ec79d5c6e8026d3ea29a7dc45ca9dd59
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-Oct-06 07:45:06 |
| Comments | |
| CompanyName | |
| FileDescription | 2Friend |
| FileVersion | 1.0.0.0 |
| InternalName | Mobi Fastpay.exe |
| LegalCopyright | Copyright © 2015 |
| LegalTrademarks | |
| OriginalFilename | Mobi Fastpay.exe |
| ProductName | 2Friend |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Suspicious |
Unusual section name found: \x17f\x1cpj+[L
Section \x17f\x1cpj+[L is both writable and executable. Unusual section name found: |
|
| Malicious | VirusTotal score: 23/68 (Scanned on 2018-10-06 08:05:46) |
MicroWorld-eScan:
Gen:Variant.Razy.398624
Cylance: Unsafe BitDefender: Gen:Variant.Razy.398624 Symantec: ML.Attribute.HighConfidence Kaspersky: HEUR:Trojan.MSIL.Agent.gen Ad-Aware: Gen:Variant.Razy.398624 F-Secure: Gen:Variant.Razy.398624 Invincea: heuristic McAfee-GW-Edition: BehavesLike.Win32.Generic.bc Emsisoft: Gen:Variant.Razy.398624 (B) Ikarus: Trojan.Confuser Avira: TR/Dropper.MSIL.Gen MAX: malware (ai score=83) Microsoft: Trojan:Win32/Fuerboos.A!cl Endgame: malicious (high confidence) Arcabit: Trojan.Razy.D61520 ZoneAlarm: HEUR:Trojan.MSIL.Agent.gen GData: Gen:Variant.Razy.398624 ALYac: Gen:Variant.Razy.398624 SentinelOne: static engine - malicious Cybereason: malicious.fdcabc CrowdStrike: malicious_confidence_100% (D) Qihoo-360: HEUR/QVM03.0.56EB.Malware.Gen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2018-Oct-06 07:45:06 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0xa600 |
| SizeOfInitializedData | 0xb5a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000C800A (Section: ) |
| BaseOfCode | 0xb0000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xca000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
\x17f\x1cpj+[L
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | 2Friend |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | Mobi Fastpay.exe |
| LegalCopyright | Copyright © 2015 |
| LegalTrademarks | |
| OriginalFilename | Mobi Fastpay.exe |
| ProductName | 2Friend |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|