Manalyze report for b850932fad7e2d0e0dacd2fec42207094a8e9b6bab83c3006dd507324a0c006d

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2023-Oct-01 00:00:00
Detected languages	English - United States
CompanyName	SAP SE
FileDescription	SAP Business One DI Server
FileVersion	`10.0.4.2`
InternalName	b1s_agent
LegalCopyright	Copyright (C) 2003-2025 SAP SE. All Rights Reserved.
OriginalFilename	b1s_agent.exe
ProductName	SAP Business One
ProductVersion	`10.0.4.2`

Plugin Output

Suspicious	PEiD Signature:	`XWD graphics format` `HQR data file`
Info	Interesting strings found in the binary:	Contains domain names: 2github.com 3github.com 4github.com birthpopuptypesapplyImagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedTermspartsGroupbrandusingwomanfalsereadyaudiotakeswhile.com genretrucklooksValueFrame.net github.com golang.org http://www.C http://www.a http://www.css http://www.hortcut http://www.icon http://www.interpretation http://www.language http://www.style http://www.text-decoration http://www.w3.org http://www.w3.org/shortcut http://www.wencodeURIComponent http://www.years https://go.dev https://swiftops7.com https://www.World https://www.recent swiftops7.com thing.org www.w3.org
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to AES`
Suspicious	The PE is possibly packed.	`Unusual section name found: .symtab`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: SwitchToThread`
Malicious	VirusTotal score: 12/71 (Scanned on 2026-10-13 19:31:25)	`AVG: Win64:MalwareX-gen [Bd]` `Alibaba: Backdoor:Application/Generic.b4144f05` `Avast: Win64:MalwareX-gen [Bd]` `Avira: BDS/W64.MalwareX` `Bkav: W32.Malware.84A5CF91` `CrowdStrike: win/malicious_confidence_100% (W)` `Cylance: Unsafe` `Elastic: malicious (high confidence)` `Google: Detected` `Kaspersky: HEUR:Backdoor.Multi.MikeDor.gen` `Rising: Backdoor.MikeDor!8.1DD02 (CLOUD)` `Sangfor: Trojan.Win32.Save.a`

Hashes

MD5	`a0f441824abd0ae544e267607ad30f74` 🔍
SHA1	`686e27dbe63d9a5bd0a72390841f1fd6674c034d` 🔍
SHA256	`b850932fad7e2d0e0dacd2fec42207094a8e9b6bab83c3006dd507324a0c006d` 🔍
SHA3	`4c1fc13150a5108ba988aae20da467d042fe1405533ec0df45e82f31cf348d44` 🔍
SSDeep	`98304:4ASv40x4UWpHAEVz3F1YAHEn1uFQsfQE0I:qgqbqg0Fu1upfp0I` 🔍
Imports Hash	`ed8b780a3ce7ca4aba78a21f6bc3d4e0` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0x8b`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`9`
TimeDateStamp	2023-Oct-01 00:00:00
PointerToSymbolTable	`0x8f3c00`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`3.0`
SizeOfCode	`0x422400`
SizeOfInitializedData	`0x89600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000000000008A0A0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`A.0`
ImageVersion	`1.0`
SubsystemVersion	`A.0`
Win32VersionValue	`0`
SizeOfImage	`0x2958000`
SizeOfHeaders	`0x600`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`a1b4b8ceef2c08a6eb6eceb10aa61416 🔍`
SHA1	`c637488aa53922c3b2732a26d8d79b9eefc64400 🔍`
SHA256	`de5bcf240f323278ac2fceb5bc361ed702e2e9670e90d6ff380b17bc098ba62d 🔍`
SHA3	`91e6e0f8cafa72bd61d9566848d93bea2567ce82c6a3582eb88020aefdc98435 🔍`
VirtualSize	`0x422371`
VirtualAddress	`0x1000`
SizeOfRawData	`0x422400`
PointerToRawData	`0x600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.21509`

