710e3d68540ec8bde302440cea7c4671bdec70ada10ec96a229411787149753e
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Oct-16 21:40:53 |
| Comments | |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Edge |
| FileVersion | 152.0.4191.62 |
| InternalName | msedge_exe |
| LegalCopyright | Copyright Microsoft Corporation. All rights reserved. |
| LegalTrademarks | |
| OriginalFilename | msedge_exe |
| ProductName | Microsoft Edge |
| ProductVersion | 152.0.4191.62 |
| Assembly Version | 152.0.4191.62 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Malicious | VirusTotal score: 52/70 (Scanned on 2026-09-06 06:01:14) |
ALYac:
Generic.AsyncRAT.Marte.B.9AE1396C
APEX: Malicious AVG: MSIL:AsyncRat-E [Pws] AhnLab-V3: Trojan/Win32.RL_Generic.C3546893 Antiy-AVL: Trojan[Backdoor]/MSIL.Crysan Arcabit: Generic.AsyncRAT.Marte.B.9AE1396C Avast: MSIL:AsyncRat-E [Pws] Avira: TR/AsyncRat.E BitDefender: Generic.AsyncRAT.Marte.B.9AE1396C Bkav: W32.Malware.B88FFA2 CAT-QuickHeal: Backdoor.MsilFC.S13564499 CTX: exe.unknown.asyncrat ClamAV: Win.Packed.Razy-9625918-0 CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.Siggen9.56514 ESET-NOD32: MSIL/AsyncRAT.A trojan Elastic: Windows.Generic.Threat Emsisoft: Generic.AsyncRAT.Marte.B.9AE1396C (B) F-Secure: Trojan.TR/AsyncRat.E Fortinet: MSIL/AsyncRAT.A!tr GData: MSIL.Backdoor.DCRat.D Google: Detected Jiangmin: Backdoor.MSIL.gguk K7AntiVirus: Trojan ( 005678321 ) K7GW: Trojan ( 005678321 ) Kaspersky: HEUR:Backdoor.MSIL.Crysan.gen Kingsoft: malware.kb.c.746 Malwarebytes: Generic.Trojan.MSIL.DDS McAfeeD: Real Protect-LS!84814AAF23CA MicroWorld-eScan: Generic.AsyncRAT.Marte.B.9AE1396C Microsoft: Backdoor:MSIL/AsyncRat!atmn NANO-Antivirus: Trojan.Win32.AsyncRAT.lhhviy Rising: Trojan.AntiVM!1.CF63 (CLASSIC) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: Fareit-FZT!84814AAF23CA Sophos: Troj/AsyncRat-B Symantec: Backdoor.ASync!g2 Tencent: Trojan.Msil.Agent.zap Trapmine: malicious.high.ml.score TrellixENS: Fareit-FZT!84814AAF23CA TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA5 VBA32: OScope.Backdoor.MSIL.Crysan VIPRE: Generic.AsyncRAT.Marte.B.9AE1396C Varist: W32/MSIL_Kryptik.DOD.gen!Eldorado VirIT: Trojan.Win32.MSIL_Heur.A Webroot: Win.Trojan.Gen Zillya: Trojan.AsyncRAT.Win32.29748 ZoneAlarm: Troj/AsyncRat-B huorong: Backdoor/MSIL.DcRat.a |
Hashes
| MD5 | 84814aaf23ca4666298cac8426ccd196 🔍 |
|---|---|
| SHA1 | 34fb69c0cfd864b0fff2169e7dde61e37b1a0ed5 🔍 |
| SHA256 | 710e3d68540ec8bde302440cea7c4671bdec70ada10ec96a229411787149753e 🔍 |
| SHA3 | 448926f1dd9608124672ff8a001d1bd7b87d3b4b781b2b5086149b4fcdfd7006 🔍 |
| SSDeep | 3072:Fu06TBncr2YX8UboruWNqRUORWBToN1Uniyimyx2:Fu0+bHUb9WsRbUaURy8 🔍 |
| Imports Hash | f34d5f2d4577ed6d9ceec516c1f5a744 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2023-Oct-16 21:40:53 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0xa800 |
