a24d5a8f6a916fe976face1f145cf297
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2019-Sep-27 08:59:07 |
| Debug artifacts |
G:\VisualStudioProjects_CN\RemoteTool\RemoteTool\obj\Release\MSAService.pdb
|
| Comments | |
| CompanyName | |
| FileDescription | Microsoft Security Application |
| FileVersion | 1.0.0.0 |
| InternalName | MSAService.exe |
| LegalCopyright | Copyright © 2018 |
| LegalTrademarks | |
| OriginalFilename | MSAService.exe |
| ProductName | Microsoft Security Application |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | .NET executable -> Microsoft |
| Malicious | VirusTotal score: 8/69 (Scanned on 2019-10-19 17:47:11) |
McAfee:
Artemis!A24D5A8F6A91
APEX: Malicious Endgame: malicious (moderate confidence) McAfee-GW-Edition: Artemis!Trojan SentinelOne: DFI - Suspicious PE AhnLab-V3: Malware/Win32.RL_Generic.C3508355 Rising: Trojan.Agent!8.B1E (TFE:D:4WwkVUwu4lK) CrowdStrike: win/malicious_confidence_60% (W) |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2019-Sep-27 08:59:07 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0xae00 |
| SizeOfInitializedData | 0xf200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000CA9E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0xe000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x20000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | Microsoft Security Application |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | MSAService.exe |
| LegalCopyright | Copyright © 2018 |
| LegalTrademarks | |
| OriginalFilename | MSAService.exe |
| ProductName | Microsoft Security Application |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2019-Sep-27 08:59:07 |
| Version | 0.0 |
| SizeofData | 284 |
| AddressOfRawData | 0xc930 |
| PointerToRawData | 0xab30 |
| Referenced File | G:\VisualStudioProjects_CN\RemoteTool\RemoteTool\obj\Release\MSAService.pdb |