4a88e212e7d4648780c747587d7d131a86fe370b23ce6557fdb804d712086136

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2055-Dec-24 00:27:33
Debug artifacts F:\Tool\Upgrade\Upgrade Tool v1.0\obj\Release\Upgrade Tool.pdb
Comments
CompanyName
FileDescription Upgrade Tool v1.0
FileVersion 1.2.0.0
InternalName Upgrade Tool.exe
LegalCopyright Copyright © 2024
LegalTrademarks
OriginalFilename Upgrade Tool.exe
ProductName Upgrade Tool v1.0
ProductVersion 1.2.0.0
Assembly Version 1.2.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • dotnet.microsoft.com
  • https://dotnet.microsoft.com
  • https://dotnet.microsoft.com/get-dotnet/dotnet-framework?tfm
  • microsoft.com
Suspicious VirusTotal score: 2/66 (Scanned on 2026-09-18 04:37:41) Malwarebytes: MachineLearning/Anomalous.95%
TrendMicro-HouseCall: Trojan.MSIL.Gen.TL0101HR26ZE

Hashes

MD5 70a717a60f9885c8ab338cd1cfecba80 🔍
SHA1 74ca19d120b41b4b6d374f81db8f7b460c8c244d 🔍
SHA256 4a88e212e7d4648780c747587d7d131a86fe370b23ce6557fdb804d712086136 🔍
SHA3 f74427841fceddcf17e8cd9a3dbb01f15e97a6b2fc1d76b8e540cd665d3369d4 🔍
SSDeep 3072:6lVZcXs5FHcITmwm6+gXJsaV5LMUbUk+u3zMyrxWVO:S3ssL8gXbFUk+uDTrxWV 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2055-Dec-24 00:27:33
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x25400
SizeOfInitializedData 0x3e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000273CA (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x28000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2e000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 21d6c0f7ccde7f9bfba05473246ebebb 🔍
SHA1 a6f7fa857f76ea93667b67069629237c091d0c5b 🔍
SHA256 12f97f5a39058445bc44997b6e31f6d90147026329c931921390934582f4624b 🔍
SHA3 e6b45b4c4722589728a1a85e02b21ecc0fe16c255dfaa8b347230438ef6a9942 🔍
VirtualSize 0x253e8
VirtualAddress 0x2000
SizeOfRawData 0x25400
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.38469

.rsrc

MD5 915ec3634bae110649b74f8b470e9f61 🔍
SHA1 5029aca5b2411aa9cceac8588895b06d06946fe0 🔍
SHA256 700c1abe3c97fb614be8dbe305fa7e64721d9024865cf3e274c93d47dd0069ef 🔍
SHA3 89f070e8d46743fed2d0ca5fec574d7ce240608a7fa42ef43cd7e3b2401a13fa 🔍
VirtualSize 0x3aac
VirtualAddress 0x28000
SizeOfRawData 0x3c00
PointerToRawData 0x25600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.69492

.reloc

MD5 94fad0ed0567711fdc2a5caf98727664 🔍
SHA1 9093e8adfbb0afa568430e27be3b936dde6cbcaa 🔍
SHA256 119f3c6e0c0622af6161e1c2ad885926ca189a23aae49c35ae720888f5f6fdd4 🔍
SHA3 ea802cb2dc4ac614a370b46e8808552c6b7f453e640ad695fef9d44560966573 🔍
VirtualSize 0xc
VirtualAddress 0x2c000
SizeOfRawData 0x200
PointerToRawData 0x29200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x342c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.94738
Detected Filetype PNG graphic file
MD5 8adf15b2e533f888a4276073f0b99672 🔍
SHA1 9f253d4753968d21c24369e624aeac7bfbebe578 🔍
SHA256 461a35860fad0051045a10e71c91a4164c10a74d2fc2e8195b26cb8734997f59 🔍
SHA3 bbffa6d5ad173317c42e9b14f74ba3caa9bc85e6910336078d8dd9d06239cd34 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.51664
Detected Filetype Icon file
MD5 c9ad2bfeb91946fa05afb3bb8762766c 🔍
SHA1 e39d5286e23c306b0a700f32664c2526c08b64d5 🔍
SHA256 0f5a4ed02d4e224bcd248d8311cdb039836670500484f83772727c2df58aeff5 🔍
SHA3 3cee557d2fbe88c7cd09462e806bd042e7a6c8c353844722b382fe3811fa685a 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x34c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31384
MD5 f89aba63c51327ea5077a1459eca687c 🔍
SHA1 0be073127137b465a9fd3795b77403548b913f34 🔍
SHA256 9cbd2ecf4f88899a2f5949e806cbb7b303144bed179a3d905028866f5945753f 🔍
SHA3 8a3f408b1d8b8be31c38c52c3618793047854be81da8e08d72504546201fb4f8 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.2.0.0
ProductVersion 1.2.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription Upgrade Tool v1.0
FileVersion (#2) 1.2.0.0
InternalName Upgrade Tool.exe
LegalCopyright Copyright © 2024
LegalTrademarks
OriginalFilename Upgrade Tool.exe
ProductName Upgrade Tool v1.0
ProductVersion (#2) 1.2.0.0
Assembly Version 1.2.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2044-Jan-11 06:07:51
Version 0.0
SizeofData 87
AddressOfRawData 0x27320
PointerToRawData 0x25520
Referenced File F:\Tool\Upgrade\Upgrade Tool v1.0\obj\Release\Upgrade Tool.pdb

UNKNOWN

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.