d96ee9703c6b3dc6289b9d7da7ff7569f81c54028473c8605a3e72306e796ad2
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2095-Oct-14 01:05:29 |
| Comments | |
| CompanyName | |
| FileDescription | PhraseExpressKeygen |
| FileVersion | 1.0.0.0 |
| InternalName | PhraseExpressKeygen.exe |
| LegalCopyright | Copyright © 2021 |
| LegalTrademarks | |
| OriginalFilename | PhraseExpressKeygen.exe |
| ProductName | PhraseExpressKeygen |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | The file contains overlay data. | 16 bytes of data starting at offset 0x84c00. |
| Malicious | VirusTotal score: 49/63 (Scanned on 2026-04-07 04:34:11) |
ALYac:
Gen:Variant.MSILHeracles.31115
APEX: Malicious AhnLab-V3: Trojan/Win32.Agent.C59497 Alibaba: Trojan:Win32/AgentTesla.b5eac85c Arcabit: Trojan.MSILHeracles.D798B Avira: TR/Crypt.XPACK.Gen7 Bkav: W32.AIDetectMalware.CS CAT-QuickHeal: Trojan.YakbeexMSIL.ZZ4 CTX: exe.trojan.msil CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.PackedNET.620 ESET-NOD32: MSIL/Kryptik.CHY trojan Elastic: malicious (high confidence) Emsisoft: Gen:Variant.MSILHeracles.31115 (B) F-Secure: Trojan.TR/Crypt.XPACK.Gen7 Fortinet: MSIL/Kryptik.CHY!tr GData: Gen:Variant.MSILHeracles.31115 Google: Detected Ikarus: Trojan.MSIL.Crypt Jiangmin: Trojan.Generic.hixcv K7AntiVirus: Trojan ( 005d4a401 ) K7GW: Trojan ( 005d4a401 ) Kingsoft: Win32.Riskware.Keygen.fn Lionic: Trojan.Win32.AgentTesla.4!c Malwarebytes: Generic.Crypt.Trojan.DDS MaxSecure: Trojan.Malware.325357590.susgen McAfeeD: Real Protect-LS!AEFDEF3FF3CA MicroWorld-eScan: Gen:Variant.MSILHeracles.31115 Microsoft: Trojan:Win32/AgentTesla!rfn NANO-Antivirus: Trojan.Win32.Kryptik.kaajuo Paloalto: generic.ml Rising: Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:4aa0P3zFU2jZwnS/4Odh0A) SentinelOne: Static AI - Malicious PE Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.13b8ce98 Trapmine: malicious.moderate.ml.score TrendMicro: TROJ_GEN.R002C0DJ923 TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z VIPRE: Gen:Variant.MSILHeracles.31115 Varist: W32/Risk.AGXJ-7931 VirIT: Trojan.Win32.MSIL_Heur.A Xcitium: Malware@#2gbewyzi1e4my Yandex: Trojan.Kryptik!cJuHQc1E39k Zillya: Trojan.Kryptik.Win32.3614069 alibabacloud: Trojan[dropper]:MSIL/AgentTesla.Gen huorong: Trojan/MSIL.Agent.ll |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2095-Oct-14 01:05:29 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x4c000 |
| SizeOfInitializedData | 0x38a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0004DEFE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x8a000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
7
8
9
32512
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | PhraseExpressKeygen |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | PhraseExpressKeygen.exe |
| LegalCopyright | Copyright © 2021 |
| LegalTrademarks | |
| OriginalFilename | PhraseExpressKeygen.exe |
| ProductName | PhraseExpressKeygen |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.