26521ffa9beb5b9f6d82cf0e62463fce087f123a46051cb0ba9bc729433617c8
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Nov-26 01:53:23 |
| Debug artifacts |
C:\Users\hpcou\OneDrive\Desktop\Manager\Source Code\Updater\obj\Debug\Updater.pdb
|
| Comments | |
| CompanyName | |
| FileDescription | Updater |
| FileVersion | 1.0.0.0 |
| InternalName | Updater.exe |
| LegalCopyright | Copyright © 2017 |
| LegalTrademarks | |
| OriginalFilename | Updater.exe |
| ProductName | Updater |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Malicious | VirusTotal score: 42/67 (Scanned on 2024-01-10 01:04:11) |
AVG:
Win32:DropperX-gen [Drp]
AhnLab-V3: Dropper/Win.Generic.C5322081 Alibaba: Trojan:MSIL/Mamut.5180799d Arcabit: IL:Trojan.MSILMamut.D2903 Avast: Win32:DropperX-gen [Drp] Avira: TR/Dldr.Agent.nwjst BitDefender: IL:Trojan.MSILMamut.10499 Bkav: W32.AIDetectMalware.CS CAT-QuickHeal: Trojan.YakbeexMSIL.ZZ4 CrowdStrike: win/malicious_confidence_100% (W) Cylance: unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS ESET-NOD32: a variant of MSIL/TrojanDownloader.Agent.NAV Elastic: malicious (high confidence) Emsisoft: IL:Trojan.MSILMamut.10499 (B) F-Secure: Trojan.TR/Dldr.Agent.nwjst Fortinet: MSIL/Agent.NAV!tr GData: MSIL.Trojan-Downloader.Agent.BEX Google: Detected Ikarus: Trojan.Crypter K7AntiVirus: Trojan-Downloader ( 00597b251 ) K7GW: Trojan-Downloader ( 00597b251 ) Kaspersky: not-a-virus:HEUR:AdWare.MSIL.ConvertAd.gen Lionic: Adware.Win32.MSILMamut.2!c Malwarebytes: Malware.AI.4287086129 MaxSecure: Trojan.Malware.74444617.susgen McAfee: GenericRXVF-PW!A8A53B816141 MicroWorld-eScan: IL:Trojan.MSILMamut.10499 Microsoft: Trojan:MSIL/Mamut!MSR Rising: Downloader.Agent!8.B23 (CLOUD) SUPERAntiSpyware: Trojan.Agent/Gen-Downloader Sangfor: Downloader.Msil.Agent.Vych SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win32.Generic.ch Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.13fc0981 TrendMicro: TROJ_GEN.R002C0DA624 TrendMicro-HouseCall: TROJ_GEN.R002C0DA624 VIPRE: IL:Trojan.MSILMamut.10499 ZoneAlarm: not-a-virus:HEUR:AdWare.MSIL.ConvertAd.gen |
Hashes
| MD5 | a8a53b8161411ee69dfd3df3b3b8d5b5 🔍 |
|---|---|
| SHA1 | bcd3255bbd4109d6c605eee7dfafd573ebc5df75 🔍 |
| SHA256 | 26521ffa9beb5b9f6d82cf0e62463fce087f123a46051cb0ba9bc729433617c8 🔍 |
| SHA3 | 5da174553e2fee81ae1559114407200909487bc39997bd84b3bbc525d5c7c940 🔍 |
| SSDeep | 3072:RjiZ/21bKlmzPvgzfZZq5xvCBDquc/21WkE7:ROZ/21bRTvSf/KxvCc/21NE 🔍 |
| Imports Hash | f34d5f2d4577ed6d9ceec516c1f5a744 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2023-Nov-26 01:53:23 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x1c800 |
| SizeOfInitializedData | 0x9400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001E632 (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x20000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2c000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 0cf70cb015c79d5fe4719207d6fbbe64 🔍 |
|---|---|
| SHA1 | dfa832bb8e1829452767dcba22e8983391d4d4ff 🔍 |
| SHA256 | 93db08f5a045a5299dfdf8df4420f1391bb9437dabff8e427b67f3f2a553c4eb 🔍 |
| SHA3 | a92700e2304dfba5009fcd9533b6cfb36313e2791d371a0d17f7a3dfb00447df 🔍 |
