Manalyze report for 81f786015cda52f8f3291e828d2ef138d2aae0560f914203b0f17b232678155c

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Jun-17 13:38:50
FileDescription
FileVersion	`1.0.0.0`
InternalName	MasonClient.exe
LegalCopyright
OriginalFilename	MasonClient.exe
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Looks for VMWare presence: vmware` `Looks for Sandboxie presence: SbieDll.dll` `Accesses the WMI: root\Security` `Miscellaneous malware strings: CMD.EXE cmd.exe` `Contains domain names: http://ip-api.com ip-api.com`
Malicious	VirusTotal score: 43/69 (Scanned on 2026-06-17 13:42:09)	`ALYac: Gen:Variant.Application.cerbu.74968` `APEX: Malicious` `AVG: Win32:MalwareX-gen [Drp]` `AhnLab-V3: Trojan/Win.AntiVm.C5216535` `Antiy-AVL: Trojan/MSIL.Zilla` `Arcabit: Trojan.Application.cerbu.D124D8` `Avast: Win32:MalwareX-gen [Drp]` `Avira: DR/W32.MalwareX` `BitDefender: Gen:Variant.Application.cerbu.74968` `Bkav: W32.Malware.DF16DC40` `CTX: exe.unknown.cerbu` `CrowdStrike: win/malicious_confidence_100% (D)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `DrWeb: BackDoor.XWormNET.9` `ESET-NOD32: MSIL/XWorm.B trojan` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Variant.Application.cerbu.74968 (B)` `F-Secure: Dropper.DR/W32.MalwareX` `Fortinet: MSIL/Agent.ECL!tr` `GData: MSIL.Backdoor.SiRAT.A` `Google: Detected` `Ikarus: Trojan.MSIL.Agent` `K7AntiVirus: Trojan ( 700000201 )` `K7GW: Trojan ( 700000201 )` `Malwarebytes: Trojan.Crypt.MSIL` `McAfeeD: Real Protect-LS!D0B5D687FABA` `MicroWorld-eScan: Gen:Variant.Application.cerbu.74968` `Microsoft: Trojan:MSIL/AsyncRAT.R!MTB` `Rising: Trojan.AntiVM!1.CF63 (CLASSIC)` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: Trojan-JAHI!D0B5D687FABA` `Sophos: Troj/RAT-KM` `Tencent: Trojan.Msil.Agent.16001768` `Trapmine: malicious.high.ml.score` `TrellixENS: Trojan-JAHI!D0B5D687FABA` `TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA3` `VBA32: Malware-Cryptor.MSIL.AgentTesla.Heur` `VIPRE: Gen:Variant.Application.cerbu.74968` `VirIT: Trojan.Win32.MSIL_Heur.A` `ZoneAlarm: Troj/RAT-KM` `huorong: HEUR:Trojan/Agent.ai`

Hashes

MD5	`d0b5d687fabaeb719da06522c8bda736`
SHA1	`cbaaca6d885b8a4ff4c62afe2b256c213696ba62`
SHA256	`81f786015cda52f8f3291e828d2ef138d2aae0560f914203b0f17b232678155c`
SHA3	`1049f13881bf5d06583166bbc504495b338c12a3b5d42270c6739c514f623f60`
SSDeep	`1536:rmHotUWIwUOU4N9UUPvZLzXOc4XOcHXOcSXOczXOcBfWkUOXUk+9mb4mSXOch5N:rmHotUWIwUOU4N9UmvZLzXOc4XOcHXO`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Jun-17 13:38:50
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0xc000`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000DEDE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xe000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x12000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`9c0232d7a8ba973ef55b323b5dc89273`
SHA1	`b74b2377269e5086086476930f627d40f1f8ff88`
SHA256	`2157fc33b2428b805ea92513221e5cd9e4d5727ce8abe05a3026182bd43bec95`
SHA3	`aee52e55bb8ab7a287c077a5a05be23efb5cc8dc9b62da9066b3720c19519a8e`
VirtualSize	`0xbee4`
VirtualAddress	`0x2000`
SizeOfRawData	`0xc000`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.64242`

.rsrc

MD5	`2534dcd678c1066bd436040bd76386ed`
SHA1	`00ebd2960976f28c955c34f2e5ca08c188b44565`
SHA256	`4b3157fadb21ebae44e497d2a77f49016b0c09d8ef0c420a7ffa7d67b5bb0e66`
SHA3	`dac85934ab0ccb3ef4bf4edf06e013a22de48355cd4e6c51b3c0141643478c79`
VirtualSize	`0x4de`
VirtualAddress	`0xe000`
SizeOfRawData	`0x600`
PointerToRawData	`0xc200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.74482`

.reloc

MD5	`1664431c133f1167d49f662df55ff644`
SHA1	`266a3d34f1134e8d613e11279ea51bd9b12f9290`
SHA256	`ef4117173f9914372f0a01e2d43a272412b4d8c38647c979a4d57b6cc969add8`
SHA3	`f80a857564088ccff3ae07d9f0c018c372e3e9033f6ecace73d345ffdb7b25d4`
VirtualSize	`0xc`
VirtualAddress	`0x10000`
SizeOfRawData	`0x200`
PointerToRawData	`0xc800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x254`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.20623`
MD5	`b7284a897d9ec38a0932e6ce0b88d078`
SHA1	`334b7d44d43411aabca07a160e83f79e12b80b58`
SHA256	`c504e54d5d0f258fb857c8f627be0d973fd60a6b2f41c492fb016d24f19fff0d`
SHA3	`968221608d14a3f663987f7aeb12d64c7d23f9613e3b8509982db168a1543eba`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription
FileVersion (#2)	1.0.0.0
InternalName	MasonClient.exe
LegalCopyright
OriginalFilename	MasonClient.exe
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.