bbfc5c83239c1360b3a6bc855f801eca
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Mar-22 12:23:16 |
| CompanyName | Zanoza Software LLC |
| FileDescription | ZModeler3 |
| FileVersion | 1.0.0.1231 |
| InternalName | ZModeler3.exe |
| LegalCopyright | Copyright © 2002-2023 |
| OriginalFilename | ZModeler3.exe |
| ProductName | ZModeler |
| ProductVersion | 1.0.0.1231 |
| Assembly Version | 1.0.0.1231 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Malicious | VirusTotal score: 54/72 (Scanned on 2024-06-06 15:56:53) |
ALYac:
Gen:Variant.Jalapeno.10718
APEX: Malicious AVG: Win32:RATX-gen [Trj] AhnLab-V3: Trojan/Win.Generic.C5604394 Alibaba: Trojan:MSIL/Generic.c5f3c213 Antiy-AVL: Trojan[Dropper]/MSIL.Agent Arcabit: Trojan.Jalapeno.D29DE Avast: Win32:RATX-gen [Trj] Avira: TR/Dropper.Gen2 BitDefender: Gen:Variant.Jalapeno.10718 BitDefenderTheta: Gen:NN.ZemsilF.36806.@p0@amytOZg Bkav: W32.AIDetectMalware.CS Cybereason: malicious.3239c1 Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.Siggen28.47342 ESET-NOD32: a variant of MSIL/TrojanDropper.Agent.FZX Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Jalapeno.10718 (B) F-Secure: Trojan.TR/Dropper.Gen2 FireEye: Generic.mg.bbfc5c83239c1360 Fortinet: Adware/Agent GData: Gen:Variant.Jalapeno.10718 Ikarus: Trojan.MSIL.Agent Jiangmin: Trojan.MSIL.aozue K7AntiVirus: Trojan ( 005af2fa1 ) K7GW: Trojan ( 005af2fa1 ) Kaspersky: HEUR:Trojan.MSIL.PowerShell.gen Lionic: Trojan.Win32.PowerShell.4!c MAX: malware (ai score=81) Malwarebytes: Malware.AI.4274042924 MaxSecure: Trojan.Malware.74168641.susgen McAfee: Artemis!BBFC5C83239C McAfeeD: ti!F822CAB6AB88 MicroWorld-eScan: Gen:Variant.Jalapeno.10718 Microsoft: Trojan:Win64/Reflo.HNS!MTB Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Malware.Obfus/MSIL@AI.85 (RDM.MSIL2:TythOFQqDk7DSW7qVpbJpg) Sangfor: Dropper.Msil.Agent.Vh03 SentinelOne: Static AI - Malicious PE Skyhigh: Artemis Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.14066a52 Trapmine: malicious.high.ml.score TrendMicro: TROJ_GEN.R002C0XCN24 TrendMicro-HouseCall: TROJ_GEN.R002C0XCN24 VIPRE: Gen:Variant.Jalapeno.10718 Varist: W32/ABTrojan.JQUI-8500 Webroot: W32.Trojan.TR.Dropper.Gen2 Zillya: Dropper.Agent.Win32.578576 ZoneAlarm: HEUR:Trojan.MSIL.PowerShell.gen alibabacloud: Trojan[dropper]:MSIL/PowerShell.gen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2024-Mar-22 12:23:16 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x4e0800 |
| SizeOfInitializedData | 0x4c600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x004E2731 (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x4e4000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x534000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
7
8
9
1 (#2)
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.1231 |
| ProductVersion | 1.0.0.1231 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | Zanoza Software LLC |
| FileDescription | ZModeler3 |
| FileVersion (#2) | 1.0.0.1231 |
| InternalName | ZModeler3.exe |
| LegalCopyright | Copyright © 2002-2023 |
| OriginalFilename | ZModeler3.exe |
| ProductName | ZModeler |
| ProductVersion (#2) | 1.0.0.1231 |
| Assembly Version | 1.0.0.1231 |
| Resource LangID | UNKNOWN |
|---|