96b01bbab000c95f7833fb7696834d9b
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-May-23 09:54:55 |
| Detected languages |
English - United States
|
| Comments | This installation was built with Inno Setup. |
| CompanyName | X-NET |
| FileDescription | Restorator 2007 Setup |
| FileVersion | |
| LegalCopyright | |
| ProductName | Restorator 2007 |
| ProductVersion | 3.70.1747 |
Plugin Output
| Suspicious |
Unusual section name found: C\x04\x12"\x1ah\x02\x13
Section C\x04\x12"\x1ah\x02\x13 is both writable and executable. Unusual section name found: |
|
| Info | The PE is digitally signed. |
Signer: AgileBits Inc.
Issuer: COMODO RSA Code Signing CA |
| Malicious | VirusTotal score: 45/67 (Scanned on 2018-03-29 02:03:07) |
MicroWorld-eScan:
Trojan.GenericKD.30373811
CAT-QuickHeal: Trojan.Multi ALYac: Trojan.Ransom.Crysis VIPRE: Trojan.Win32.Generic!BT K7AntiVirus: Trojan ( 005250141 ) K7GW: Trojan ( 005250141 ) Baidu: Win32.Trojan.WisdomEyes.16070401.9500.9927 Cyren: W32/Trojan.VJRA-5714 Symantec: Trojan.Gen.2 TrendMicro-HouseCall: Ransom_GENASOM.THBAFJ Paloalto: generic.ml Kaspersky: Trojan-Ransom.Win32.Crusis.cbp BitDefender: Trojan.GenericKD.30373811 NANO-Antivirus: Trojan.Win32.Crusis.eyoyzx AegisLab: Uds.Dangerousobject.Multi!c Tencent: Win32.Trojan.Crusis.Huyy Ad-Aware: Trojan.GenericKD.30373811 Sophos: Mal/Generic-S Comodo: .UnclassifiedMalware DrWeb: Trojan.Encoder.3953 TrendMicro: Ransom_GENASOM.THBAFJ McAfee-GW-Edition: Generic.dbq Emsisoft: Trojan.GenericKD.30373811 (B) SentinelOne: static engine - malicious Avira: TR/Dropper.MSIL.ezxxr Fortinet: MSIL/Kryptik.MNQ!tr Antiy-AVL: Trojan[Ransom]/Win32.AGeneric Endgame: malicious (high confidence) ZoneAlarm: Trojan-Ransom.Win32.Crusis.cbp Microsoft: Ransom:Win32/Genasom AhnLab-V3: Trojan/Win32.Kryptik.C2444184 McAfee: Generic.dbq AVware: Trojan.Win32.Generic!BT VBA32: TrojanRansom.Genasom Cylance: Unsafe Panda: Trj/GdSda.A ESET-NOD32: a variant of MSIL/Kryptik.MNQ Ikarus: Trojan.Inject eGambit: PE.Heur.InvalidSig GData: Trojan.GenericKD.30373811 AVG: Win32:Ransom-AZY [Trj] Cybereason: malicious.ed4375 Avast: Win32:Ransom-AZY [Trj] CrowdStrike: malicious_confidence_100% (W) Qihoo-360: Win32/Trojan.Ransom.067 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2017-May-23 09:54:55 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x6800 |
| SizeOfInitializedData | 0x4d400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0005A00A (Section: ) |
| BaseOfCode | 0x2e000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x5c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x61736 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
C\x04\x12"\x1ah\x02\x13
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
7
4089
4090
4091
4093
4094
4095
11111
MAINICON
1 (#2)
1 (#3)
String Table contents
| '%s' is not a valid integer value |
| '%s' is not a valid floating point value |
| '%s' is not a valid date |
| '%s' is not a valid time |
| '%s' is not a valid date and time |
| Invalid argument to time encode |
| Invalid argument to date encode |
| Out of memory |
| I/O error %d |
| File not found |
| Invalid filename |
| Too many open files |
| File access denied |
| Read beyond end of file |
| Disk full |
| Invalid numeric input |
| Division by zero |
| Range check error |
| Integer overflow |
| Invalid floating point operation |
| Floating point division by zero |
| Floating point overflow |
| Floating point underflow |
| Invalid pointer operation |
| Invalid class typecast |
| Access violation at address %p. %s of address %p |
| Stack overflow |
| Control-C hit |
| Privileged instruction |
| Operation aborted |
| Exception %s in module %s at %p. |
| %s%s |
| Application Error |
| Format '%s' invalid or incompatible with argument |
| No argument for format '%s' |
| Invalid variant type conversion |
| Invalid variant operation |
| Variant method calls not supported |
| Read |
| Write |
| Format result longer than 4096 characters |
| Format string too long |
| Error creating variant array |
| Variant is not an array |
| Variant array index out of bounds |
| External exception %x |
| Jan |
| Feb |
| Mar |
| Apr |
| May |
| Jun |
| Jul |
| Aug |
| Sep |
| Oct |
| Nov |
| Dec |
| January |
| February |
| March |
| April |
| May |
| June |
| July |
| August |
| September |
| October |
| November |
| December |
| Sun |
| Mon |
| Tue |
| Wed |
| Thu |
| Fri |
| Sat |
| Sunday |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Saturday |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | This installation was built with Inno Setup. |
| CompanyName | X-NET |
| FileDescription | Restorator 2007 Setup |
| FileVersion (#2) | |
| LegalCopyright | |
| ProductName | Restorator 2007 |
| ProductVersion (#2) | 3.70.1747 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: [plugin_authenticode] Hashing algorithm 1.2.840.1015.13.2.5 is not supported.