e6fa3028cd03318496852718143d256f
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2014-Dec-13 05:09:01 |
| Debug artifacts |
d:\Projects\My\loic\loic\obj\Release\LOIC.pdb
|
| Comments | TCP/IP stress-test tool |
| FileDescription | Low Orbit Ion Cannon |
| FileVersion | 1.0.8.0 |
| InternalName | LOIC.exe |
| LegalCopyright | Public domain |
| OriginalFilename | LOIC.exe |
| ProductName | Low Orbit Ion Cannon |
| ProductVersion | 1.0.8.0 |
| Assembly Version | 1.0.8.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Malicious | VirusTotal score: 46/70 (Scanned on 2021-04-05 19:20:32) |
Elastic:
malicious (high confidence)
MicroWorld-eScan: Application.Hacktool.US FireEye: Generic.mg.e6fa3028cd033184 CAT-QuickHeal: Trojan.YakbeexMSIL.ZZ4 ALYac: Misc.HackTool.Loic Cylance: Unsafe VIPRE: Trojan.Win32.Generic!BT Sangfor: Hacktool.Win32.Agent.sc K7AntiVirus: Trojan ( 700000121 ) BitDefender: Application.Hacktool.US K7GW: Trojan ( 700000121 ) Cybereason: malicious.8cd033 Cyren: W32/MSIL_LOIC.CRA.gen!Eldorado Symantec: Hacktool ESET-NOD32: a variant of MSIL/HackTool.LOIC.AF potentially unsafe APEX: Malicious Avast: Win32:Loic-A [Trj] Alibaba: HackTool:MSIL/Uflooder.7cd5d9d1 NANO-Antivirus: Trojan.Win32.Mlw.eswpzj ViRobot: Keygen.136192 Ad-Aware: Application.Hacktool.US Emsisoft: Application.Hacktool.US (B) Comodo: Malware@#2bq2788hhdirm Zillya: Tool.LOIC.Win32.151 TrendMicro: TROJ_SPNR.0BA015 McAfee-GW-Edition: HTool-Loic Sophos: Mal/Generic-R + Troj/Loic-A Ikarus: HackTool.Loic Jiangmin: HackTool.MSIL.aet MAX: malware (ai score=100) Kingsoft: Win32.HackTool.Undef.(kcloud) Gridinsoft: Trojan.Win32.Agent.dg Microsoft: HackTool:MSIL/Uflooder.C!bit SUPERAntiSpyware: Hack.Tool/Gen-LOIC GData: Application.Hacktool.US AhnLab-V3: Trojan/Win32.Loic.R131592 McAfee: HTool-Loic Malwarebytes: HackTool.LOIC TrendMicro-HouseCall: TROJ_SPNR.0BA015 Yandex: Trojan.Igent.bTL4uG.3 SentinelOne: Static AI - Malicious PE Fortinet: Riskware/Loic Webroot: Hacktool:Oylecann.A AVG: Win32:Loic-A [Trj] Paloalto: generic.ml CrowdStrike: win/malicious_confidence_100% (D) |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2014-Dec-13 05:09:01 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x1c400 |
| SizeOfInitializedData | 0x4e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001E22E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x20000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x28000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0x291ed |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
2
3
4
5
32512
1
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.8.0 |
| ProductVersion | 1.0.8.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | TCP/IP stress-test tool |
| FileDescription | Low Orbit Ion Cannon |
| FileVersion (#2) | 1.0.8.0 |
| InternalName | LOIC.exe |
| LegalCopyright | Public domain |
| OriginalFilename | LOIC.exe |
| ProductName | Low Orbit Ion Cannon |
| ProductVersion (#2) | 1.0.8.0 |
| Assembly Version | 1.0.8.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2014-Dec-13 05:09:01 |
| Version | 0.0 |
| SizeofData | 284 |
| AddressOfRawData | 0x1e0c0 |
| PointerToRawData | 0x1c2c0 |
| Referenced File | d:\Projects\My\loic\loic\obj\Release\LOIC.pdb |