Manalyze report for b356a3ce179ca9c459c833cf5201b72ddac11ff313591f737fbc3e43b18fd664

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2023-Jun-09 11:11:49
FileDescription
FileVersion	`0.0.0.0`
InternalName	Borra_perfiles_EXCEPCIONES.exe
LegalCopyright
OriginalFilename	Borra_perfiles_EXCEPCIONES.exe
ProductVersion	`0.0.0.0`
Assembly Version	0.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Malicious	VirusTotal score: 15/72 (Scanned on 2025-04-10 19:56:31)	`APEX: Malicious` `Antiy-AVL: Trojan/PowerShell.Agent` `Bkav: W32.AIDetectMalware.CS` `DeepInstinct: MALICIOUS` `Elastic: malicious (high confidence)` `Fortinet: PossibleThreat` `Google: Detected` `K7GW: Trojan ( aaa0070a1 )` `Malwarebytes: Malware.AI.2499627779` `MaxSecure: Trojan.Malware.300983.susgen` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Trapmine: malicious.high.ml.score` `Varist: W32/Trojan.GPA.gen!Eldorado` `VirIT: Trojan.Win32.MSIL_Heur.A`

Hashes

MD5	`351ce5eff280d7e0a07b8e9c2cc7871a` 🔍
SHA1	`cfdd4e88bf9b7d4c5f0076c299c13c30866cb3e5` 🔍
SHA256	`b356a3ce179ca9c459c833cf5201b72ddac11ff313591f737fbc3e43b18fd664` 🔍
SHA3	`9eb30a555c7a650f566a779e37ea46811e3b1787dc38d3df35af5f0ed9645011` 🔍
SSDeep	`768:uEHXdkQIsnorTBXAM41v1CbpCMZm71cEGgm3Ht1:uEHXTnorTBE2MOX3H` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2023-Jun-09 11:11:49
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x5e00`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00007CBE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x8000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0xc000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`fe21bdbd76b7b878eaf151244cb88cf4 🔍`
SHA1	`ef5ef6cf071272509c76af07cb47428bbf0fa99f 🔍`
SHA256	`7fb05144031c0e8ca25964ade494270fafb632392fdca29edf179724c49bf34d 🔍`
SHA3	`55a065dc16dfc4b486141ec8aefc1f01224668ef802776b4e680eba73d011bf0 🔍`
VirtualSize	`0x5cc4`
VirtualAddress	`0x2000`
SizeOfRawData	`0x5e00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.73113`

.rsrc

MD5	`44a2227ea72a54099141fb3dcf7b1e06 🔍`
SHA1	`d8a8e0175120d20c280fb7643d1fea3bdd534a06 🔍`
SHA256	`7b356c696bc89cdb2bed480037ea7fd9f317f1c61c6636e6ea0ed69288ef17a7 🔍`
SHA3	`c07beccedf9268b266805d0db4edd9b36ae4df3b520beee005fa7ea04c0e339d 🔍`
VirtualSize	`0x4d0`
VirtualAddress	`0x8000`
SizeOfRawData	`0x600`
PointerToRawData	`0x6000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.57329`

.reloc

MD5	`2867ff18d1975d5cb9ac8bd8fb98f90c 🔍`
SHA1	`71feb97b8436ba77498dd733ade893840c8473a4 🔍`
SHA256	`c9d26310ad04f99664a04310af584e4caf434b35ca5e2d08ccd1de88c0ddd5ab 🔍`
SHA3	`b54d92b9fcdbfe145df43c80650e61d379cc7e0124bd1266d64fc224e65284c9 🔍`
VirtualSize	`0xc`
VirtualAddress	`0xa000`
SizeOfRawData	`0x200`
PointerToRawData	`0x6600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x294`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.2407`
MD5	`98e1db37413625c1005b796dcfaf266f 🔍`
SHA1	`21b7d38d1dc9eb03e98556d66d13af062bb7e535 🔍`
SHA256	`f4b650d7f985e8c4fb4ca822a027a1fa26c63add67c0720383f2078dc893b3ef 🔍`
SHA3	`1d025a66f4e4046c1be66f1555c1bfea986484264e096111427d7e8fdb801e60 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x193`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.9886`
MD5	`19d70dfcdeb812833de7ba67472845d5 🔍`
SHA1	`e8f6ebb0080572042c7cf97a8a3911e1aec364ad 🔍`
SHA256	`6a6690c7e7400672941c6ed0cdde6f5119e5bf49956706bea9d4a442b1213d7d 🔍`
SHA3	`2f85c1eb489631f2bf6527b77f95783569bcc288c4d1fbcdd6cb2ee7e7c68ab4 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription
FileVersion (#2)	0.0.0.0
InternalName	Borra_perfiles_EXCEPCIONES.exe
LegalCopyright
OriginalFilename	Borra_perfiles_EXCEPCIONES.exe
ProductVersion (#2)	0.0.0.0
Assembly Version	0.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.