f1a8cce5f97ca84013a322c27af8cf64
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2019-Jan-14 21:27:15 |
| Comments | My Love Details |
| CompanyName | My Love Details |
| FileDescription | My Love |
| FileVersion | 0.0.0.0 |
| InternalName | Folder+.exe |
| LegalCopyright | Copyright My Love Details 2016 |
| LegalTrademarks | My Love Details |
| OriginalFilename | Folder+.exe |
| ProductName | My Love Details |
| ProductVersion | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | The file contains overlay data. | 1000 bytes of data starting at offset 0xcbe48. |
| Info | The PE is digitally signed. |
Signer: My Love
Issuer: My Love |
| Malicious | VirusTotal score: 43/66 (Scanned on 2019-07-23 09:16:18) |
MicroWorld-eScan:
Trojan.GenericKD.40996453
FireEye: Generic.mg.f1a8cce5f97ca840 CAT-QuickHeal: TrojanDropper.MSIL ALYac: Trojan.GenericKD.40996453 Cylance: Unsafe K7AntiVirus: Trojan ( 005467131 ) BitDefender: Trojan.GenericKD.40996453 K7GW: Trojan ( 005467131 ) Cybereason: malicious.5f97ca Arcabit: Trojan.Generic.D2718E65 Cyren: W32/Trojan.LANV-0725 ESET-NOD32: MSIL/Agent.BTZ Paloalto: generic.ml GData: Trojan.GenericKD.40996453 Kaspersky: HEUR:Trojan-Dropper.MSIL.Scrop.gen Alibaba: TrojanDropper:MSIL/Scrop.05217374 NANO-Antivirus: Trojan.Win32.Mlw.fmresz Avast: Win32:Trojan-gen Tencent: Msil.Trojan-dropper.Scrop.Ecjw Ad-Aware: Trojan.GenericKD.40996453 Sophos: Mal/Generic-S Comodo: Malware@#1umamot7comtp F-Secure: Trojan.TR/Dropper.Gen Qihoo-360: Win32/Trojan.Dropper.a3f Invincea: heuristic McAfee-GW-Edition: Artemis!Trojan Emsisoft: Trojan.GenericKD.40996453 (B) SentinelOne: DFI - Malicious PE Avira: TR/Dropper.Gen Antiy-AVL: Trojan[Dropper]/MSIL.Scrop Microsoft: Trojan:Win32/Occamy.C Endgame: malicious (high confidence) ZoneAlarm: HEUR:Trojan-Dropper.MSIL.Scrop.gen McAfee: Artemis!F1A8CCE5F97C MAX: malware (ai score=100) Malwarebytes: Trojan.Dropper.MSIL Yandex: Trojan.Agent!D32plSelmWM Ikarus: Trojan.Dropper eGambit: PE.Heur.InvalidSig Fortinet: MSIL/Agent.BTZ!tr AVG: Win32:Trojan-gen Panda: Generic Malware CrowdStrike: win/malicious_confidence_100% (D) |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2019-Jan-14 21:27:15 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0xb0000 |
| SizeOfInitializedData | 0x1a800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000B1E9E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xd0000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0xd952e |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
A
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | My Love Details |
| CompanyName | My Love Details |
| FileDescription | My Love |
| FileVersion (#2) | 0.0.0.0 |
| InternalName | Folder+.exe |
| LegalCopyright | Copyright My Love Details 2016 |
| LegalTrademarks | My Love Details |
| OriginalFilename | Folder+.exe |
| ProductName | My Love Details |
| ProductVersion (#2) | 0.0.0.0 |
| Assembly Version | 0.0.0.0 |
| Resource LangID | UNKNOWN |
|---|