c40dba0c413dae86b03349288b50d55ce7e40c402d85355cb6d428de66dc30f6
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Nov-26 07:17:19 |
| Comments | |
| CompanyName | CORE |
| FileDescription | Hulubulu Advanced Renamer 4.x |
| FileVersion | 1.0.0.0 |
| InternalName | cr-keygen.exe |
| LegalCopyright | Copyright © CORE 2025 |
| LegalTrademarks | |
| OriginalFilename | cr-keygen.exe |
| ProductName | Hulubulu Advanced Renamer 4.x |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Suspicious |
Unusual section name found: .core0
Unusual section name found: .core1 |
|
| Malicious | VirusTotal score: 47/69 (Scanned on 2026-09-13 16:15:20) |
ALYac:
IL:Trojan.MSILZilla.237787
APEX: Malicious AVG: Win32:MalwareX-gen [Misc] AhnLab-V3: Malware/Win.Generic.C4555221 Alibaba: Packed:Win32/VMProtect.3b505f98 Arcabit: IL:Trojan.MSILZilla.D3A0DB Avast: Win32:MalwareX-gen [Misc] Avira: TR/W32.Agent BitDefender: IL:Trojan.MSILZilla.237787 Bkav: W32.Malware.A19F1CAF CAT-QuickHeal: Trojan.Kepavll CTX: exe.trojan.vmprotect CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: Win32/Packed.VMProtect.ACR trojan Elastic: malicious (high confidence) Emsisoft: IL:Trojan.MSILZilla.237787 (B) F-Secure: Trojan.TR/W32.Agent Fortinet: MSIL/GenKryptik.FNHG!tr GData: IL:Trojan.MSILZilla.237787 Google: Detected Gridinsoft: Trojan.Heur!.022130A1 K7AntiVirus: Trojan ( 700000201 ) K7GW: Trojan ( 700000201 ) Lionic: Trojan.Win32.VMProtect.4!c Malwarebytes: Malware.AI.4111986637 MaxSecure: Trojan.Malware.613475989.susgen MicroWorld-eScan: IL:Trojan.MSILZilla.237787 Microsoft: Trojan:Win32/Kepavll!rfn Paloalto: generic.ml Panda: Trj/GdSda.A Rising: Malware.Obfus/MSIL@AI.95 (RDM.MSIL2:KaMIEDtwzTvuQ9/7iAgtww) Sangfor: Virus.Win32.Save.a SentinelOne: Static AI - Malicious PE Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence TrellixENS: Artemis!836035B2074C TrendMicro: TROJ_FRS.VSNTBE26 TrendMicro-HouseCall: TROJ_FRS.VSNTBE26 VBA32: TScope.Trojan.MSIL VIPRE: IL:Trojan.MSILZilla.237787 Varist: W32/MSIL_Kryptik.ALN.gen!Eldorado VirIT: Trojan.Win32.MSIL_Heur.D Yandex: Trojan.VMProtect!1CKbecfCMIU Zillya: Trojan.VMProtect.Win32.134041 alibabacloud: VirTool:Win/Packed.VMProtect.AWY |
Hashes
| MD5 | 836035b2074c80a4a90cb3fd78d9268d 🔍 |
|---|---|
| SHA1 | 7abc9db2a0c229008080e1972b97bc2b50df7958 🔍 |
| SHA256 | c40dba0c413dae86b03349288b50d55ce7e40c402d85355cb6d428de66dc30f6 🔍 |
| SHA3 | 219d63254dbb5c831bbefd0afbfa106a58d66104869b724ce574b106b9f27788 🔍 |
| SSDeep | 12288:pwZqw1JGpNC8J5qHtVmNGCKc6nhf+zBzLxZFT:pwZmNC8J5rJKc6nhf+ 🔍 |
| Imports Hash | f34d5f2d4577ed6d9ceec516c1f5a744 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2025-Nov-26 07:17:19 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x1e400 |
| SizeOfInitializedData | 0x1200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0008B687 (Section: .core1) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x22000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xbc000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x1e374 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.core0
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x2bc66 |
| VirtualAddress | 0x22000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.core1
| MD5 | aba4f9150724b9c2a0facf8596ab88f3 🔍 |
|---|---|
| SHA1 | f3c578d11ce7b2177ed3d687a0dcd1032094b17b 🔍 |
| SHA256 | 3006a7c62a7565a028b1aff4a7b74245516dd865712abe6cbcdcac6021895b89 🔍 |
| SHA3 | de119e2b69fdf209b0e86b5836035970b96674973acd1c99e5392ad23f98843c 🔍 |
| VirtualSize | 0x69240 |
| VirtualAddress | 0x4e000 |
| SizeOfRawData | 0x69400 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 7.47437 |
.rsrc
| MD5 | 9f88d6bcf2154c87331c30e732992051 🔍 |
|---|---|
| SHA1 | fb28b20fb08f65ec2de09e9d353dbf76d8cd1f7e 🔍 |
| SHA256 | 3773eb7a453ea08174516dca6dd469df76e387de42a86b3f5344056c1d5159c9 🔍 |
| SHA3 | e83d737b5823f6b5830735097b014543c31f7f8b80ffdb41364b28c61cd727a5 🔍 |
| VirtualSize | 0xf52 |
| VirtualAddress | 0xb8000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x69800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.56375 |
.reloc
| MD5 | 9f120e37aba98c1254c2f6370b4cd4a0 🔍 |
|---|---|
| SHA1 | c1e3175f320cd2628dfba13337d4fb6bfd92b6e0 🔍 |
| SHA256 | 9d27da9247f241898cb95107035e6dc672e71f050d642f22caba6de6cb51c6c9 🔍 |
| SHA3 | 89728e0331c41d3c733bd22ee49e44e591269ea2001679a811c35c1a93d787ba 🔍 |
| VirtualSize | 0xc |
| VirtualAddress | 0xba000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x6a800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 0.122276 |
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x8a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.55843 |
| MD5 | 0600371f88a037636ff00097cc5a68f6 🔍 |
| SHA1 | 4228cbe58b1b06b24e4606b514c0873ae849b345 🔍 |
| SHA256 | c4e545fd23ada24e71e7db4a0031338957fb2efefc9a89d29dcae047678b7643 🔍 |
| SHA3 | 6f886c7439dedd6dd773f4d7cf8dda1169bf93131185951289e3290c5e75ca38 🔍 |
32512
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.91924 |
| Detected Filetype | Icon file |
| MD5 | 1549770227648af64211c945b3821675 🔍 |
| SHA1 | 01182707fcdbeeb9fd165b58be758dc5965533d1 🔍 |
| SHA256 | d668bdb6c221c4f8695118e7c6398fdd5dbc7efc9d33e98a47af6514170cdcaf 🔍 |
| SHA3 | 87bff2ed1a62f1cfdd3449c7fb6bce0950a6ccaf786ed52cca4410946ae157ae 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x37c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.36788 |
| MD5 | d21fedc05339a2c2acca5e0c909e7564 🔍 |
| SHA1 | dc73cacf9df4dfccb838170d0a5012edf94bda57 🔍 |
| SHA256 | 99b4ca0235f712483661e9b00a1de786dd6311e53f5b3545217701129a262601 🔍 |
| SHA3 | c5e1e26bb8f5542e40cf482006a810bd5e9dc9e2f4bc021675ffe2e2042aa9b1 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x1ea |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.00112 |
| MD5 | b7db84991f23a680df8e95af8946f9c9 🔍 |
| SHA1 | cac699787884fb993ced8d7dc47b7c522c7bc734 🔍 |
| SHA256 | 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍 |
| SHA3 | 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | CORE |
| FileDescription | Hulubulu Advanced Renamer 4.x |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | cr-keygen.exe |
| LegalCopyright | Copyright © CORE 2025 |
| LegalTrademarks | |
| OriginalFilename | cr-keygen.exe |
| ProductName | Hulubulu Advanced Renamer 4.x |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .core0 has a size of 0!
Leave a comment
No comments yet.