Manalyze report for fd5fd7d3e1f31ceebd7200d69143a293

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2023-May-11 19:54:55
FileDescription
FileVersion	`0.0.0.0`
InternalName	flag.exe
LegalCopyright
OriginalFilename	flag.exe
ProductVersion	`0.0.0.0`
Assembly Version	0.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Malicious	VirusTotal score: 10/72 (Scanned on 2023-05-25 07:42:02)	`Cynet: Malicious (score: 100)` `Cyren: W32/Azorult.D.gen!Eldorado` `Elastic: malicious (high confidence)` `APEX: Malicious` `Trapmine: malicious.moderate.ml.score` `Kingsoft: malware.kb.c.884` `Google: Detected` `MaxSecure: Trojan.Malware.300983.susgen` `BitDefenderTheta: Gen:NN.ZemsilCO.36196.am0@a0fj8eo` `Cybereason: malicious.3e1f31`

Hashes

MD5	`fd5fd7d3e1f31ceebd7200d69143a293`
SHA1	`605faeb6ab588891a2f64209f831dd7888df3bd2`
SHA256	`1dc970e2ae6085d189d08e09981a232ae4aa4a89c03638290ae39ad4f7159aad`
SHA3	`275ba7dcae4c28fadc658905264377f283db25ff257a3c2024152ad856f57568`
SSDeep	`96:eXTHONBx0nbQQ8kTeCJrC8G3EPOuDObw7KL7xUmVkzKGUzNt:H2n0g5+8fPsP7BCXe`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2023-May-11 19:54:55
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x1200`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000318E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`e68fd91a4cb9be5c2cfe642b9e3f90ba`
SHA1	`90e3a51febee559fb700e401d53d87f1a860bad0`
SHA256	`95b00d54967525540837f65d727e039555f8d7b644db6b6aa0e327be41a09ed4`
SHA3	`14d09dda3b2c09f7f217fc8a2761e9d368bcc0553055b63e400d9c856bcd1b08`
VirtualSize	`0x1194`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.07394`

.rsrc

MD5	`51fd65a2585e1a9259df4cfec4a92193`
SHA1	`d0e8a52e7f9f3584fadc462f91f77fbf448b354f`
SHA256	`f4e834ff00d222bdaf4bb05c64cd1d463688fed06979d2fea2c01598c4889429`
SHA3	`176de7ade6bdfa5f94dbd6a3ef391e015727fd5c38a4c517b3eaf1f8f22cd14e`
VirtualSize	`0x4d0`
VirtualAddress	`0x4000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.68044`

.reloc

MD5	`ef43af6721563f7b7fd5dbf3c22147f7`
SHA1	`0f4128a1793588f351ddbbed0ef83629dd20adfa`
SHA256	`8753abdc7dc83807d728c5cb15e497c9720948ab43cab1266e159a574b1e3150`
SHA3	`f2c977b056123f62f7a71644437a78e3489df77a5d0d5901ceb98b5058e83009`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x23c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.13101`
MD5	`ecbee13954122044aeb48a0fac0591a3`
SHA1	`58ecde14e8402600003eae7e3df5fe77197bc316`
SHA256	`5ab931ae1595f31a4e6e1d2b56ab456f331d6b0f4c54f0da36cc0057b5c3fe23`
SHA3	`81bcf969187e3c3d6399ad92a5e30468b4c74fac843f66b6f8cf1d75d57d34b2`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription
FileVersion (#2)	0.0.0.0
InternalName	flag.exe
LegalCopyright
OriginalFilename	flag.exe
ProductVersion (#2)	0.0.0.0
Assembly Version	0.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

fd5fd7d3e1f31ceebd7200d69143a293

Summary

Plugin Output

Hashes

DOS Header

PE Header

Image Optional Header

.text

.rsrc

.reloc

Imports

Delayed Imports

1

1 (#2)

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors