de87d284627f7f3d4c0b2e166a471b47defaedb1b72de98916c0f27ee85ca33f
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Feb-19 21:27:42 |
| Comments | UPatch HD Launcher |
| CompanyName | aoe_scout |
| FileDescription | UPatch HD Launcher |
| FileVersion | 1.1.0.0 |
| InternalName | Launcher.exe |
| LegalCopyright | aoe_scout |
| LegalTrademarks | |
| OriginalFilename | Launcher.exe |
| ProductName | UPatch HD |
| ProductVersion | 1.1.0.0 |
| Assembly Version | 1.1.0.0 |
Plugin Output
| Info | Matching compiler(s): | .NET executable -> Microsoft |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Malicious | VirusTotal score: 8/68 (Scanned on 2026-05-04 05:57:33) |
APEX:
Malicious
CrowdStrike: win/malicious_confidence_70% (W) Cylance: Unsafe DeepInstinct: MALICIOUS MaxSecure: Trojan.Malware.300983.susgen SentinelOne: Static AI - Suspicious PE Trapmine: malicious.moderate.ml.score VirIT: Trojan.Win32.MSIL_Heur.A |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2024-Feb-19 21:27:42 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 80.0 |
| SizeOfCode | 0x143800 |
| SizeOfInitializedData | 0x3a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001457DE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x146000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x14c000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.1.0.0 |
| ProductVersion | 1.1.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | UPatch HD Launcher |
| CompanyName | aoe_scout |
| FileDescription | UPatch HD Launcher |
| FileVersion (#2) | 1.1.0.0 |
| InternalName | Launcher.exe |
| LegalCopyright | aoe_scout |
| LegalTrademarks | |
| OriginalFilename | Launcher.exe |
| ProductName | UPatch HD |
| ProductVersion (#2) | 1.1.0.0 |
| Assembly Version | 1.1.0.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.