Manalyze report for dbfa6a59b90de694bb914fd1284c1136

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2040-Aug-26 06:49:45
Comments	penalty
CompanyName	glory
FileDescription	tape
FileVersion	`4.3.2.5`
InternalName	LoadToBadXml.exe
LegalCopyright	good diesel © 2024
LegalTrademarks	goddess
OriginalFilename	LoadToBadXml.exe
ProductName	good
ProductVersion	`4.3.2.5`
Assembly Version	21.3.4.22

Plugin Output

Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5`
Malicious	VirusTotal score: 44/73 (Scanned on 2024-05-20 09:49:26)	`ALYac: Trojan.GenericKD.72771425` `APEX: Malicious` `AVG: Win32:SpywareX-gen [Trj]` `AhnLab-V3: Trojan/Win.Generic.C5583460` `Alibaba: TrojanSpy:Win32/Atlantidastealer.f94b26da` `Antiy-AVL: Trojan[Spy]/MSIL.Stealer` `Arcabit: Trojan.Generic.D4566761` `Avast: Win32:SpywareX-gen [Trj]` `Avira: TR/AD.Nekark.wonlg` `BitDefender: Trojan.GenericKD.72771425` `BitDefenderTheta: Gen:NN.ZemsilF.36804.@p0@aSUPtbf` `Bkav: W32.AIDetectMalware.CS` `CAT-QuickHeal: TrojanSpy.MSIL` `DeepInstinct: MALICIOUS` `DrWeb: Trojan.PWS.Siggen3.37257` `Elastic: malicious (high confidence)` `Emsisoft: Trojan.GenericKD.72771425 (B)` `F-Secure: Trojan.TR/AD.Nekark.wonlg` `FireEye: Generic.mg.dbfa6a59b90de694` `Fortinet: PossibleThreat.MU` `GData: Trojan.GenericKD.72771425` `Google: Detected` `Ikarus: Trojan.Nekark` `Kaspersky: HEUR:Trojan-Spy.MSIL.Stealer.gen` `Lionic: Trojan.Win32.Stealer.12!c` `MAX: malware (ai score=89)` `Malwarebytes: Trojan.Crypt.MSIL.Generic` `MaxSecure: Trojan.Malware.3411146.susgen` `McAfee: Artemis!DBFA6A59B90D` `MicroWorld-eScan: Trojan.GenericKD.72771425` `Microsoft: Trojan:Win32/Atlantidastealer!MSR` `Paloalto: generic.ml` `Rising: Stealer.Agent!8.C2 (CLOUD)` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: BehavesLike.Win32.Generic.vc` `Sophos: Mal/Generic-S` `Symantec: Trojan Horse` `Tencent: Malware.Win32.Gencirc.140c0128` `Trapmine: malicious.high.ml.score` `VIPRE: Trojan.GenericKD.72771425` `Varist: W32/MSIL_Troj.DEJ.gen!Eldorado` `ZoneAlarm: HEUR:Trojan-Spy.MSIL.Stealer.gen` `tehtris: Generic.Malware`

Hashes

MD5	`dbfa6a59b90de694bb914fd1284c1136`
SHA1	`d5087774813b464ff95cd4cb6bdff0e633ad94bb`
SHA256	`13907caae48ea741942bce60fa32087328475bd14f5a81a6d04d82286bd28b4d`
SHA3	`2b95fe68315b681d15a7010db283f06424e1ff6ee48779156d3f7186e7a978f4`
SSDeep	`196608:qtHMRzrOVQZduYUogBOr6809vD5JGBE0Ag9oVN:sHJuuBogl801VJN0T90N`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2040-Aug-26 06:49:45
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x6ab000`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x006ACFEE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x6ae000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x6b2000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`3f7430f7687c9c708c07278b284ae27a`
SHA1	`70c69ea41dd39e7854c8880dbe6571901ddce69a`
SHA256	`1036f868f4bc854a15f6a99ad569bf37ae04b29343cc02e1ae7aaf441c226ad2`
SHA3	`f90d84dc21d01f95ce4c3b98a1c3f861a37f9171faa520a328a23009be2022a4`
VirtualSize	`0x6aaff4`
VirtualAddress	`0x2000`
SizeOfRawData	`0x6ab000`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.9984`

.rsrc

MD5	`a92278048e1909af18931c35ec9cc3d9`
SHA1	`c7afae6213edd6b1c0495fd8834db3159c91dcdf`
SHA256	`c75f92bb6c34ea2e2d9c53afb17b5a91b55246df69b7b301eb66a49103f885c3`
SHA3	`d39b06548b81fa515be21fdcac949cc079396d70a2a68a4a267853de6fdfa5f1`
VirtualSize	`0x5d0`
VirtualAddress	`0x6ae000`
SizeOfRawData	`0x600`
PointerToRawData	`0x6ab200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.20487`

.reloc

MD5	`11b373c0a543e2e358437d9bc32d0bf8`
SHA1	`520ddca80154aa0d1b0efe969a07bb6eb1274d8c`
SHA256	`2dd99a418b3661044e29b52c9e1f6d9cc28c9124cd25b2f2f2d860a1cd7fffc1`
SHA3	`6d15e0db1c250854d3fa3c5b8d0ede09131d011c34d8fe8f294aba9a744d0cb0`
VirtualSize	`0xc`
VirtualAddress	`0x6b0000`
SizeOfRawData	`0x200`
PointerToRawData	`0x6ab800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x344`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.3782`
MD5	`40296eeebfd78337c15f8f8708c39a2e`
SHA1	`7319f23f06095d5f30a0700df3d93584939bb275`
SHA256	`fe74e42b80e0538de737add9904fea1b78bbadb867db3bf7658cd0aceb952ee2`
SHA3	`c3941165c218255f20c2fadc3b94311aa15bbf870654c4da8af77d30effba3f6`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	4.3.2.5
ProductVersion	4.3.2.5
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments	penalty
CompanyName	glory
FileDescription	tape
FileVersion (#2)	4.3.2.5
InternalName	LoadToBadXml.exe
LegalCopyright	good diesel © 2024
LegalTrademarks	goddess
OriginalFilename	LoadToBadXml.exe
ProductName	good
ProductVersion (#2)	4.3.2.5
Assembly Version	21.3.4.22

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

dbfa6a59b90de694bb914fd1284c1136

Summary

Plugin Output

Hashes

DOS Header

PE Header

Image Optional Header

.text

.rsrc

.reloc

Imports

Delayed Imports

1

1 (#2)

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors