e943a52430652d35dc0b9b96f7d6510caac449039bb94f8afc7d6ff570e212be
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Feb-27 20:55:22 |
| Debug artifacts |
C:\Users\LUCAS GOMES\AppData\Local\Temporary Projects\ntflix\obj\Debug\ntflix.pdb
|
| FileDescription | ntflix |
| FileVersion | 1.0.0.0 |
| InternalName | ntflix.exe |
| LegalCopyright | Copyright © 2017 |
| OriginalFilename | ntflix.exe |
| ProductName | ntflix |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | Unusual section name found: .sdata | |
| Malicious | VirusTotal score: 38/66 (Scanned on 2017-11-27 01:53:25) |
MicroWorld-eScan:
Gen:Variant.Razy.144481
CAT-QuickHeal: TrojanSpy.Skeeyah ALYac: Gen:Variant.Razy.144481 K7GW: Password-Stealer ( 004b93e81 ) K7AntiVirus: Password-Stealer ( 004b93e81 ) Baidu: MSIL.Trojan.Agent.p Symantec: Infostealer.Limitail TrendMicro-HouseCall: TSPY_LIMITAIL.XXUEC Avast: Win32:Malware-gen Kaspersky: UDS:DangerousObject.Multi.Generic BitDefender: Gen:Variant.Razy.144481 NANO-Antivirus: Trojan.Win32.Gktse.elzohf Emsisoft: Gen:Variant.Razy.144481 (B) F-Secure: Gen:Variant.Razy.144481 VIPRE: Trojan.Win32.Generic!BT TrendMicro: TSPY_LIMITAIL.XXUEC McAfee-GW-Edition: RDN/Generic PWS.y Sophos: Mal/Generic-S Paloalto: generic.ml Cyren: W32/GenBl.169CBB64!Olympus Webroot: W32.Trojan.Gen Avira: TR/Spy.gktse Arcabit: Trojan.Razy.D23461 AegisLab: Troj.Spy.Gktse!c ZoneAlarm: UDS:DangerousObject.Multi.Generic McAfee: RDN/Generic PWS.y AVware: Trojan.Win32.Generic!BT MAX: malware (ai score=100) Ad-Aware: Gen:Variant.Razy.144481 Cylance: Unsafe ESET-NOD32: a variant of MSIL/PSW.Agent.ONZ Tencent: Win32.Trojan.Generic.Dyqu Yandex: Trojan.PWS.Agent!8NXeJHX1HO8 Fortinet: MSIL/Agent.ONZ!tr.pws AVG: Win32:Malware-gen Cybereason: malicious.1b8fb7 Panda: Trj/GdSda.A CrowdStrike: malicious_confidence_80% (D) |
Hashes
| MD5 | 169cbb64029a69d720dc9cdab7c4e85f 🔍 |
|---|---|
| SHA1 | 8b60d56d9c4b12fe48daadac3f600bf08c118a5a 🔍 |
| SHA256 | e943a52430652d35dc0b9b96f7d6510caac449039bb94f8afc7d6ff570e212be 🔍 |
| SHA3 | 3f023032a767356e86f77d8b6fa47f0cd00f622d91d78fb0de05fab51683961a 🔍 |
| SSDeep | 1536:Sz7YrS4ulxIpEufW1Q1dgvrOYK3BOmRGb:SzE9uS++W1WdgvrOYK3BOmsb 🔍 |
| Imports Hash | f34d5f2d4577ed6d9ceec516c1f5a744 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2017-Feb-27 20:55:22 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0xde00 |
| SizeOfInitializedData | 0x1000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000FD5E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x10000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x16000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 9fb3aaa8ab3e2ab1364b90983a29bbb0 🔍 |
|---|---|
| SHA1 | 9b5f71f5742ca0d87aa0b4489dc286bc379a978a 🔍 |
| SHA256 | 2f349954cf2601d52f7042be7bbe4036e94d1b67bdbceb6164f095007b780984 🔍 |
| SHA3 | b33deaf58a8b7cdc78260f5b8cd1676f9862eac2ce966574bd3287cf54868b2a 🔍 |
| VirtualSize | 0xdd64 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0xde00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.95333 |
.sdata
| MD5 | 0b4b57c7511b189f21f87ba7bd2315a3 🔍 |
|---|---|
| SHA1 | b285d6269a43c5b83dca6da87822458c18f5d455 🔍 |
| SHA256 | 4416a9ae8512e3cc2e5275564fb003814cc5fdaa2f69d71a577c874eb97d7516 🔍 |
| SHA3 | cbeae256d674ab03bcbe49e01e7d21bcff925e0b099e39641082f19b94a9dc9c 🔍 |
| VirtualSize | 0x86 |
| VirtualAddress | 0x10000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xe200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.96514 |
.rsrc
| MD5 | bcc4f6f5759d14804adfabef884f26ca 🔍 |
|---|---|
| SHA1 | 8d017c41c1668f27f0a20dffdacbcb0bd84e247b 🔍 |
| SHA256 | a0bea95f6473008fc0eaf8243524d30c7e0bddc29d91ed2fcf236c09b7353f2a 🔍 |
| SHA3 | f30da6ca8ac9684f78e7310bd29111e4dcafb26b2a60464cccd5e13d8ac7daee 🔍 |
| VirtualSize | 0xa28 |
| VirtualAddress | 0x12000 |
| SizeOfRawData | 0xc00 |
| PointerToRawData | 0xe400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.60126 |
.reloc
| MD5 | 581c334e32d9aa4f6dae8b6e3697a1e8 🔍 |
|---|---|
| SHA1 | 4b46ee675adc35eb8368a4b3485c4c9ac437e558 🔍 |
| SHA256 | a5d2481269d92fb3bd996d0cc96040914958983f6abea0509c80a2a05a1111c0 🔍 |
| SHA3 | 820f3fec6614ca976988c157deba313cc5303a1dca67e1d20fe516e0cd097ff4 🔍 |
| VirtualSize | 0xc |
| VirtualAddress | 0x14000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xf000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 0.0815394 |
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
2
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.71419 |
| MD5 | d2d15e1e362ef2edda7238e165376112 🔍 |
| SHA1 | c1e5af71c456dc766ad70e1a3abc6c97fda626d7 🔍 |
| SHA256 | 7c5a5e79e83118e35690003b7af90edf66caea64b38e03bf65e555c49c3a5b31 🔍 |
| SHA3 | fa458690e3f40a331300e7fea11f1f2d9d24266b84ed5c645b5eb272677670e6 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x128 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.53612 |
| MD5 | da1aeaa9a812c0a31fcc6e42e2f8e675 🔍 |
| SHA1 | 58edba28c9067b74c7699bd5a12348e5f7c50e49 🔍 |
| SHA256 | bf763501e16f639d5223f88427789665cb0baa9af8877e2e83c65e16016ab8b1 🔍 |
| SHA3 | c12b7a9764a04702f5684387b5fb20a37874203cb2af7b41921d68496146d378 🔍 |
32512
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x22 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.47702 |
| Detected Filetype | Icon file |
| MD5 | 29a1f473b6fc0b877ce30be83212f25a 🔍 |
| SHA1 | a66309103e9f7ff118fd964f2cd5ae04bbd4a322 🔍 |
| SHA256 | e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda 🔍 |
| SHA3 | c3b0b1b14385cdc2d88d02c11aaca33ca55d509d2fe1dce1777c05d32c0e8a30 🔍 |
1
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2a0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.22208 |
| MD5 | 2975c7529af46a8f80861e1f2d8a6cfa 🔍 |
| SHA1 | b1e6603350346cc32740557f93b986ec0eaa418c 🔍 |
| SHA256 | 74478114e6a2f6a518263aeb286aa929f789803054fa906e536aee33afd1f7bc 🔍 |
| SHA3 | 1dba68b70e19e3b5febb3d298cf4d34b038dce80e6c056a560dae0f64007241c 🔍 |
1 (#2)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x1ea |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.00112 |
| MD5 | a19a2658ba69030c6ac9d11fd7d7e3c1 🔍 |
| SHA1 | 879dcf690e5bf1941b27cf13c8bcf72f8356c650 🔍 |
| SHA256 | c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f 🔍 |
| SHA3 | 93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| FileDescription | ntflix |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | ntflix.exe |
| LegalCopyright | Copyright © 2017 |
| OriginalFilename | ntflix.exe |
| ProductName | ntflix |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2017-Feb-27 20:55:22 |
| Version | 0.0 |
| SizeofData | 106 |
| AddressOfRawData | 0x1001c |
| PointerToRawData | 0xe21c |
| Referenced File | C:\Users\LUCAS GOMES\AppData\Local\Temporary Projects\ntflix\obj\Debug\ntflix.pdb |
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.