062a01a2bd320aef927127082c3ad4edd8ce3ef43647dfb84b17ed6412045dd8
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2078-Sep-09 06:54:17 |
| Debug artifacts |
ExamBrowser.pdb
|
| Comments | |
| CompanyName | |
| FileDescription | Downloadpembaruan |
| FileVersion | 1.0.0.0 |
| InternalName | ExamBrowser.exe |
| LegalCopyright | Copyright © 2023 |
| LegalTrademarks | |
| OriginalFilename | ExamBrowser.exe |
| ProductName | Downloadpembaruan |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to SHA256 |
| Malicious | VirusTotal score: 20/71 (Scanned on 2026-10-06 01:11:57) |
APEX:
Malicious
CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_70% (D) DeepInstinct: MALICIOUS Elastic: malicious (moderate confidence) Google: Detected Gridinsoft: Trojan.Win32.Wacatac.dd!n Lionic: Trojan.Win32.Generic.mGMW Malwarebytes: Malware.AI.4103521161 MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Real Protect-LS!F65A169648AA Microsoft: PUA:Win32/Packunwan Paloalto: generic.ml SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Infected.dt TrellixENS: Artemis!F65A169648AA Varist: W32/ABApplication.NTUK-3917 VirIT: Trojan.Win32.MSIL_Heur.A alibabacloud: Suspicious tehtris: Generic.Malware |
Hashes
| MD5 | f65a169648aa0caf603879f79226bca5 🔍 |
|---|---|
| SHA1 | b5ba800a1be654efe702ab9aced5e3509813a165 🔍 |
| SHA256 | 062a01a2bd320aef927127082c3ad4edd8ce3ef43647dfb84b17ed6412045dd8 🔍 |
| SHA3 | 32ccf47f3c4104c7b55ee1e6cd4e8c2c383f1f96969dbdefdca83a4ac6144451 🔍 |
| SSDeep | 3072:lZvzwHa/w8lIh3+e/X5O401f6tOy401f6tR:zLwHa/wEpQ5O40fy40 🔍 |
| Imports Hash | f34d5f2d4577ed6d9ceec516c1f5a744 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2078-Sep-09 06:54:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x2ae00 |
| SizeOfInitializedData | 0x1b200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0002CCCE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x2e000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x4c000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 15 |
.text
| MD5 | 84e53d4dec72b98855ac789b4fd84d02 🔍 |
|---|---|
| SHA1 | 6d968eeccf4a95927370a635468b696db6c80c86 🔍 |
| SHA256 | 58a41f912a82af402ee8a0cbbddd1af535233e814363fe60732a78385a96530b 🔍 |
| SHA3 | 08a2a4a7905e83ea3436dd375b1e161ee9395128f0aac0e31109abd4ad14013a 🔍 |
| VirtualSize | 0x2acd4 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x2ae00 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.01922 |
.rsrc
| MD5 | 763322512b860a99646b8c1dd2a4dacd 🔍 |
|---|---|
| SHA1 | be602f6e0cfd6160cef21d9206dcc2032595dbae 🔍 |
| SHA256 | e62d4433bbf5ffce1560a231ee763e8af3b602b6164ec1919f016d31ed11f1ca 🔍 |
| SHA3 | d83a0c6e4254bfe890ca31ecc9088debfde83f89e062b85d50c4ed20933a4507 🔍 |
| VirtualSize | 0x1ae4c |
| VirtualAddress | 0x2e000 |
| SizeOfRawData | 0x1b000 |
| PointerToRawData | 0x2b000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.78552 |
.reloc
| MD5 | e7343ac6c3e556d2d5ee611242ad3369 🔍 |
|---|---|
| SHA1 | e86d041ad29f4949497d8f76f4342e061a66100d 🔍 |
| SHA256 | f77cde3de73c98ea9cfb1ebf67684e547f0856a8883d002e8e4cae2b79245241 🔍 |
| SHA3 | e0a7746b172c056f46ab0b554855caef386597080c5cb3f6e5930bdfa4313253 🔍 |
| VirtualSize | 0xc |
| VirtualAddress | 0x4a000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x46000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 0.10191 |
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2198 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.90318 |