| SizeOfInitializedData | 0x11000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000C76E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0xe000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x22000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | e6a1be7d7924fc149310c6f06032d15b 🔍 |
|---|---|
| SHA1 | 54471ba0851b7da7465a09528696aaee4cbd1209 🔍 |
| SHA256 | 9f4afe205ca046e1238abd1d6610d4bf543269be6a97f1dfc75625153bef736a 🔍 |
| SHA3 | 78e8d42299ba6818b40c8ede97cd68420497a17fe4d102d04fe25fada3d1b5e8 🔍 |
| VirtualSize | 0xa774 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0xa800 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.51172 |
.rsrc
| MD5 | d9f3a878a1b9b7bc6f5f66cb9bb45a9b 🔍 |
|---|---|
| SHA1 | 42b661792727dff0a2ec5492a887da09c4b03fcb 🔍 |
| SHA256 | 118497137458601d777229586258a806468105f62e48a80e9ff5e18405468391 🔍 |
| SHA3 | cba673569d08eae1714530cf1a78ad1272d5b07c781b7b4e05856fea1a8f7bff 🔍 |
| VirtualSize | 0x10c68 |
| VirtualAddress | 0xe000 |
| SizeOfRawData | 0x10e00 |
| PointerToRawData | 0xaa00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.65168 |
.reloc
| MD5 | 0c63fd53f0585494a34bab03f5aa6db2 🔍 |
|---|---|
| SHA1 | f7447c055f64b3b0af92c26179a80335f690f908 🔍 |
| SHA256 | 9b266038f8db97705e634da082546697dc2e01c2e08a907285e16baa68bfb126 🔍 |
| SHA3 | 3db42ae93f66882105dbf5c57224393ac568b878844efb538b3c80be6ad9f344 🔍 |
| VirtualSize | 0xc |
| VirtualAddress | 0x20000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1b800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 0.0815394 |
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x5992 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.92355 |
| Detected Filetype | PNG graphic file |
| MD5 | 5d5cd404dda8a6409b28d59bd1c7c9c6 🔍 |
| SHA1 | 4ece936b261e7d84009707955c3408637c3e815f 🔍 |
| SHA256 | e387d8ead2ee578b87069d37661b8d6a17649738300f172309a5f77310facd12 🔍 |
| SHA3 | 9eaaf9aa2b0d1eae6f5b40ac6f9c884ac16e5b0227cdac3f2b09b186b5d0e23e 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.45828 |
| MD5 | 2c78774dd208f4ab76ea5eac623b69d5 🔍 |
| SHA1 | fc1fdc20825a807346700e0663505b718396bd66 🔍 |
| SHA256 | 761ed25024f100a25bb3ff1f5af8658abe16086cf8eeecf35f9a7493089dbf60 🔍 |
| SHA3 | 0985e06180d389d07922fdb9560bb0221ec6dc28573483bad3ac59be42ea079f 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.49799 |
| MD5 | 7744d08204370f134c8fafc9fc9ba574 🔍 |
| SHA1 | 4a944306de7a48498b37a8c8d5ffbdca86a8ce90 🔍 |
| SHA256 | f46daaedf599ca9b840f34473f1e7dcd7d59e6436c89ac87c51a56b960ca0556 🔍 |
| SHA3 | 29aef36a79e47fa703933c59fa12e169768d45cab866a324557d2ab3d5f5bd29 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x1a68 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.57683 |
| MD5 | 0adc3f87808b04f87718d32a7f5efe18 🔍 |
| SHA1 | da0ed8c771bc91ca4c1e03bdc88487f78d5ed8b1 🔍 |
| SHA256 | d35a6854b3997967f86d712561163ee83d0744ee90edb0d07b6fb9dee0e3b11d 🔍 |
| SHA3 | 592938e9f50329e0a04bcd6e44fd05720341851e8afb910901a975400df92404 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.71509 |
