dcd7634cd980838b5de7e76f9751182d1d52d03de4f5cad560379564c7c5c0e2
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-26 01:15:54 |
| FileDescription | |
| FileVersion | 0.0.0.0 |
| InternalName | RichardLauncherLite.exe |
| LegalCopyright | |
| OriginalFilename | RichardLauncherLite.exe |
| ProductVersion | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ 8.0 .NET executable -> Microsoft |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 93.6632% of the executable. |
| Malicious | VirusTotal score: 11/71 (Scanned on 2026-05-27 14:53:28) |
APEX:
Malicious
Bkav: W32.Malware.92D7D110 CrowdStrike: win/malicious_confidence_60% (W) Cylance: Unsafe DeepInstinct: MALICIOUS Elastic: malicious (high confidence) Kingsoft: malware.kb.c.773 MaxSecure: Trojan.Malware.300983.susgen Trapmine: malicious.moderate.ml.score TrendMicro-HouseCall: Trojan.MSIL.Gen.TL0101ER26Y9 VBA32: Downloader.MSIL.gen.rexp |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2026-May-26 01:15:54 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x5a00 |
| SizeOfInitializedData | 0x5b000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000794E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x8000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x66000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| FileDescription | |
| FileVersion (#2) | 0.0.0.0 |
| InternalName | RichardLauncherLite.exe |
| LegalCopyright | |
| OriginalFilename | RichardLauncherLite.exe |
| ProductVersion (#2) | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.