Manalyze report for c1e8ea0ebbe41a5714caca4fc85046de84dd82553379c16b7f83b0c7fc8ce20a

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Apr-21 00:27:49
Detected languages	English - United States
CompanyName	SilverLine
FileDescription	DesktopWorkspaceSync Component
FileVersion	`1.0.0.0`
InternalName	DesktopWorkspaceSync.exe
LegalCopyright	Copyright ÃÂ© SilverLine 2026
OriginalFilename	DesktopWorkspaceSync.exe
ProductName	DesktopWorkspaceSync
ProductVersion	`1.0.0.0`

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Info	The PE is digitally signed.	`Signer: MyStubCert` `Issuer: MyStubCert`
Malicious	VirusTotal score: 41/72 (Scanned on 2026-04-22 22:55:15)	`ALYac: IL:Trojan.MSILZilla.245852` `AVG: Win32:MalwareX-gen [Cryp]` `AhnLab-V3: Trojan/Win.Generic.C5853754` `Alibaba: Trojan:MSIL/Shellcode.b4bbc157` `Antiy-AVL: Trojan/MSIL.Kryptik` `Arcabit: IL:Trojan.MSILZilla.D3C05C` `Avast: Win32:MalwareX-gen [Cryp]` `BitDefender: IL:Trojan.MSILZilla.245852` `Bkav: W32.AIDetectMalware.CS` `CTX: exe.trojan.msil` `CrowdStrike: win/malicious_confidence_100% (W)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `ESET-NOD32: MSIL/Kryptik.AOLT trojan` `Elastic: malicious (high confidence)` `Emsisoft: IL:Trojan.MSILZilla.245852 (B)` `GData: IL:Trojan.MSILZilla.245852` `Google: Detected` `Gridinsoft: Trojan.Win32.Kryptik.sa` `K7AntiVirus: Unwanted-Program ( 700000201 )` `K7GW: Unwanted-Program ( 700000201 )` `Kaspersky: HEUR:Trojan.MSIL.Shellcode.gen` `Kingsoft: MSIL.Trojan.Shellcode.gen` `Malwarebytes: Trojan.ShellCode.MSIL.Generic` `McAfeeD: ti!C1E8EA0EBBE4` `MicroWorld-eScan: IL:Trojan.MSILZilla.245852` `Microsoft: Trojan:Win32/Wacatac.B!ml` `Paloalto: generic.ml` `Panda: Trj/GdSda.A` `Rising: Malware.Obfus/MSIL@AI.94 (RDM.MSIL2:+iwQCXoI073EwZudq5svjQ)` `Sangfor: Trojan.Msil.Agent.Vmwl` `SentinelOne: Static AI - Malicious PE` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `Tencent: Win32.Trojan.FalseSign.Vylw` `Trapmine: suspicious.low.ml.score` `TrellixENS: Artemis!B4352B63AFAF` `TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z` `VIPRE: IL:Trojan.MSILZilla.245852` `Varist: W32/MSIL_Kryptik.NAB.gen!Eldorado` `alibabacloud: Trojan:MSIL/Wacatac.B9nj`

Hashes

MD5	`b4352b63afaf0d6888c9f5f4b250668e`
SHA1	`1656334adf66a7d04de72119fade56652898c366`
SHA256	`c1e8ea0ebbe41a5714caca4fc85046de84dd82553379c16b7f83b0c7fc8ce20a`
SHA3	`3834377a875dcd83903cd9c36b0f0eb17c1abd10810d9730ea08f61e1c74d596`
SSDeep	`6144:IeLKqFnq0nq0nyw9r9c5X46ZwuJD2gbWusPDjMs/FX+8i8z/xE:I2KKnq0nq1wyKgiPDYs/FXguE`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Apr-21 00:27:49
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x16f200`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0017111E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x172000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x176000`
SizeOfHeaders	`0x200`
Checksum	`0x179df5`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`de8e9c0a2a62951daaa760a4a80feb2f`
SHA1	`03d24c53be47aa56a097e8d5525413c6c67992dc`
SHA256	`ff9cdc7d9e51e47ee777c18824702ff305c979b484b2131d0937142b43004fa6`
SHA3	`3aa4dd819c44fbfb11ad032505ab5b097e8cd1e1c16a4d8c9dd100fa3f363bef`
VirtualSize	`0x16f124`
VirtualAddress	`0x2000`
SizeOfRawData	`0x16f200`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.19162`

.rsrc

MD5	`aa4da1d5fed65e1d08955619afc5041d`
SHA1	`54d3c7d632afaa9965f8188ee6a6171588ecbb94`
SHA256	`a3ce3fadb55f534c1cab9f3f453d61b680eb85df1fe10a9a88a917bd12de82c1`
SHA3	`70210784fb742d3fd780ec0c94c46dedc9940e63bd79133d1f31f36735c0b763`
VirtualSize	`0x550`
VirtualAddress	`0x172000`
SizeOfRawData	`0x600`
PointerToRawData	`0x16f400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.74947`

.reloc

MD5	`85fe53d04a206783ef64c466075db23e`
SHA1	`45573accaae75c901fa1de0efd0bfa21c5ad2840`
SHA256	`86a146fbfb102870f512338b950697362b9731d8b569c7bed904897261153307`
SHA3	`0f2850d400f365659ade41c638d9a9f032b521c1cca319e0570eeebdad57b8d0`
VirtualSize	`0xc`
VirtualAddress	`0x174000`
SizeOfRawData	`0x200`
PointerToRawData	`0x16fa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x33c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.35185`
MD5	`41f7529990315c10c2dd468b60b2c813`
SHA1	`36c34b85979afd6f7cd11f3f0db3b3e72c13581e`
SHA256	`6366d94d8159c7d3d3f0b51a1eabba42e056d026d441977422e9f4a5b5d3758e`
SHA3	`56e508ad415b270432dd6a0056da2a1cd8b7e79d76163e59373107b0a0f94f2a`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x16c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.85909`
MD5	`440f8c05a8f32a8fee87e66ccbab39ca`
SHA1	`c0973c8546ee3c16eba6285d518680af10b7446a`
SHA256	`c19e8797eb05a317b0b0abc4ceab9e326a287484d636227f7b7da7c15283c1de`
SHA3	`600df803fddbeb11aaa97c4ea795045b9ffb31067ca7d04bccc15a69fbd8cdc9`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	SilverLine
FileDescription	DesktopWorkspaceSync Component
FileVersion (#2)	1.0.0.0
InternalName	DesktopWorkspaceSync.exe
LegalCopyright	Copyright ÃÂ© SilverLine 2026
OriginalFilename	DesktopWorkspaceSync.exe
ProductName	DesktopWorkspaceSync
ProductVersion (#2)	1.0.0.0

Resource LangID	English - United States

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.