| MD5 | 892de54c9aac9bdb22c4e5ac87d02c53 🔍 |
| SHA1 | 9a605da180d0cbda0ce8302942021a69acf51189 🔍 |
| SHA256 | ff67d10f20866c49aad622ec404b27f3bba5da9411e442b0adedd0001a520c64 🔍 |
| SHA3 | ada7ce9062fca19c3aa94af7da88963309b9b5f017a159ae448cbcea0ea127c2 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.76024 |
| MD5 | f2916239a71269e53ac5e526757f7b50 🔍 |
| SHA1 | 6fcec38863fe5537abdbec4d2a5b0d69a17d2bcd 🔍 |
| SHA256 | 810e886ee71854383702ad56bf782f1d0672f142baf6e366bc178368d3503796 🔍 |
| SHA3 | 9a179b1878a012d0dfceb23c733fc48b71933aa13342aedaf8beb5bd5ff0b4ac 🔍 |
7
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x6b8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.97393 |
| MD5 | 1cd24f84a1d7f0c71c45cc13504e0910 🔍 |
| SHA1 | fbfd75f4e810e850b07ac4ccbe228ef20b5db167 🔍 |
| SHA256 | cac5649212afad33f2c0faac40e7e6311e23fd2f39a4c44bc5b5eb1e3ae67611 🔍 |
| SHA3 | 3721aaf68f6dd404ed4edd7848c436fbba8e53f77102653a102f5c2da6a9a0b6 🔍 |
8
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.93295 |
| MD5 | 28de43ca8cc76b2564891550c1ff48be 🔍 |
| SHA1 | 9464b779ceaffc9924b6dbd87d11a868c28852ce 🔍 |
| SHA256 | 976f423f50cb0e8b1f3d017672fdaa433ef774865b200bd05ecac24cb500c27b 🔍 |
| SHA3 | 0097374d6a3102399822e66e03016863aaf820bd02baa719fe9f3f6cccfb7eb4 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x76 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.46085 |
| Detected Filetype | Icon file |
| MD5 | 99602b65a5e5ea44e4b1c9caa0d4a4c1 🔍 |
| SHA1 | 6db1aae0a29ddd2699b26c492b6c7925230e9469 🔍 |
| SHA256 | 51186e34e2e652cd0a2044de48b46b334df595beb45edd6088fe8cff67971d7d 🔍 |
| SHA3 | c9480a62fec9915b1ff57f65a1d46b56982cdc077da40ed3458751141d487056 🔍 |
1 (#3)
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x3c0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.41031 |
| MD5 | 583a3595b58f6cca15f5c54a93132131 🔍 |
| SHA1 | ed9ac6965a6b1e2f7cf498fd1c64170b8a8d6d01 🔍 |
| SHA256 | 216c643ba16eea63fbb43e846f74e462de8ce5c21cd94a58d01be9a5beab7321 🔍 |
| SHA3 | 467f7f5b6bd36d4b3888dc2d3e2b5d3fad78966cbef7c15f0206501b72c82201 🔍 |
1 (#4)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x493 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.22615 |
| MD5 | f3d7095de1636559aa56ad81b25bbff9 🔍 |
| SHA1 | 6a55e1445c1c915664fba385828c5a0078fe460d 🔍 |
| SHA256 | 4ff1c75a93b2280dabe75acecade82d644388c9f4412565d846aeb396bfdc133 🔍 |
| SHA3 | 66d420e8633fd20ebea3048e5ed6afe3cf66dcb6d5041729ab7c7faa44b0a1b0 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 152.0.4191.62 |
| ProductVersion | 152.0.4191.62 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Edge |
| FileVersion (#2) | 152.0.4191.62 |
| InternalName | msedge_exe |
| LegalCopyright | Copyright Microsoft Corporation. All rights reserved. |
| LegalTrademarks | |
| OriginalFilename | msedge_exe |
| ProductName | Microsoft Edge |
| ProductVersion (#2) | 152.0.4191.62 |
| Assembly Version | 152.0.4191.62 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.