| VirtualSize | 0x1c638 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x1c800 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 7.04678 |
.rsrc
| MD5 | 4cdde23c3421010970fe15151dfd171b 🔍 |
|---|---|
| SHA1 | c3ca04d01a3924bb2a7f4bad63dde19aa7a6001d 🔍 |
| SHA256 | 4acd2bfa48f655939924efd4dfc8cbb8fd77f590213f0dbd7d83e92d8e316b14 🔍 |
| SHA3 | 769750a29cf52fd246cad22988a56bd748007d203902cc34ff1c17cba29df47a 🔍 |
| VirtualSize | 0x9064 |
| VirtualAddress | 0x20000 |
| SizeOfRawData | 0x9200 |
| PointerToRawData | 0x1ca00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.84613 |
.reloc
| MD5 | d874546fdd492a6b21a7c094c74e1ea1 🔍 |
|---|---|
| SHA1 | a085d40a7db8a2a56afa60b5c59b15fadf21a896 🔍 |
| SHA256 | fd8d036efadef669d30ba83a1628095c291abaaa94d880b64bba4c52ce8d0c1d 🔍 |
| SHA3 | 3d999a4327f498619ff3d5c01a8cd9279a82cc44346f20cb5fe12fd8d1532cad 🔍 |
| VirtualSize | 0xc |
| VirtualAddress | 0x2a000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x25c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 0.10191 |
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x7eb4 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.55154 |
| MD5 | de40dfcf1e8500a28679c2c4b1ceec85 🔍 |
| SHA1 | 71c063123b8c0f19826bee7c5fd2a333680a393e 🔍 |
| SHA256 | 9d3534e4d9d175fe4a6fbd225f1a7c2925e94f2d9472470e26a8d1e0b7b20edb 🔍 |
| SHA3 | 9261ad5624f856fd014045994e3b2f5a721fc1e4af4a446604d80f7aa774b97c 🔍 |
32512
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.01924 |
| Detected Filetype | Icon file |
| MD5 | 2029f9fcfc282d6b498e48550f86b8e4 🔍 |
| SHA1 | 3ac804437dc833c543ee145d8ff4954c6185c1f8 🔍 |
| SHA256 | 0e7456bd2dfed1b75afbcd74a2d7e327ad510dd9875d68cd5bb89c57d9b7a9c6 🔍 |
| SHA3 | 10008ae13d98bc8668dbbb3bacda7344745e714cf1226f94394a7de6dd676951 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x30c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.24946 |
| MD5 | 8e96df7250814d41bbc814f54f597ac1 🔍 |
| SHA1 | e42135c3f9ce61b2f5f00c6707d089ea2b27ce70 🔍 |
| SHA256 | 824efaef0f4292ef5c758587ce95b7e5f27b0fff5288a4e87d881f12fb9dabba 🔍 |
| SHA3 | bf8c5d3c0b304423d79d50241acb5540444269e0df73fbfad954736d1fd04f84 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0xd59 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.00156 |
| MD5 | 2c004d967207f68a79dc49b7553c037c 🔍 |
| SHA1 | 93ac43e95aa9217cc48be43a35727e6bfb0e527b 🔍 |
| SHA256 | c3ab380cac3d533c7edce184b3105ebc2c7f2dacef03a34cdbebf3d9d8ad2ad3 🔍 |
| SHA3 | 3b058139f2b38c8211da23d1adc46b051ca59f81886669dcec23de6403705f08 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | Updater |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | Updater.exe |
| LegalCopyright | Copyright © 2017 |
| LegalTrademarks | |
| OriginalFilename | Updater.exe |
| ProductName | Updater |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Nov-26 01:53:23 |
| Version | 0.0 |
| SizeofData | 284 |
| AddressOfRawData | 0x1e4c4 |
| PointerToRawData | 0x1c6c4 |
| Referenced File | C:\Users\hpcou\OneDrive\Desktop\Manager\Source Code\Updater\obj\Debug\Updater.pdb |
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.