Manalyze report for f681f8dc362bb10bcc025f72b5ad8112e9027e2a006bf3f6be58c9fc84c58451

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2019-Apr-07 19:10:52
Debug artifacts	C:\Users\Erik\Desktop\ISKS_CTF_1\ISKS_CTF_1\obj\Debug\ISKS_CTF_1.pdb
Comments
CompanyName
FileDescription	ISKS_CTF_1
FileVersion	`1.0.0.0`
InternalName	ISKS_CTF_1.exe
LegalCopyright	Copyright Â© 2017
LegalTrademarks
OriginalFilename	ISKS_CTF_1.exe
ProductName	ISKS_CTF_1
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Info	Interesting strings found in the binary:	`Contains domain names: https://nee.pythonanywhere.com nee.pythonanywhere.com pythonanywhere.com`
Suspicious	VirusTotal score: 1/72 (Scanned on 2025-05-22 17:06:36)	`SentinelOne: Static AI - Suspicious PE`

Hashes

MD5	`65e02252e7669b8223b4e63c40d7d831`
SHA1	`5fd4bd747f1c58991d52086c6f2f9deb84d575a5`
SHA256	`f681f8dc362bb10bcc025f72b5ad8112e9027e2a006bf3f6be58c9fc84c58451`
SHA3	`ba2ed91242eacdcb421857446858a6ade42377d42ee9214ff4d0847c3fcfa0da`
SSDeep	`384:3JYDKjhhqq1TyTFvbzxQSCz2DDdBHfoc5tuJRxi3hFW:3yShhqq1TIr9BBgc5tuJRxYhY`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2019-Apr-07 19:10:52
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x2200`
SizeOfInitializedData	`0x1400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000410E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x6000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0xa000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`f8708a3e342e0f1573d4be46473f26a1`
SHA1	`ddaa387c29d6390d2d661ec0d92d030755a78a54`
SHA256	`f442016279b44a59fce2494b418dbe7f0f4834be584eef0879f0a87438bc2a13`
SHA3	`471cffc126052588b172fce5190db323f865feaebb274e85573a9282672b2dce`
VirtualSize	`0x2114`
VirtualAddress	`0x2000`
SizeOfRawData	`0x2200`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.43361`

.rsrc

MD5	`57501822836fce8b8a8e4dfb49bbd497`
SHA1	`4339664173ee72c85151a8613aa96f91b1a55659`
SHA256	`dc987621da925c6d0a2f16c33db5a3e5b4c1646dbdc291c5c0e9d4177c243dd6`
SHA3	`d06ab765090a3105ba2c2c4ead3f19514f7dbc3d57c474bfb8b614c9d407b52b`
VirtualSize	`0x10c0`
VirtualAddress	`0x6000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x2400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.88501`

.reloc

MD5	`87751df207b50ca9b860ab41f77af6d5`
SHA1	`7adea1c8b7516a4c712b1c979e6f2faf7965e360`
SHA256	`964f79534595e1e4cc15a6be3e247952a33f5b55a7e8f30fa28cd77721fec1e5`
SHA3	`ce38f19da14b48252709df46d4b692639e6eccda36aac782e41a9114f48ec03f`
VirtualSize	`0xc`
VirtualAddress	`0x8000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x32c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.2918`
MD5	`62a65c11881d948f6444642b3809f471`
SHA1	`19753f118c1e9317bc03ef14ee8115ed6d3ce2d0`
SHA256	`8e76eb4dedd7eaa93fe1bb7e1fc20cd5bc67feee35f8a392a48714e8f489a52f`
SHA3	`b2ac9b72e150ba55fa7ed2eba4c4ee75b88bbbb259cc6f5ccb3e1c504a9bfcc2`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xcf0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.98713`
MD5	`7af7f77772e7cbf9b637e12ac0d8e166`
SHA1	`84ce7eb97074905b79cd8bc7ae93791f741a9e7b`
SHA256	`147dfc6d30ef3f0053d28fda4ce69ed1208ac178cd3ba806817cea6cb59936f0`
SHA3	`8ea43072e3859fbfa6fe78d6047da2bd9629d01686ba9018ffcbdc7ce45236ea`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription	ISKS_CTF_1
FileVersion (#2)	1.0.0.0
InternalName	ISKS_CTF_1.exe
LegalCopyright	Copyright Â© 2017
LegalTrademarks
OriginalFilename	ISKS_CTF_1.exe
ProductName	ISKS_CTF_1
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2019-Apr-07 19:10:52
Version	`0.0`
SizeofData	`284`
AddressOfRawData	`0x3fa0`
PointerToRawData	`0x21a0`
Referenced File	C:\Users\Erik\Desktop\ISKS_CTF_1\ISKS_CTF_1\obj\Debug\ISKS_CTF_1.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.