f6cb85c3971b02e9ab05594d32601e39ac8535270a9b8b67712a08530134a897
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2081-Sep-23 12:17:32 |
| Comments | XHP Booster |
| CompanyName | |
| FileDescription | XHP |
| FileVersion | 12.9.1.22 |
| InternalName | Steanings.exe |
| LegalCopyright | XHP Corporation Copyright © 2021 |
| LegalTrademarks | |
| OriginalFilename | Steanings.exe |
| ProductName | XHP booster |
| ProductVersion | 12.9.1.22 |
| Assembly Version | 1.1.21.1 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to internet browsers:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to AES |
| Malicious | VirusTotal score: 62/72 (Scanned on 2025-09-03 14:48:23) |
ALYac:
Gen:Variant.Jalapeno.421
APEX: Malicious AVG: Win32:MalwareX-gen [Pws] AhnLab-V3: Trojan/Win.Dacic.R641638 Alibaba: TrojanSpy:MSIL/RedLineStealz.0fff5ee9 Arcabit: Trojan.Jalapeno.421 Avast: Win32:MalwareX-gen [Pws] Avira: HEUR/AGEN.1376350 BitDefender: Gen:Variant.Jalapeno.421 Bkav: W32.AIDetectMalware.CS CAT-QuickHeal: Trojan.Generic.TRFH1229 CTX: exe.trojan.msil CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.PWS.Stealer.38294 ESET-NOD32: a variant of MSIL/Spy.RedLine.A Elastic: Windows.Generic.Threat Emsisoft: Gen:Variant.Jalapeno.421 (B) F-Secure: Heuristic.HEUR/AGEN.1376350 Fortinet: MSIL/RedLine.A!tr.spy GData: MSIL.Trojan-Stealer.Redline.G Google: Detected Gridinsoft: Trojan.Win32.RedLine.mz!n Ikarus: Trojan-Spy.MSIL.Redline Jiangmin: TrojanSpy.MSIL.ddcb K7AntiVirus: Spyware ( 0059955a1 ) K7GW: Spyware ( 0059955a1 ) Kaspersky: HEUR:Trojan-Spy.MSIL.Stealer.gen Lionic: Trojan.Win32.RedLine.l!c Malwarebytes: Trojan.MalPack.MSIL MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!F6CB85C3971B MicroWorld-eScan: Gen:Variant.Jalapeno.421 Microsoft: Trojan:MSIL/RedLineStealz.A!MTB Paloalto: generic.ml Panda: Trj/GdSda.A Rising: Stealer.RedLine!1.11745 (CLASSIC) SUPERAntiSpyware: Trojan.Agent/Gen-SpyStealer Sangfor: Virus.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Infected.fm Sophos: Troj/Redline-D Symantec: ML.Attribute.HighConfidence TACHYON: Trojan-Spy/W32.DN-InfoStealer.307712.D Tencent: Trojan-Spy.Msil.Redline.16001319 Trapmine: suspicious.low.ml.score TrellixENS: ACL/Infostealer RedLine TrendMicro: TrojanSpy.Win32.METASTEALER.YXFIBZ TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9j VBA32: Trojan.MSIL.InfoStealer.gen.U VIPRE: Gen:Variant.Jalapeno.421 Varist: W32/MSIL_Kryptik.KFT.gen!Eldorado ViRobot: Trojan.Win.Z.Redline.307712.QK VirIT: Trojan.Win32.MSIL_Heur.A Webroot: W32.Trojan.Gen Yandex: TrojanSpy.RedLine!EfZ9EzHb3Bk Zillya: Trojan.RedLine.Win32.12513 ZoneAlarm: Troj/Redline-D alibabacloud: Trojan[downloader]:MSIL/Redline.GD!MTB huorong: TrojanSpy/RedLine.q tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2081-Sep-23 12:17:32 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x2e400 |
| SizeOfInitializedData | 0x1cc00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0003028E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x32000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x52000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 12.9.1.22 |
| ProductVersion | 12.9.1.22 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | XHP Booster |
| CompanyName | |
| FileDescription | XHP |
| FileVersion (#2) | 12.9.1.22 |
| InternalName | Steanings.exe |
| LegalCopyright | XHP Corporation Copyright © 2021 |
| LegalTrademarks | |
| OriginalFilename | Steanings.exe |
| ProductName | XHP booster |
| ProductVersion (#2) | 12.9.1.22 |
| Assembly Version | 1.1.21.1 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.