cb706977acf35640a9b1158423f571cc
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Jul-09 22:49:11 |
| Comments | Coding Inc |
| CompanyName | Coding Inc |
| FileDescription | Remote Assistance |
| FileVersion | 5.1.545.1 |
| InternalName | Remote Assistance.exe |
| LegalCopyright | Copyright © 2013 - 2017 |
| ProductName | Remote Assistance |
| ProductVersion | 5.1.545.1 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 8.0
.NET DLL -> Microsoft .NET executable -> Microsoft |
| Malicious | VirusTotal score: 29/64 (Scanned on 2017-07-11 06:50:39) |
Baidu:
Win32.Trojan.WisdomEyes.16070401.9500.9999
F-Prot: W32/MSIL_Injector.KQ.gen!Eldorado Symantec: Trojan.Gen TrendMicro-HouseCall: TROJ_GEN.F0D1H00G917 Avast: Win32:Malware-gen Kaspersky: Trojan.Win32.Neurevt.znc Paloalto: generic.ml AegisLab: Troj.W32.Neurevt!c Tencent: Win32.Trojan.Inject.Auto Endgame: malicious (high confidence) DrWeb: Trojan.MulDrop7.31813 VIPRE: Trojan.Win32.Generic!BT Invincea: heuristic McAfee-GW-Edition: BehavesLike.Win32.BadFile.jh Sophos: Mal/Generic-S Cyren: W32/MSIL_Injector.KQ.gen!Eldorado Avira: TR/Dropper.MSIL.ppryl Antiy-AVL: Trojan/Win32.Neurevt ZoneAlarm: Trojan.Win32.Neurevt.znc GData: Win32.Trojan.BetaBot.E80FV3 McAfee: GenericRXBY-NP!CB706977ACF3 AVware: Trojan.Win32.Generic!BT Malwarebytes: Spyware.PasswordStealer.Gen ESET-NOD32: a variant of MSIL/Injector.SOJ Rising: Malware.Undefined!8.C (cloud:B9Gimg9je0B) SentinelOne: static engine - malicious AVG: Win32:Malware-gen Panda: Trj/GdSda.A CrowdStrike: malicious_confidence_100% (W) |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2017-Jul-09 22:49:11 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x48c00 |
| SizeOfInitializedData | 0x5b000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0004ABEE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xaa000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
50
51
52
53
54
55
1
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 5.1.545.1 |
| ProductVersion | 5.1.545.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | Coding Inc |
| CompanyName | Coding Inc |
| FileDescription | Remote Assistance |
| FileVersion (#2) | 5.1.545.1 |
| InternalName | Remote Assistance.exe |
| LegalCopyright | Copyright © 2013 - 2017 |
| ProductName | Remote Assistance |
| ProductVersion (#2) | 5.1.545.1 |
| Resource LangID | UNKNOWN |
|---|