Manalyze report for aa823a279a54bf15f82b2f1dadd9f75c8dc9b3a088b289f21c5769bef199fa08

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2097-Nov-02 09:11:22
Debug artifacts	C:\Users\sammi\AppData\Local\Temp\TempClient\obj\Release\net48\Client.pdb
CompanyName	Client
FileDescription	Client
FileVersion	`1.0.0.0`
InternalName	Client.exe
LegalCopyright
OriginalFilename	Client.exe
ProductName	Client
ProductVersion	`1.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to security software: rshell.exe`
Malicious	VirusTotal score: 48/71 (Scanned on 2026-02-11 07:29:48)	`ALYac: Generic.UAC.Marte.B.2470B747` `AVG: Win32:MalwareX-gen [Expl]` `AhnLab-V3: Malware/Win.Generic.C5704440` `Alibaba: Trojan:MSIL/Marte.b64c6bdd` `Antiy-AVL: Trojan[Exploit]/MSIL.BypassUAC` `Arcabit: Generic.UAC.Marte.B.2470B747` `Avast: Win32:MalwareX-gen [Expl]` `Avira: EXP/BypassUAC.kdvjf` `BitDefender: Generic.UAC.Marte.B.2470B747` `Bkav: W32.AIDetectMalware.CS` `CAT-QuickHeal: Trojan.Ghanarava.173390569202a50a` `CTX: exe.trojan.bypassuac` `CrowdStrike: win/malicious_confidence_70% (W)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `ESET-NOD32: MSIL/Tiny.HT trojan` `Elastic: malicious (high confidence)` `Emsisoft: Generic.UAC.Marte.B.2470B747 (B)` `F-Secure: Exploit.EXP/BypassUAC.kdvjf` `Fortinet: PossibleThreat` `GData: Generic.UAC.Marte.B.2470B747` `Google: Detected` `Ikarus: Trojan.Agent` `K7AntiVirus: Trojan ( 700000201 )` `K7GW: Trojan ( 700000201 )` `Kaspersky: HEUR:Exploit.Win32.BypassUAC.a` `Kingsoft: MSIL.Exploit.BypassUAC.c` `Lionic: Trojan.Win32.Marte.3!c` `Malwarebytes: Generic.Malware/Suspicious` `MaxSecure: Trojan.Malware.192116422.susgen` `McAfeeD: ti!AA823A279A54` `MicroWorld-eScan: Generic.UAC.Marte.B.2470B747` `Microsoft: Trojan:MSIL/Marte!MTB` `NANO-Antivirus: Exploit.Win32.BypassUAC.ktzdno` `Paloalto: generic.ml` `Panda: Trj/Chgt.AD` `Rising: Exploit.BypassUAC!8.87F5 (TFE:C:gDTUifXVoTN)` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Suspicious PE` `Sophos: Generic Reputation PUA (PUA)` `Symantec: Downloader` `Tencent: Malware.Win32.Gencirc.1424dc93` `TrellixENS: Artemis!74AAB49593EF` `VIPRE: Generic.UAC.Marte.B.2470B747` `Varist: W32/ABApplication.RHGB-7976` `Webroot: W32.Dropper.Gen` `Zillya: Trojan.Tiny.Win32.24809` `alibabacloud: Exploit:MSIL/BypassUAC.c`

Hashes

MD5	`74aab49593ef9bec523e6b3d1f02a50a` 🔍
SHA1	`fdec40b1fbfce72ed800ce4deca8d38207f6cf74` 🔍
SHA256	`aa823a279a54bf15f82b2f1dadd9f75c8dc9b3a088b289f21c5769bef199fa08` 🔍
SHA3	`e16a44180ff370934979e8274a4686572229218bce5d1209f7be1d468f925569` 🔍
SSDeep	`192:peMtWZmom6Wa7fiaWOU3KqljtlwgrJUHuDDJNgJ9:peXZmo/r7fVhkKxvuD1NgJ` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2097-Nov-02 09:11:22
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x1c00`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00003AD6 (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`b3d2bbc16d2cac8ffaf108908fa2413a 🔍`
SHA1	`f0f7bed933c70883d293f4ede445f889b6775c0b 🔍`
SHA256	`31633c06d94b2c7c3f9ee17009318e06710fce043c72bba862cda4a73e7c5780 🔍`
SHA3	`6adb0a524972535391b0b7897024b102f29bde0a8a611b1068c2222d5a07fea8 🔍`
VirtualSize	`0x1adc`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1c00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.19114`

.rsrc

MD5	`c37872a760934090d6660060e78613fb 🔍`
SHA1	`ce2e4ab3947b3526218a54e268ddf74ec0140427 🔍`
SHA256	`d578710c9ed9a4acac8ba2db6ce402dcba638d38644907ac74ba61385d6d897d 🔍`
SHA3	`183531301916ba8580967f6b6fa85923a202cfcf84079d0124fccb81fe0e1bd4 🔍`
VirtualSize	`0x53c`
VirtualAddress	`0x4000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.86427`

.reloc

MD5	`3a31d4c06870b57eda1d3945d8dc60ad 🔍`
SHA1	`b0073d75a508d1745f866341e6dfa15f6bee9df7 🔍`
SHA256	`3feb037c74c879fbcc8eee64cc72ed870d7877acddecd3defbeb2560c1bd0df0 🔍`
SHA3	`fbe435f12a359a0a571379aee19af6321f4dcaa86cf80828ae3c9ae73783de35 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2ac`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.1653`
MD5	`896493aca7a03d51ce09d0cf5108d434 🔍`
SHA1	`f795c3d83ec47232bcd09555854e53de930432b1 🔍`
SHA256	`6e3f3de223c5663810c8e69fe04e917c0315fa6148e8d1c45b5832b906decae5 🔍`
SHA3	`ac625ed5d6660b902b417011f4c69c9a33ac31d00b16b6f97b4218ec1ddcfabe 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9 🔍`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734 🔍`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
CompanyName	Client
FileDescription	Client
FileVersion (#2)	1.0.0.0
InternalName	Client.exe
LegalCopyright
OriginalFilename	Client.exe
ProductName	Client
ProductVersion (#2)	1.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2045-Nov-10 19:25:54
Version	`256.20557`
SizeofData	`98`
AddressOfRawData	`0x39f8`
PointerToRawData	`0x1bf8`
Referenced File	C:\Users\sammi\AppData\Local\Temp\TempClient\obj\Release\net48\Client.pdb

UNKNOWN

Characteristics	`0`
TimeDateStamp	1970-Jan-01 00:00:00
Version	`1.0`
SizeofData	`39`
AddressOfRawData	`0x3a5a`
PointerToRawData	`0x1c5a`

UNKNOWN (#2)

Characteristics	`0`
TimeDateStamp	1970-Jan-01 00:00:00
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.