c4394fb4daaf350cdbf5303d812e917e
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Oct-23 00:10:59 |
| Comments | |
| CompanyName | master131 |
| FileDescription | Extreme Injector |
| FileVersion | 3.7.2.0 |
| InternalName | Extreme Injector.exe |
| LegalCopyright | Copyright © 2017 |
| LegalTrademarks | master131 |
| OriginalFilename | Extreme Injector.exe |
| ProductName | Extreme Injector |
| ProductVersion | 3.7.2.0 |
| Assembly Version | 3.7.2.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | PEiD Signature: | Crunch 4 |
| Malicious | VirusTotal score: 43/73 (Scanned on 2020-06-25 04:07:20) |
MicroWorld-eScan:
Application.Hacktool.ANO
FireEye: Generic.mg.c4394fb4daaf350c CAT-QuickHeal: PUA.InjectorFC.S12590146 Cylance: Unsafe Zillya: Trojan.DllInject.Win32.356 SUPERAntiSpyware: Trojan.Agent/Gen-Injector Sangfor: Malware CrowdStrike: win/malicious_confidence_90% (W) K7GW: Unwanted-Program ( 00520cc31 ) K7AntiVirus: Unwanted-Program ( 00520cc31 ) Arcabit: Application.Hacktool.ANO Invincea: heuristic Symantec: Trojan.Gen.2 APEX: Malicious Paloalto: generic.ml Kaspersky: not-a-virus:HEUR:RiskTool.MSIL.Generic BitDefender: Application.Hacktool.ANO NANO-Antivirus: Trojan.Win32.DllInject.fcluxu AegisLab: Trojan.Win32.Generic.llVQ Ad-Aware: Application.Hacktool.ANO Sophos: Generic PUA GK (PUA) Comodo: Malware@#1nuni5recb1ux VIPRE: Trojan.Win32.Generic!BT TrendMicro: TROJ_GEN.R002C0PF420 McAfee-GW-Edition: GenericRXFK-KY!C4394FB4DAAF Emsisoft: Application.Hacktool.ANO (B) Webroot: W32.Injector Fortinet: W32/DllInject.XQ!tr Antiy-AVL: Trojan/Win32.BTSGeneric Endgame: malicious (high confidence) Microsoft: PUA:Win32/Presenoker ZoneAlarm: not-a-virus:HEUR:RiskTool.MSIL.Generic AhnLab-V3: HackTool/Win32.Injector.C3340657 McAfee: GenericRXFK-KY!C4394FB4DAAF MAX: malware (ai score=100) Malwarebytes: RiskWare.Injector.DC ESET-NOD32: a variant of MSIL/DllInject.XQ potentially unsafe TrendMicro-HouseCall: TROJ_GEN.R002C0PF420 Yandex: Trojan.Igent.bTKAcV.30 eGambit: Unsafe.AI_Score_99% GData: Application.Hacktool.ANO Panda: Trj/RnkBend.A MaxSecure: Trojan.Malware.7164915.susgen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2017-Oct-23 00:10:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x1dee00 |
| SizeOfInitializedData | 0x4e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001E0C1E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x1e2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1ea000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0x79844151 |
| NumberOfRvaAndSizes | 15 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 3.7.2.0 |
| ProductVersion | 3.7.2.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | master131 |
| FileDescription | Extreme Injector |
| FileVersion (#2) | 3.7.2.0 |
| InternalName | Extreme Injector.exe |
| LegalCopyright | Copyright © 2017 |
| LegalTrademarks | master131 |
| OriginalFilename | Extreme Injector.exe |
| ProductName | Extreme Injector |
| ProductVersion (#2) | 3.7.2.0 |
| Assembly Version | 3.7.2.0 |
| Resource LangID | UNKNOWN |
|---|