Manalyze report for 4dfc227bb3ec1a4082968c4d106f1dd545077a57af55a45c67a89c17073773d4

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Sep-19 14:09:23
FileDescription
FileVersion	`0.0.0.0`
InternalName	OPEN IT!.exe
LegalCopyright
OriginalFilename	OPEN IT!.exe
ProductVersion	`0.0.0.0`
Assembly Version	0.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Malicious	VirusTotal score: 8/71 (Scanned on 2026-10-10 14:44:16)	`APEX: Malicious` `Bkav: W32.Malware.BC9FA631` `Cylance: Unsafe` `Elastic: malicious (high confidence)` `MaxSecure: Trojan.Malware.300983.susgen` `McAfeeD: Real Protect-LS!BA53F24895E8` `SentinelOne: Static AI - Suspicious PE` `Trapmine: malicious.moderate.ml.score`

Hashes

MD5	`ba53f24895e82c3cdcd5a0ec5731acfb` 🔍
SHA1	`7e8dbd7c6efe0087108c3ce56092c977ce0ee447` 🔍
SHA256	`4dfc227bb3ec1a4082968c4d106f1dd545077a57af55a45c67a89c17073773d4` 🔍
SHA3	`9246f607f47863c48d66bb4b4867fb48c164d5c0f9356eef0f0b9aab02ea2969` 🔍
SSDeep	`96:YDC+zwyfcY4b+FWCAiAUuVMRdI0YgErC9v0W1TLuKKYzNt:Y2lyfdLWCiUuG5Yq9v0Wc6` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Sep-19 14:09:23
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x1000`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00002FBE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`1517db6c606bd375be519aeeb12393ff 🔍`
SHA1	`7c4c0484e1be567e0d86ea40b3a769b366a37610 🔍`
SHA256	`bfa5a4953bd01ce2da716dd282be84b43bea40080bc48d0981995adc043316a0 🔍`
SHA3	`f6dcb09bcdf1842b6a3a1305f224fec2570c953945ef3b52d41108cf7506f77a 🔍`
VirtualSize	`0xfc4`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.47885`

.rsrc

MD5	`f3f952eee268fc511f330e927078f8a1 🔍`
SHA1	`b325c6086c08202f2f65095dc7c373a0526364ff 🔍`
SHA256	`2ace1ce84325172ad7e90150960e267c5be031523ecf610b57eed1c4b5154516 🔍`
SHA3	`4412a30f2d3acfd8f84cd7de90f23c51bc572acbdac99235c78ac660d864a0e8 🔍`
VirtualSize	`0x4e0`
VirtualAddress	`0x4000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.72827`

.reloc

MD5	`b2484c52e05637a646b9be47a7e54b78 🔍`
SHA1	`7e937be483bee5b91a7be4e4db0a85f8671a26ab 🔍`
SHA256	`4f73880c0684b805ad10118289aebc5261a820cd582329ded81dcc37a21ec88e 🔍`
SHA3	`ae870fc91e5b7d0747c951c7dd3d33b55adfff9ca7e210bd475470d69cbd2f1a 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x24c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.18558`
MD5	`10b9bf365a62ad9af61f5241aa64947a 🔍`
SHA1	`879fe9c7d520462a1e6d23377e3640bfe97458c7 🔍`
SHA256	`3dc2cb57d1e8aae940bdb5b409cec14d38d16986038b236c9e0bdca1c3bfe462 🔍`
SHA3	`54775152d18096f296fee7718cfe67df300118940b353aa0369cb4e918530756 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1 🔍`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650 🔍`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f 🔍`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription
FileVersion (#2)	0.0.0.0
InternalName	OPEN IT!.exe
LegalCopyright
OriginalFilename	OPEN IT!.exe
ProductVersion (#2)	0.0.0.0
Assembly Version	0.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.