0460643fb4625a715a7d40a35741fc998973ccb8011c213f3825c9fc5e9a36ff

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2023-Mar-12 16:16:39
Comments
CompanyName ForgeLink Systems Inc.
FileDescription Enterprise collaboration platform with real-time document editing, video conferencing, and project workflow automation.
FileVersion 38.7.3.0
InternalName forgelink-collaboration-enterprise-2026.07-full-x64-setup
LegalCopyright © 2026 ForgeLink Systems Inc. All Rights Reserved.
LegalTrademarks ForgeLink, ForgeLink Collaboration are registered trademarks of ForgeLink Systems Inc.
OriginalFilename forgelink-collaboration-enterprise-2026.07-full-x64-setup
ProductName ForgeLink Collaboration
ProductVersion 38.7.3.0
Assembly Version 38.7.3.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • schtask
 May have dropper capabilities:
  • CurrentVersion\Run
 Accesses the WMI:
  • root\Security
 Contains domain names:
  • api.ipify.org
  • https://api.ipify.org
  • https://api.ipify.org/
  • https://ipwho.is
  • https://stackoverflow.com
  • ipify.org
  • stackoverflow.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Uses constants related to Blowfish
Uses constants related to RC5 or RC6
Uses constants related to Twofish
Uses constants related to TEA
Malicious VirusTotal score: 48/66 (Scanned on 2026-07-13 15:16:32) ALYac: Gen:Variant.Application.fca.3927
APEX: Malicious
AVG: MSIL:Quasar-A [Rat]
AhnLab-V3: Backdoor/Win32.QuasarRAT.R341693
Antiy-AVL: Trojan/MSIL.Quasar
Arcabit: Trojan.Application.fca.DF57
Avast: MSIL:Quasar-A [Rat]
Avira: TR/Quasar.A
BitDefender: Gen:Variant.Application.fca.3927
Bkav: W32.Malware.C5663C86
CAT-QuickHeal: Trojan.Generic.TRFH927
CTX: exe.trojan.quasar
ClamAV: Win.Malware.Generic-9883083-0
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
DrWeb: BackDoor.Quasar.299
ESET-NOD32: MSIL/Agent.CLQ trojan
Elastic: Windows.Generic.Threat
Emsisoft: Gen:Variant.Application.fca.3927 (B)
F-Secure: Trojan.TR/Quasar.A
Fortinet: MSIL/Agent.BPH!tr
GData: MSIL.Backdoor.Quasar.A
Google: Detected
Jiangmin: Trojan.MSIL.aogzw
K7AntiVirus: Trojan ( 005b1c021 )
K7GW: Trojan ( 005b1c021 )
Kaspersky: HEUR:Trojan.MSIL.Quasar.gen
Malwarebytes: Quasar.Backdoor.Rat.DDS
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Trojan:Win/QuasarRAT.AA
MicroWorld-eScan: Gen:Variant.Application.fca.3927
Microsoft: Backdoor:MSIL/Quasar!atmn
NANO-Antivirus: Trojan.Win32.Quasar.lelzaq
Rising: Backdoor.Quasar!1.E5F1 (CLASSIC)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Sophos: Troj/Quasar-AF
Symantec: ML.Attribute.HighConfidence
TACHYON: Trojan/W32.DN-Quasar.3266560.C
Tencent: Backdoor.Msil.Quasar.16001301
TrendMicro: Backdoor.MSIL.QUASAR.SMTPTPI
TrendMicro-HouseCall: Backdoor.MSIL.QUASAR.SMTPTPI
VBA32: Trojan.MSIL.Quasar.Heur
VIPRE: Gen:Variant.Application.fca.3927
Varist: W32/MSIL_Troj.BTX.gen!Eldorado
VirIT: Trojan.Win32.MSIL_Heur.B
ZoneAlarm: Troj/Quasar-AF
huorong: Trojan/MSIL.Obfuscated.g!crit

Hashes

MD5 1ea4c4acd69a7b18c7dd0d105d9f75c9
SHA1 544ef67aa18fa15dc0a0a998dad4fb4d6da6f136
SHA256 0460643fb4625a715a7d40a35741fc998973ccb8011c213f3825c9fc5e9a36ff
SHA3 4a16e19193340354ea1864016757a02c3cb8635171e70989c9c84340fbbad1ac
SSDeep 49152:avPL82kyaNnwxPlllSWxc9LpQXpV+k9h8vJ3LoGd8lTHHB72eh2NT:avj82kyaNnwxPlllSWa9LpQX/hK
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2023-Mar-12 16:16:39
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x31c600
SizeOfInitializedData 0x1000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0031E53E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x324000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 891d2b73e3347ffa4ac9ee310f4803c7
SHA1 f88971b6494aeb5e5c631c34ed1495e6cfeba9fa
SHA256 5fc6e3392b479e4a49fdd6ec732d7f4403e510793391be15d6be5736efe74285
SHA3 07b97e41e2fd356d0abec3de1f556858ab270664b410f4729fbcea365f0c2f03
VirtualSize 0x31c544
VirtualAddress 0x2000
SizeOfRawData 0x31c600
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.07657

.rsrc

MD5 68a416ce230141b3d7f12bdbf7846ad9
SHA1 a106bdf06847803ed5ac2d2dfddd20cd355535d8
SHA256 0867ee7401de06b624887b69ba7c1c9ebbd9947d41fee9136f2bc270015d2296
SHA3 9478b90dd90c24bd36484d93706a2a04463d71bf5b5b439fe5206c32c702343e
VirtualSize 0xd64
VirtualAddress 0x320000
SizeOfRawData 0xe00
PointerToRawData 0x31c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.93685

.reloc

MD5 6232003922ffced833d3ca424c9ef38d
SHA1 198453a28ae88d40956fd0589b9b42a0dbef803c
SHA256 254d6e1f9673c2e648f1fbde0d0050435d645aef9350b1c756f61518ff8ff3f1
SHA3 be87833a7e5800927f28b0d85b848e7b488c2d59ac927769ab09207cf8bc869b
VirtualSize 0xc
VirtualAddress 0x322000
SizeOfRawData 0x200
PointerToRawData 0x31d600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.45157
MD5 21c8e38de0c090b9b835b703855cb8fa
SHA1 1592568a914207fb20bde4ece0e16f707898018b
SHA256 1df47a216c62ac85f5e5292391b8ee27028572930a65afa90671f5750d037a9e
SHA3 5266c64b37f0bcfa4b8670a598575ef648b197d01ad706211601cfd6baf617cf

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x6d7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.18029
MD5 ef224e384450bd3a0c3dc30e1fea01a8
SHA1 324739f2b1686d940bb3e241087e79c0fdc09381
SHA256 1896060246fc6b09837baf64f2b9888be8b6cb85e9840edf6e616a28da057250
SHA3 513da03328753cbf47106623ac5ad3711cd6061f7a71e1e793f52eff21ac9f59

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 38.7.3.0
ProductVersion 38.7.3.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName ForgeLink Systems Inc.
FileDescription Enterprise collaboration platform with real-time document editing, video conferencing, and project workflow automation.
FileVersion (#2) 38.7.3.0
InternalName forgelink-collaboration-enterprise-2026.07-full-x64-setup
LegalCopyright © 2026 ForgeLink Systems Inc. All Rights Reserved.
LegalTrademarks ForgeLink, ForgeLink Collaboration are registered trademarks of ForgeLink Systems Inc.
OriginalFilename forgelink-collaboration-enterprise-2026.07-full-x64-setup
ProductName ForgeLink Collaboration
ProductVersion (#2) 38.7.3.0
Assembly Version 38.7.3.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.