d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Feb-08 22:10:28 |
| Comments | |
| CompanyName | |
| FileDescription | HMC 2.0 |
| FileVersion | 1.0.0.0 |
| InternalName | Hackus Mail Checker Reforged.exe |
| LegalCopyright | Copyright © 2022 |
| LegalTrademarks | |
| OriginalFilename | Hackus Mail Checker Reforged.exe |
| ProductName | Hackus Mail Checker |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 80.7805% of the executable. |
| Malicious | VirusTotal score: 55/67 (Scanned on 2026-03-20 09:16:25) |
ALYac:
Trojan.GenericKDZ.102657
APEX: Malicious AhnLab-V3: Trojan/Win.Agent.C5394037 Alibaba: Backdoor:MSIL/AsyncRAT.8236d361 Antiy-AVL: Trojan[Backdoor]/MSIL.AsyncRAT Arcabit: Trojan.Generic.D19101 Avira: HEUR/AGEN.1365975 BitDefender: Gen:Variant.Application.Jalapeno.131 Bkav: W32.AIDetectMalware.CS CAT-QuickHeal: Trojan.GenericFC.S30154362 CTX: exe.trojan.msil ClamAV: Win.Packed.Razy-9807129-0 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DrWeb: BackDoor.AsyncRATNET.1 ESET-NOD32: MSIL/AsyncRAT.A trojan Elastic: Windows.Generic.Threat Emsisoft: Trojan.GenericKDZ.102657 (B) F-Secure: Heuristic.HEUR/AGEN.1365975 Fortinet: MSIL/Agent.CTE!tr GData: MSIL.Trojan-Stealer.Keylogger.BA Google: Detected Gridinsoft: Trojan.Win32.Downloader.dd!ni Ikarus: Backdoor.Agent Jiangmin: Trojan.MSIL.aoink K7AntiVirus: Trojan ( 700000201 ) K7GW: Trojan ( 700000201 ) Kaspersky: HEUR:Trojan.MSIL.Agent.gen Kingsoft: MSIL.Backdoor.SheetRat.gen Lionic: Trojan.Win32.AsyncRAT.4!c Malwarebytes: AsyncRAT.Backdoor.Rat.DDS McAfeeD: Real Protect-LS!5237DCB1E6EC MicroWorld-eScan: Trojan.GenericKDZ.102657 Microsoft: Trojan:MSIL/AsyncRAT.S!MTB NANO-Antivirus: Trojan.Win32.AsyncRAT.leijnn Paloalto: generic.ml Panda: Trj/GdSda.A Rising: Backdoor.AsyncRAT!1.C678 (CLASSIC) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: W32/VenomRAT!5237DCB1E6EC Sophos: Troj/VenomRat-A Symantec: Backdoor.ASync Tencent: Trojan.MSIL.Agent.16000593 Trapmine: malicious.moderate.ml.score TrellixENS: GenericRXVS-NQ!5237DCB1E6EC TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z Varist: W32/Trojan.IML.gen!Eldorado ViRobot: Trojan.Win.Z.Asyncrat.381440 VirIT: Trojan.Win32.MSIL_Heur.B Webroot: Win.Trojan.Gen Zillya: Trojan.AsyncRAT.Win32.24521 ZoneAlarm: Troj/VenomRat-A alibabacloud: Rat:Win/AsyncRAT.Stub huorong: Backdoor/MSIL.DcRat.a |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2023-Feb-08 22:10:28 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x11600 |
| SizeOfInitializedData | 0x4ba00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001346E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x14000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x62000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
7
8
9
1 (#2)
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | HMC 2.0 |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | Hackus Mail Checker Reforged.exe |
| LegalCopyright | Copyright © 2022 |
| LegalTrademarks | |
| OriginalFilename | Hackus Mail Checker Reforged.exe |
| ProductName | Hackus Mail Checker |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.