Manalyze report for 9e8f4d1471503d5a8ca63f1334dd72e7d9d182dd9014293a91bc2d4e109c23b4

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2079-Mar-30 03:03:25
Comments
CompanyName
FileDescription	AI
FileVersion	`1.0.0.0`
InternalName	AI.exe
LegalCopyright	Copyright Â© 2026
LegalTrademarks
OriginalFilename	AI.exe
ProductName	AI
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Looks for Qemu presence: qeMu`
Suspicious		Unusual section name found: .`2& `Unusual section name found: .kJc` `Unusual section name found: .vEs`
Malicious	VirusTotal score: 22/70 (Scanned on 2026-06-03 07:41:21)	`ALYac: Gen:Variant.Tedy.818598` `APEX: Malicious` `Arcabit: Trojan.Tedy.DC7DA6` `BitDefender: Gen:Variant.Tedy.818598` `Bkav: W32.Malware.F623BD3F` `CTX: exe.unknown.tedy` `CrowdStrike: win/malicious_confidence_100% (D)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `ESET-NOD32: MSIL/Packed.VMProtect.E suspicious application` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Variant.Tedy.818598 (B)` `GData: Gen:Variant.Tedy.818598` `Gridinsoft: Trojan.Heur!.022134A1` `Ikarus: PUA.MSIL.Vmprotect` `Kingsoft: malware.kb.c.991` `McAfeeD: Real Protect-LS!B93A0820E1FC` `MicroWorld-eScan: Gen:Variant.Tedy.818598` `Microsoft: Trojan:Win32/Wacatac.B!ml` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `VIPRE: Gen:Variant.Tedy.818598`

Hashes

MD5	`b93a0820e1fcc63619b5f5236a5a2699`
SHA1	`fd5f7ef668746291b255b0444fed3b9cbf60779b`
SHA256	`9e8f4d1471503d5a8ca63f1334dd72e7d9d182dd9014293a91bc2d4e109c23b4`
SHA3	`2d190bbe97888a716b1b15ff8b95178cee52609ce8f1987b0c68eb007ff735bc`
SSDeep	`98304:k7rsMe3UBJAhl0Mlgl+LHaYg9SYBdYyzZPBpPP9o692+KT4YglDbGRBQDSvw/tY:k7LwUaatl+LHbg9ZBdYy1v92ZUS7i`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`6`
TimeDateStamp	2079-Mar-30 03:03:25
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x2b8c00`
SizeOfInitializedData	`0xf800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00B95A33 (Section: .vEs)`
BaseOfCode	`0x2000`
BaseOfData	`0x2bc000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0xc82000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x2b8a34`
VirtualAddress	`0x2000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.`2&

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x3070e3`
VirtualAddress	`0x2bc000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.kJc

MD5	`06ebf36a6ced7f9384734a4fbd8b3774`
SHA1	`7081028b5d4e9561496f1326cee23805b112b165`
SHA256	`e41920328764a6f41ce9d88756c41be73451e5896f5f918506ccd8431a350363`
SHA3	`37e39d10249f2b382e0b32c8fa3ae887c33a7fcfef3727404f25f579bc7a4583`
VirtualSize	`0x8`
VirtualAddress	`0x5c4000`
SizeOfRawData	`0x200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.0611629`

.vEs

MD5	`b1dd0eeb016b0ac7596e727dbd3dd239`
SHA1	`be78f1c73404563698402f1a911490bb63be62e7`
SHA256	`1757e84b8b81e56c50d0ed434b611b18a8bc6b3012997bb66da37fed066f80c4`
SHA3	`5109fca47a921fe0d0aaf49f1aea4c90ae0541ac01c5764d766de1f9e985b0f7`
VirtualSize	`0x6a9d54`
VirtualAddress	`0x5c6000`
SizeOfRawData	`0x6a9e00`
PointerToRawData	`0x600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.94191`

.rsrc

MD5	`20993d87f34e47d7d03e2941e7598ce9`
SHA1	`0e6497dcc7fd9834a2793e3f31bb9836b597631a`
SHA256	`6200b81a4642bd241c25f24f5080375d5f8dafb9999cb96aecbb5ac42110f316`
SHA3	`c98b91c777599433a86f3cc477f82de028a4d7c671ef5b4f917f7c89189c219c`
VirtualSize	`0xf524`
VirtualAddress	`0xc70000`
SizeOfRawData	`0xf600`
PointerToRawData	`0x6aa400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.93881`

.reloc

MD5	`feb1fa7a94220ee0d0da5b246983b924`
SHA1	`3fbad72831838be68b119d1efc4391feccde69bd`
SHA256	`448412349c3a0be11354195d89a6f273bfeb2a25a0df479d20a207c50bb0607e`
SHA3	`fe352b8c07d86be2f6f2a6353162177774de31d411bb912eb4d59554e991fc25`
VirtualSize	`0xc`
VirtualAddress	`0xc80000`
SizeOfRawData	`0x200`
PointerToRawData	`0x6b9a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.122276`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xe39c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9854`
Detected Filetype	PNG graphic file
MD5	`518ca41dba3f8968359145df3b1dfd10`
SHA1	`6e4d6eba639d2fe5f2375ca4637bca9f4fd92ad5`
SHA256	`45098a98dd6eec2e23bde3501786bc6d0a83315b4ed7a552e7f4890bbffae8aa`
SHA3	`4a271fc4e9f7e8452ff0f9a0e93684dca8612e9f82d4e7be2835a1bd473bf91e`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.51664`
Detected Filetype	Icon file
MD5	`c7683cee2ce3bd4a4f8b022eb269791f`
SHA1	`c4abe6c5883ea12cb6b96bea2a437d062553bfbb`
SHA256	`2cf0cfabe3ccd77add0c014f5ac8618c98a0d55bd228f588fd5b9eed69ce6d04`
SHA3	`21073604bb514ce05853b789a61f49d35ed80d1bc31424e6dcc2678b28b6a450`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2ec`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.22375`
MD5	`6605233a2ef516e111273e31c4d6fab3`
SHA1	`68afe8e29268b7b48f81f862a2a0f6a34c31e056`
SHA256	`93807be736c2ffca34c9e138fafa2036456411fae41b979ee7998bc1fff93b73`
SHA3	`6d87ae849e0c5672d5ea47858d353b6115d1d71b44cd05af4d6a55a7c2f3907c`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xd53`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.01752`
MD5	`a99c09dbd4a65da324e2d732f5351786`
SHA1	`164d3ec47c9487bd42d9ec580fb730a61dc156d7`
SHA256	`59c778ad5af1032a264960d8cf35e7b4226e9ab5d1d9cbe91d4f93b347768b88`
SHA3	`5e12a029662dd5cc2e838e5e40d2e0715685e718c429233ccb2e35881abdd4e6`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription	AI
FileVersion (#2)	1.0.0.0
InternalName	AI.exe
LegalCopyright	Copyright Â© 2026
LegalTrademarks
OriginalFilename	AI.exe
ProductName	AI
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .text has a size of 0!
[*] Warning: Section .`2& has a size of 0!

Leave a comment

No comments yet.