Manalyze report for e37c14b974391a315f5fb0c7ad146fbb71f52cad779e24da7c0483fbdda23f7e

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Sep-28 05:45:00
Comments	FERROSHIFT game launcher by Douglas Pan / thepan.art
CompanyName	thepan.art
FileDescription	FERROSHIFT Launcher
FileVersion	`0.8.24.0`
InternalName	FERROSHIFT Launcher.exe
LegalCopyright	Copyright (c) Douglas Pan. thepan.art.
OriginalFilename	FERROSHIFT Launcher.exe
ProductName	FERROSHIFT Launcher
ProductVersion	`0.8.24-earlyaccess`
Assembly Version	0.8.24.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains another PE executable: This program cannot be run in DOS mode.` `Contains domain names: googleapis.com http://schemas.microsoft.com http://schemas.microsoft.com/SMI/2005/WindowsSettings https://ferroshift.online https://identitytoolkit.googleapis.com https://identitytoolkit.googleapis.com/v1/accounts https://securetoken.googleapis.com https://securetoken.googleapis.com/v1/token?key identitytoolkit.googleapis.com microsoft.com schemas.microsoft.com securetoken.googleapis.com storage.googleapis.com`
Malicious	VirusTotal score: 5/71 (Scanned on 2026-09-28 17:59:19)	`APEX: Malicious` `Cylance: Unsafe` `Malwarebytes: MachineLearning/Anomalous.100%` `MaxSecure: Trojan.Malware.300983.susgen` `Trapmine: suspicious.low.ml.score`

Hashes

MD5	`4bd0d7accf9e540969b32419f0ce3768` 🔍
SHA1	`db43373e81aeabf8c95c1e7351f4f4ead228cf7f` 🔍
SHA256	`e37c14b974391a315f5fb0c7ad146fbb71f52cad779e24da7c0483fbdda23f7e` 🔍
SHA3	`c5753ad433061867b88b9fda584cfdfeb770044dd97293c92cb852145dcacd3f` 🔍
SSDeep	`24576:fuCjKhX0dgYVi/XZCt5Ej9WZODBhf0dgYj6hf0dgY:fuC2hlYVi/e5Ej9GO9hdYehdY` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Sep-28 05:45:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0xd4e00`
SizeOfInitializedData	`0x2c600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000D6C8E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xd8000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x108000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d3a54e57c8fdb41bfecf45d0203fd98e 🔍`
SHA1	`a0ac4bac62fd50f3305400f369e8f74df59bdfa9 🔍`
SHA256	`152f76e2b7d77e6ab9348e7abf26632b800e82c7a21c5a84ec030ce1dcbabbaa 🔍`
SHA3	`d789813911f28bbbd4ac2080121b0e9ff66a5779fa72cafa6fa55157c63e8874 🔍`
VirtualSize	`0xd4c94`
VirtualAddress	`0x2000`
SizeOfRawData	`0xd4e00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.78044`

.rsrc

MD5	`f8112884e02b33500bda9c331014a500 🔍`
SHA1	`3c1fc7782cb7b44aff2d982372bfdf922f54c584 🔍`
SHA256	`f996d3c5a58db6f47979536be188ffd06521f697bd20aac21d1a3da716431d94 🔍`
SHA3	`d2cc15504dbf66da9f9336a579b264898e68eebf70fde9276dccdcf619c3cf32 🔍`
VirtualSize	`0x2c260`
VirtualAddress	`0xd8000`
SizeOfRawData	`0x2c400`
PointerToRawData	`0xd5000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.98216`

.reloc

MD5	`92ec84afc308af01d3dd4efb4bdca164 🔍`
SHA1	`bdab4d23aae05dbdd8ce19082bf20a6c3f2b9d91 🔍`
SHA256	`55e6db57e06489438dc8bce69f4842f775dba77697bb7215de3e9404bb0a45d6 🔍`
SHA3	`27b09ba25549a86041c974119ab1871b91807b85eeccbc98328b89d869e88a1c 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x106000`
SizeOfRawData	`0x200`
PointerToRawData	`0x101400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

2

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x344`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.6766`
Detected Filetype	PNG graphic file
MD5	`4c148e8c67b662e160b59fa573d6d38f 🔍`
SHA1	`1a4a777319cf35494051cf65918f013c89b5ee90 🔍`
SHA256	`131a4cdb7545232989c757a348c3918ba2393a34784a3c77df050c2f456ebed7 🔍`
SHA3	`829498006602b544ad9a0ab19e794532314a7bde7641b8dd97b138562b861573 🔍`

3

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x65c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.84682`
Detected Filetype	PNG graphic file
MD5	`4728f97897ebb639754edbedefedc1b4 🔍`
SHA1	`f3962c30965d6778c3c1f2a1e3c0c01e34e642fb 🔍`
SHA256	`1e6f0da29d033ff585f7cebdd01f2a7321aec40718dca0cd5170fcee26440894 🔍`
SHA3	`a73c211d4aa012cdc09af750adc5744d44f6bea896190d4460ce83f590314cc3 🔍`

