Manalyze report for e93f82042a2e1b0daa0fd20946f3f38c324c32f5575b90bfa7eeb31ed7b6fc98

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2096-Jan-09 06:37:40
Comments	https://discord.gg/FreeUp
CompanyName	ModadByLUc2s
FileDescription	Creative EAX Setting
FileVersion	`1.0.0.0`
InternalName	Creative EAX Setting.exe
LegalCopyright	CodedBySamurai
LegalTrademarks	https://guns.lol/xjy
OriginalFilename	Creative EAX Setting.exe
ProductName	Creative EAX Setting
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	PEiD Signature:	`UPolyX V0.1 -> Delikon`
Info	Interesting strings found in the binary:	`Contains domain names: https://discord.gg https://guns.lol`
Suspicious	VirusTotal score: 1/70 (Scanned on 2026-08-19 21:36:42)	`Microsoft: Trojan:Win32/Wacatac.B!ml`

Hashes

MD5	`892bc4936df67de245d7e8794abde3e4` 🔍
SHA1	`224cc512f2b5d38306d99aac68fa624df34eab3c` 🔍
SHA256	`e93f82042a2e1b0daa0fd20946f3f38c324c32f5575b90bfa7eeb31ed7b6fc98` 🔍
SHA3	`8d0ae402bf8246eb854fd889ea663dd897e34b1d6d97558912349c22572ceef2` 🔍
SSDeep	`24576:hMbS+RgaMj3XRD+uVK2H2Cuk1+Lda3WvhMV+O/mDo5uQij:hMbbRgaMj3XRD+ufH2Cuk1+Lda3Wvho` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2096-Jan-09 06:37:40
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x107600`
SizeOfInitializedData	`0x42a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0010941E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x10a000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x150000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`1e02bfbd0e2f7ef14368f23528eb698b 🔍`
SHA1	`550da806ba8a14826b7f43463917e4c42764beca 🔍`
SHA256	`b654112f8fcaddc7b9552dbed19f9f6d0d4b03990cac7b0085b27f647937671e 🔍`
SHA3	`a8f4b06f917232bb77a4b6b88a17dd31c0672a2bcbf3e8cf47e6591dd6ad92b7 🔍`
VirtualSize	`0x107424`
VirtualAddress	`0x2000`
SizeOfRawData	`0x107600`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.71188`

.rsrc

MD5	`a1e1f08801be7c22e185c060786ef116 🔍`
SHA1	`9a38babf106770e771c099b928f4f378935ca9e0 🔍`
SHA256	`d8b8cacc197ad010a170979dc578ae2b66b80791c5f8ab563b6f1a3ac39b574b 🔍`
SHA3	`1305e476134525ac4ce5bb5738a2c7e62620dd24e4f3ff3bb68e078bc75e4edb 🔍`
VirtualSize	`0x4273e`
VirtualAddress	`0x10a000`
SizeOfRawData	`0x42800`
PointerToRawData	`0x107800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.33553`

.reloc

MD5	`d431070ab40bc2f83b836a0a698cacdc 🔍`
SHA1	`9a1f69524cf5d496aeba02edf2c29a77e495caa3 🔍`
SHA256	`8763c92bcb02f21a73062c3718cb1aa07721d559ac83ba682e78faab003315ac 🔍`
SHA3	`7a4a5bc8183193ef4faf1f9dab8acb4066180a9c41adef7cdfae12937158755b 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x14e000`
SizeOfRawData	`0x200`
PointerToRawData	`0x14a000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x42028`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.32276`
MD5	`074c9983502ea34ce431e95869d6307d 🔍`
SHA1	`774f8bb315872436d049156e7c1d7876f260eba5 🔍`
SHA256	`9a8cf951811052002c3834e44385cb9654f3cd304bd762434c93508e5da808c6 🔍`
SHA3	`3fb4ff269b22abadc8052d15147fcd053e70585435601307295172b27deb3c2b 🔍`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.67095`
Detected Filetype	Icon file
MD5	`464cb94db3a2622922a9562865009ae8 🔍`
SHA1	`dbe17c767d942f219df59f9eae77b213c15eab70 🔍`
SHA256	`8affd1fa69a6c5a5b54e504d72d4e9a0eba9b7d702a445ea1399a5978794719a 🔍`
SHA3	`3e0e32110c6c0f3323eeeb5e4a6cbb7a8db52ab14e0f065384fb4eedac4fbcda 🔍`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x3e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.36975`
MD5	`8219fa8d874098863f3a50ac691afc3b 🔍`
SHA1	`8e049c2da854a9a239af5d2aa2cc660a3612b160 🔍`
SHA256	`50f15a3b5bf4b77553f6ac10ac549cb3ccf1575562a03e7d95eb12511c5f4247 🔍`
SHA3	`55ebc17d7420bae678be49b8f31d53752d03dda0486c1ae0725fcd7f999cd4e9 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9 🔍`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734 🔍`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments	https://discord.gg/FreeUp
CompanyName	ModadByLUc2s
FileDescription	Creative EAX Setting
FileVersion (#2)	1.0.0.0
InternalName	Creative EAX Setting.exe
LegalCopyright	CodedBySamurai
LegalTrademarks	https://guns.lol/xjy
OriginalFilename	Creative EAX Setting.exe
ProductName	Creative EAX Setting
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.