befd43899d3fd6441ae166811caf6c71c5f28cded92b567562b5186d942e6cd2
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Mar-12 16:16:39 |
| Comments | |
| CompanyName | AU88 |
| FileDescription | Official premium betting and entertainment platform. Offering sports betting, live casino, slot games, lottery, and exclusive VIP rewards. Fast payout, high odds, secure transactions, and professional customer service. The ultimate destination for serious players. |
| FileVersion | 4.1.8.2 |
| InternalName | au88elite |
| LegalCopyright | © 2026 AU88 Elite Entertainment |
| LegalTrademarks | AU88⢠|
| OriginalFilename | au88elite |
| ProductName | AU88 Elite |
| ProductVersion | 4.1.8.2 |
| Assembly Version | 4.1.8.2 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses constants related to RC5 or RC6 Uses constants related to Twofish Uses constants related to TEA |
| Malicious | VirusTotal score: 50/63 (Scanned on 2026-05-13 14:00:16) |
ALYac:
Gen:Variant.Application.fca.3927
APEX: Malicious AhnLab-V3: Backdoor/Win32.QuasarRAT.R341693 Alibaba: Backdoor:MSIL/Quasar.2fed8328 Antiy-AVL: Trojan/MSIL.Quasar Arcabit: Trojan.Application.fca.DF57 Avira: TR/Quasar.A BitDefender: Gen:Variant.Application.fca.3927 Bkav: W32.Malware.33F0574A CAT-QuickHeal: Trojan.Generic.TRFH927 CTX: exe.unknown.generic ClamAV: Win.Malware.Generic-9883083-0 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: BackDoor.Quasar.299 ESET-NOD32: MSIL/Agent.CLQ trojan Elastic: Windows.Generic.Threat Emsisoft: Gen:Variant.Application.fca.3927 (B) F-Secure: Trojan.TR/Quasar.A Fortinet: MSIL/Agent.BPH!tr GData: MSIL.Backdoor.Quasar.A Google: Detected Gridinsoft: Trojan.Win32.Agent.sa Ikarus: Trojan-Spy.Agent Jiangmin: Trojan.MSIL.aogzw K7AntiVirus: Trojan ( 005b1c021 ) K7GW: Trojan ( 005b1c021 ) Kaspersky: HEUR:Trojan.MSIL.Quasar.gen Kingsoft: MSIL.Trojan.Quasar.gen Lionic: Trojan.Win32.Quasar.4!c Malwarebytes: Backdoor.Quasar McAfeeD: Trojan:Win/QuasarRAT.AA MicroWorld-eScan: Gen:Variant.Application.fca.3927 Microsoft: Backdoor:MSIL/Quasar!atmn NANO-Antivirus: Trojan.Win32.Quasar.lelzaq Paloalto: generic.ml Panda: Trj/CI.A Rising: Backdoor.Quasar!1.E5F1 (CLASSIC) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Sophos: Troj/Quasar-AF Tencent: Backdoor.Msil.Quasar.16001301 VBA32: Trojan.MSIL.Quasar.Heur VIPRE: Gen:Variant.Application.fca.3927 Varist: W32/MSIL_Troj.BTX.gen!Eldorado VirIT: Trojan.Win32.MSIL_Heur.B ZoneAlarm: Troj/Quasar-AF alibabacloud: Backdoor:MSIL/Quasar.server huorong: Trojan/MSIL.Obfuscated.g!crit |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2023-Mar-12 16:16:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x31c800 |
| SizeOfInitializedData | 0x29800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0031E65E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x34c000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
1 (#2)
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 4.1.8.2 |
| ProductVersion | 4.1.8.2 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | AU88 |
| FileDescription | Official premium betting and entertainment platform. Offering sports betting, live casino, slot games, lottery, and exclusive VIP rewards. Fast payout, high odds, secure transactions, and professional customer service. The ultimate destination for serious players. |
| FileVersion (#2) | 4.1.8.2 |
| InternalName | au88elite |
| LegalCopyright | © 2026 AU88 Elite Entertainment |
| LegalTrademarks | AU88⢠|
| OriginalFilename | au88elite |
| ProductName | AU88 Elite |
| ProductVersion (#2) | 4.1.8.2 |
| Assembly Version | 4.1.8.2 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.