4

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xa49`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.89399`
Detected Filetype	PNG graphic file
MD5	`6d40084bd6df1b6fd0a3ab75a4c861f9 🔍`
SHA1	`59b89f0ef540dfcabf8decc31680882d2291dac0 🔍`
SHA256	`5bf5a228efc24c0292553d6f1a84c39ffa434b597928af47e27752b9d009f52c 🔍`
SHA3	`74af146d9a76535545202d1441ed088a97b47f5425e9acc2d6569eb067e85d25 🔍`

5

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1446`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.93618`
Detected Filetype	PNG graphic file
MD5	`1fb78780a4ad536a3ac3d1d829c54151 🔍`
SHA1	`f503bd768dddf6f28777646e5f685c6bbe68acda 🔍`
SHA256	`537b77c8e66737f851df9ef6ccc6b740a5b288b87fffef09c03fd766ed368e4b 🔍`
SHA3	`de950f8274daa680088365be6d387a452d1ce70f3e0f8def0d4ead221a25eac6 🔍`

6

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2298`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96129`
Detected Filetype	PNG graphic file
MD5	`afb15f9339dad1fb581743579d3af97a 🔍`
SHA1	`e351fb7b5bd17f5f0d459b1f5337fd62183747aa 🔍`
SHA256	`910c939e6a35c2f8cbe6a031acdfd5a72c5416076e8495562143e0bd21b22b89 🔍`
SHA3	`bfb6c8e0fc800c0d28d5fd30bdfe4d9138e27641b9c219122177890ba6ba176d 🔍`

7

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x7dde`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9821`
Detected Filetype	PNG graphic file
MD5	`8bfac2a65f8122b738ebe6ab24f0b902 🔍`
SHA1	`2c63b0c90b81d02f23fa9e173b853d36db3d94a3 🔍`
SHA256	`56a3d55161f45bcbdb80d0867ef7acb2fdca30bcb9ea381084d6db66b5b5c34e 🔍`
SHA3	`765694336ba5064abbbd822d985a1c78df309cab8cc7bd8d1145a39cc455181b 🔍`

8

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1f01b`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99042`
Detected Filetype	PNG graphic file
MD5	`224ccce95587ae82eeb2cde71bdade6b 🔍`
SHA1	`fc20f0bd4437881f68386151d90b821943700cc6 🔍`
SHA256	`edf1548a9626cd97e7231d332809d9cbc2b359b75cb32972f00542650b066b35 🔍`
SHA3	`ebd9dfe853e02ba38c5ca591e04c1cf37d5254d0250dbebe80c743ca8c2fa65f 🔍`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.00984`
Detected Filetype	Icon file
MD5	`9dc8c688b6cdd45181f98ca5e21c648c 🔍`
SHA1	`ec49877488f09fb5731ed41a6a5e6ddb1e0c90f6 🔍`
SHA256	`8a55d662209471b77c3b3b34e1b1bf52410ce02507d07c01d03b6b352a3466f4 🔍`
SHA3	`6548b61d75d845146f0da93bcee12d297ab3b9501244f7fc61db046c53105258 🔍`

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x408`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.41551`
MD5	`78d97eb92414e08dedbe42d5e2ddf087 🔍`
SHA1	`3e6b4cac4c0837d9e031c95aa6516d96316a46c1 🔍`
SHA256	`0a08d2eff765e969db8022c21bd029fe1b21116ea2c0102d505b704622887b24 🔍`
SHA3	`e006f6d5639af84989bbd0ef926d9bbb131acbf20fe79d14f9d3e8f1e33af137 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2c2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.11988`
MD5	`7e448a00e1145cc69dee507c899afe0e 🔍`
SHA1	`104b4a3611f4ea423e64fb895a8d2a1d612f6eb5 🔍`
SHA256	`47aa693410640d789e24c20d4ef8e2f0f0e746a85c7f68317c32489892631cf0 🔍`
SHA3	`140b0228a722394c02a8ff9d3c3ad943365d015af3fb4bf1419d2772190ac4e0 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.8.24.0
ProductVersion	0.8.24.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments	FERROSHIFT game launcher by Douglas Pan / thepan.art
CompanyName	thepan.art
FileDescription	FERROSHIFT Launcher
FileVersion (#2)	0.8.24.0
InternalName	FERROSHIFT Launcher.exe
LegalCopyright	Copyright (c) Douglas Pan. thepan.art.
OriginalFilename	FERROSHIFT Launcher.exe
ProductName	FERROSHIFT Launcher
ProductVersion (#2)	0.8.24-earlyaccess
Assembly Version	0.8.24.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.