.rdata

MD5	`2e8da10fac3801c9f2ff6d9d2ef4dde5 🔍`
SHA1	`401f133bc9ad3cb026fe1185ce4d0f059f3da8d9 🔍`
SHA256	`921f9b8da19661beaae35e45fd99d4036028ce586369b86bd0a98e5a4fb69190 🔍`
SHA3	`96e850a16a6285f9deffafff4cb7e46e47b99af2cc15fe4bcfaba4c535434dd0 🔍`
VirtualSize	`0x41d658`
VirtualAddress	`0x424000`
SizeOfRawData	`0x41d800`
PointerToRawData	`0x422a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.77532`

.data

MD5	`13504dd34b2450fbbb532db622e83326 🔍`
SHA1	`ad4728a93a4036dcaff75836ea812b96d9a97445 🔍`
SHA256	`086fad5d178ffd9667f146e2941541b085bbcbc6e1ee1dc4b33957c38724aa2d 🔍`
SHA3	`931a39f808ab91d92091e30b6c0f1efe9bccdcd81877396b1c9aa439ee01919e 🔍`
VirtualSize	`0x20e6218`
VirtualAddress	`0x842000`
SizeOfRawData	`0x89600`
PointerToRawData	`0x840200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.26669`

.pdata

MD5	`3c407e19881155878e7087b19cbe1ef1 🔍`
SHA1	`d0bcf9ad9666c91d047ed4a090cdaf9dde3a158b 🔍`
SHA256	`691ed67c1f33dc476ae9e666caaadf4f4ec16fdf17331fb6e7220a4b064eda99 🔍`
SHA3	`824c05bf0f5a6223c693c27e950b377c2a37446da19bd202e50375dc1755dec7 🔍`
VirtualSize	`0x16194`
VirtualAddress	`0x2929000`
SizeOfRawData	`0x16200`
PointerToRawData	`0x8c9800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.46776`

.xdata

MD5	`53bdff4b19bf972e1ccbeaa1fde37d5e 🔍`
SHA1	`d7633708283ea44bee064d8ef06ac38bc4f4a3a9 🔍`
SHA256	`1d6f341626b264134bb67d0709d11d01b2d5eb3d310c2278316ba8af0c604701 🔍`
SHA3	`49508a35ca56edae6283df53cfdbbcbc9aa684d385f179781a8bc66283cb47c8 🔍`
VirtualSize	`0xb4`
VirtualAddress	`0x2940000`
SizeOfRawData	`0x200`
PointerToRawData	`0x8dfa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.78711`

.idata

MD5	`445e3076a032f1b73270f113b46c98dd 🔍`
SHA1	`e3db440ec11b1faa76162ae63a6453f7ded0c4f2 🔍`
SHA256	`f778711b47d1f1c2a9b3702200b65b97878d9959ef7f7ac8e5435a95bc738f2c 🔍`
SHA3	`cf3728bbfaa0f348f6016a51cf680ebc2a67674cd3d5d5d167659cf747a9a0f6 🔍`
VirtualSize	`0x57c`
VirtualAddress	`0x2941000`
SizeOfRawData	`0x600`
PointerToRawData	`0x8dfc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.30775`

.reloc

MD5	`40c3f791f8397e79b61e0f06cd549c7f 🔍`
SHA1	`a1f5238ac3e7e0c2df7017a419ba0d6e3e24aa10 🔍`
SHA256	`231e5bfa649ac0cae203694a2eea1c5ee66c7e8c48b790d929328c8b488b34d0 🔍`
SHA3	`7b383bfc05b6d577b483d1dccd737007471a4b163cde3172d05514abf49c5bbf 🔍`
VirtualSize	`0x139ac`
VirtualAddress	`0x2942000`
SizeOfRawData	`0x13a00`
PointerToRawData	`0x8e0200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.45753`

