Manalyze report for e3fdbb915d6a6737a13da5504ace5a279796247e3b24b3b049ee58013687fe35

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2023-Jul-06 17:14:47
Comments
CompanyName
FileDescription
FileVersion	`1.0.0.0`
InternalName	Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Stub.exe
ProductName
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5`
Malicious	VirusTotal score: 57/70 (Scanned on 2026-04-24 07:14:57)	`ALYac: Gen:Trojan.Mardom.MN.12` `AVG: Win32:MalwareX-gen [Pws]` `AhnLab-V3: Trojan/Win.Generic.C5648268` `Alibaba: Backdoor:MSIL/AsyncRAT.34aceb9f` `Antiy-AVL: Trojan[Backdoor]/MSIL.Crysan` `Arcabit: Trojan.Mardom.MN.12` `Avast: Win32:MalwareX-gen [Pws]` `Avira: TR/Dropper.Gen` `BitDefender: Gen:Trojan.Mardom.MN.12` `Bkav: W32.AIDetectMalware.CS` `CTX: exe.trojan.msil` `ClamAV: Win.Packed.AsyncRAT-9861056-1` `CrowdStrike: win/malicious_confidence_100% (W)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `DrWeb: Trojan.Siggen29.2135` `ESET-NOD32: MSIL/Agent.CQS trojan` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Trojan.Mardom.MN.12 (B)` `F-Secure: Trojan.TR/Dropper.Gen` `Fortinet: MSIL/Agent.CQS!tr` `GData: Gen:Trojan.Mardom.MN.12` `Google: Detected` `Ikarus: Trojan.Win32.Themida` `Jiangmin: Backdoor.MSIL.gpaq` `K7AntiVirus: Backdoor ( 005d48c61 )` `K7GW: Backdoor ( 005d48c61 )` `Kaspersky: HEUR:Backdoor.MSIL.Crysan.gen` `Kingsoft: MSIL.Backdoor.Crysan.gen` `Lionic: Trojan.Win32.Mardom.4!c` `Malwarebytes: Backdoor.AsyncRAT` `McAfeeD: Trojan:Win/Protect.EAA` `MicroWorld-eScan: Gen:Trojan.Mardom.MN.12` `Microsoft: Backdoor:MSIL/AsyncRAT!rfn` `NANO-Antivirus: Trojan.Win32.Mardom.kppmam` `Paloalto: generic.ml` `Panda: Trj/Chgt.AD` `Rising: Backdoor.Crysan!8.10ECA (CLOUD)` `Sangfor: Suspicious.Win32.Save.pkr` `SentinelOne: Static AI - Malicious PE` `Skyhigh: BehavesLike.Win32.Trojan.dc` `Sophos: Mal/Generic-S` `Symantec: Downloader` `Tencent: Malware.Win32.Gencirc.1411ac63` `TrellixENS: Artemis!00A1A14BB48D` `TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z` `VBA32: TScope.Trojan.MSIL` `VIPRE: Gen:Trojan.Mardom.MN.12` `Varist: W32/MSIL_Agent.BTJ.gen!Eldorado` `ViRobot: Trojan.Win.Z.Agent.297472.CP` `VirIT: Trojan.Win32.MSIL_Heur.B` `Xcitium: Malware@#3ur37lgt3bgou` `Yandex: Trojan.Agent!sgfPU1YSRlI` `Zillya: Trojan.Agent.Win32.3979025` `alibabacloud: Trojan:MSIL/Agenttesla.LQL!MTB` `huorong: HEUR:Backdoor/MSIL.DcRat.d` `tehtris: Generic.Malware`

Hashes

MD5	`00a1a14bb48da6fb3d6e5b46349f1f09`
SHA1	`ebc052aa404ef9cfe767b98445e5b3207425afaa`
SHA256	`e3fdbb915d6a6737a13da5504ace5a279796247e3b24b3b049ee58013687fe35`
SHA3	`177db479c9f7382a96d877f51472d2e8fb9b54ce2d453120684fdb6fe438390d`
SSDeep	`6144:bFU2Ixa+znhtZtgcB0k7HWTyHJSfZlOALoWFirALFv64ly:ZAnhLqcBVx2tLp/pVy`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2023-Jul-06 17:14:47
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`8.0`
SizeOfCode	`0x47e00`
SizeOfInitializedData	`0xa00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00049BFE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4a000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x4e000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`15`

.text

MD5	`a63070e3ae7fd78005be1a8ed94b1cc5`
SHA1	`33adc7354ce0fedb4b849710e7e9da36232af768`
SHA256	`e991db95d07fa9cd5cd387eb0b235fbae460c244d16a84d818da70697054d8d4`
SHA3	`e8ec2a842a01209e695955aadfebe6eed0b3d7931580a2fc7ed33fb96201c58c`
VirtualSize	`0x47c04`
VirtualAddress	`0x2000`
SizeOfRawData	`0x47e00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.09613`

.rsrc

MD5	`676ac3599f21c88d01eaa624f1ae0ca1`
SHA1	`794579c1513bb26e385ab7441e9c3b8162543097`
SHA256	`6ff42111ad2303da9696223ff95861175aebe3f3d8b302c76429c0341a064516`
SHA3	`9d3f65ee1552c4cefea4126987c3d3471bd649bf3fcc0110c6ac903021db3948`
VirtualSize	`0x800`
VirtualAddress	`0x4a000`
SizeOfRawData	`0x800`
PointerToRawData	`0x48000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.89047`

.reloc

MD5	`50af5e7b7e466a9c4f3f84740d12dfbe`
SHA1	`ff29edfcbbf4e67ed4dbd1d7f40a0f995fb5bd6d`
SHA256	`6ca60be33103a73c5c8951808c935fe53d8bae511c449fe41653f27f2b59bd01`
SHA3	`cd8070d3543fdae21d09c6e4da499e79c5fb70d1dc753bce9212e432f5884b01`
VirtualSize	`0xc`
VirtualAddress	`0x4c000`
SizeOfRawData	`0x200`
PointerToRawData	`0x48800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2cc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.15228`
MD5	`16ec11406456535d1de48d96513667e8`
SHA1	`a60ebbbcae868abd27fc96e22701fae48940e53c`
SHA256	`23202710be8c5fc9672495b0b62bebcf29a087cc7e07236f6bb155efb6e499ad`
SHA3	`ec347df0db7e63c15cad3d1f9d2b5b4d497473b5992bd681fc145eb5057ecb7d`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x493`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.22615`
MD5	`f3d7095de1636559aa56ad81b25bbff9`
SHA1	`6a55e1445c1c915664fba385828c5a0078fe460d`
SHA256	`4ff1c75a93b2280dabe75acecade82d644388c9f4412565d846aeb396bfdc133`
SHA3	`66d420e8633fd20ebea3048e5ed6afe3cf66dcb6d5041729ab7c7faa44b0a1b0`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription
FileVersion (#2)	1.0.0.0
InternalName	Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Stub.exe
ProductName
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.