| Detected Filetype | PNG graphic file |
| MD5 | 3a77a4d0f07e6804721677902cbb11d6 🔍 |
| SHA1 | d9fe469996c7638356afa5ace7dcad1eccad13d4 🔍 |
| SHA256 | 2ad8e0f6d1def7b0eb8d9e24e4e8d891f5b73558d53d3c38de583bec2278b906 🔍 |
| SHA3 | 34099f73ca63742983e15eb6c610cefeed1d07bf8c237a7df5e11e6f3f93a78f 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.87722 |
| MD5 | 377b0e60fe860dad7efeaf6407332d2c 🔍 |
| SHA1 | 9a87e09ebf8201002d7f0a191f629710fc893f3f 🔍 |
| SHA256 | 50e4cf30473691724edbb724fda2e57232c700ba28a678b46c429a774d7d876b 🔍 |
| SHA3 | 84a110e0e0036afe51fff1aa695055d880a76a43f9a732528eca90c6db34b3be 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.2445 |
| MD5 | e4b502833b77fc7685039ca2fb03685e 🔍 |
| SHA1 | 3b4a16b3f4f44f4b7779167c921b65d44c229f35 🔍 |
| SHA256 | f7e3a99be562f2f8662a44d88a8efd624bab2c161826829333922d85f94d5c26 🔍 |
| SHA3 | d9551a84e424b9ce7398f75423edb5dca21dac13cda1ffffcc82b04e79b397b0 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.53857 |
| MD5 | a43b0b1fc907ee6f1f8df1a0f167c332 🔍 |
| SHA1 | 39e65b8540debe433a126834edbc78d8fe21bf19 🔍 |
| SHA256 | 6a1c7b8f629a883d0227c4960b6781b0c30f89f1eec4b1dfee632ae834f3e142 🔍 |
| SHA3 | 00352d57f12c67ebcc5c9a7905f183295f37ec145ff8fe9743d5c404c7c9b113 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.86927 |
| MD5 | 6df181cd9e14875cf1d33a091c6f03e8 🔍 |
| SHA1 | 55b86a54a531e294e5d69eeb34b456b7dd57935a 🔍 |
| SHA256 | a708710bf7f1a6940578318ec69df5e3d6fbc03098af4518ad4c3e7f14f704a8 🔍 |
| SHA3 | 803262e5d4af1f1aac1e4d763a5c2de6607e107249c662cc892f8e674cf3a396 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.572 |
| MD5 | 343efa10a7cf76a5dfa0a3abe1620b9d 🔍 |
| SHA1 | 2bad3d8247ffb0ba33a2de384c9d70cd82891a0d 🔍 |
| SHA256 | 72fb9140474de66c4e58770ef30e19ea2fffa9422348e96f0bd054a009e7991a 🔍 |
| SHA3 | c2653b8dbc46c6d23a1ac98f652711e4edf23808acfda92cf319f85cb4e0bdc8 🔍 |
32512
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x5a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.79908 |
| Detected Filetype | Icon file |
| MD5 | d3b26eec5ca376469723b7fdbb4856b2 🔍 |
| SHA1 | 2bc50a9f2af595ea5d32114f96dc1430b897bb9c 🔍 |
| SHA256 | 787fd7c15d48cea2574359425232ba6dd31a75aac4e3f7cb4543c73264b1e460 🔍 |
| SHA3 | 54784a7b1ea5401c399968496e44d86fd6b05a35be1c3aef854c22f3d1eca4fd 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x344 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.29688 |
| MD5 | 3ba63367b4bf6d56d4f463e89954d323 🔍 |
| SHA1 | b30e721de6c5eb900b059ea835aa72e722c6ea0b 🔍 |
| SHA256 | 15abcf92586b656db8b240a6510a853b9ee4f8e8aa3d95a522355d2c426adfbe 🔍 |
| SHA3 | 8efdbcf0e29ec8eab2f2c99daa01bdb96cbad8965df58cb1de8f411c77ee181e 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x1ea |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.00112 |
| MD5 | b7db84991f23a680df8e95af8946f9c9 🔍 |
| SHA1 | cac699787884fb993ced8d7dc47b7c522c7bc734 🔍 |
| SHA256 | 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍 |
| SHA3 | 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | Downloadpembaruan |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | ExamBrowser.exe |
| LegalCopyright | Copyright © 2023 |
| LegalTrademarks | |
| OriginalFilename | ExamBrowser.exe |
| ProductName | Downloadpembaruan |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 40 |
| AddressOfRawData | 0x2cc56 |
| PointerToRawData | 0x2ae56 |
| Referenced File | ExamBrowser.pdb |
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.