.symtab

MD5	`07b5472d347d42780469fb2654b7fc54 🔍`
SHA1	`943ae54f4818e52409fbbaf60ffd71318d966b0d 🔍`
SHA256	`3e67f4a7d14b832ff2a2433e9cf0f6f5720821f67148a87c0ee2595a20c96c68 🔍`
SHA3	`a70a3e18515c06557b62676f2a8eb6d7d41962d8c9c7c49f4641c429cc65b977 🔍`
VirtualSize	`0x4`
VirtualAddress	`0x2956000`
SizeOfRawData	`0x200`
PointerToRawData	`0x8f3c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0203931`

.rsrc

MD5	`73945ea187f1b70b0993ff26d5aa046f 🔍`
SHA1	`17f380627794d5b8edca2035a17f573bf538cec0 🔍`
SHA256	`0cb9762a3aebb5232702298f1195f14aa948f072cc95573b792d57c69694fb53 🔍`
SHA3	`1b60449cc58e4d85e02236021cf95fab69b3096d24acd751b31144d58452e483 🔍`
VirtualSize	`0x850`
VirtualAddress	`0x2957000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x8f3e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.27104`

Imports

kernel32.dll	`GetProcAddress` `LoadLibraryExW` `WriteFile` `WriteConsoleW` `WerSetFlags` `WerGetFlags` `WaitForMultipleObjects` `WaitForSingleObject` `VirtualQuery` `VirtualFree` `VirtualAlloc` `TlsAlloc` `SwitchToThread` `SuspendThread` `SetWaitableTimer` `SetProcessPriorityBoost` `SetEvent` `SetErrorMode` `SetConsoleCtrlHandler` `RtlVirtualUnwind` `RtlLookupFunctionEntry` `ResumeThread` `RaiseFailFastException` `QueryPerformanceCounter` `PostQueuedCompletionStatus` `LoadLibraryExW` `SetThreadContext` `GetThreadContext` `GetSystemInfo` `GetSystemDirectoryA` `GetStdHandle` `GetQueuedCompletionStatusEx` `GetProcessAffinityMask` `GetProcAddress` `GetErrorMode` `GetEnvironmentStringsW` `GetCurrentThreadId` `GetConsoleMode` `FreeEnvironmentStringsW` `ExitProcess` `DuplicateHandle` `CreateWaitableTimerExW` `CreateThread` `CreateIoCompletionPort` `CreateEventA` `CloseHandle` `AddVectoredExceptionHandler` `AddVectoredContinueHandler`

Delayed Imports

1

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x324`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.4361`
MD5	`8c97e7715d7eb52a07acabd291dd0308 🔍`
SHA1	`629e398c0da4ac13da16b8ee3713ee76a72220b5 🔍`
SHA256	`0ca00dd170f6d2e64ee100a42c19b03a5347913c9c2ac0a2eb065e9491769e45 🔍`
SHA3	`3a3a52fca511f0e574e54236ce63e5547fa27ec0ecdc0abaff6908a7ed3d6faf 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x482`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.11213`
MD5	`4a0b87de0fa649f67519ae350304c5ec 🔍`
SHA1	`056cef90b8450c0806d5b9127f2679fa65321e9e 🔍`
SHA256	`bfa75b5c647f552fdda6991ec539434a891c9481ca5c0cc786ae20d4629fa23c 🔍`
SHA3	`5292d55f939d7f67d139ef0dcedb0020f2f92ed0e74a3c5eb1613344a3d732e6 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	10.0.4.2
ProductVersion	10.0.4.2
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	SAP SE
FileDescription	SAP Business One DI Server
FileVersion (#2)	10.0.4.2
InternalName	b1s_agent
LegalCopyright	Copyright (C) 2003-2025 SAP SE. All Rights Reserved.
OriginalFilename	b1s_agent.exe
ProductName	SAP Business One
ProductVersion (#2)	10.0.4.2

Resource LangID	English - United States

TLS Callbacks

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0`

RICH Header

Errors

Leave a comment

No comments yet.