Manalyze report for ede8d55bec5946bb4f9b60a2495ff485849506eb6bdc5a0e1791922973b3e565

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Mar-03 16:14:01
FileDescription	setup
FileVersion	`3.3.0.0`
InternalName	Roshade2.0.Setup.exe
LegalCopyright
OriginalFilename	Roshade2.0.Setup.exe
ProductName	setup
ProductVersion	`3.3.0.0`
Assembly Version	3.3.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: %Temp%`
Malicious	VirusTotal score: 43/71 (Scanned on 2026-03-06 22:03:19)	`ALYac: Gen:Variant.MSIL.Packy.1` `APEX: Malicious` `AVG: Win32:MalwareX-gen [Cryp]` `AhnLab-V3: Trojan/Win.Generic.C5052738` `Arcabit: Trojan.MSIL.Packy.1` `Avast: Win32:MalwareX-gen [Cryp]` `Avira: TR/Dropper.Gen` `BitDefender: Gen:Variant.MSIL.Packy.1` `Bkav: W32.AIDetectMalware.CS` `CTX: exe.unknown.msil` `CrowdStrike: win/malicious_confidence_100% (D)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `DrWeb: Trojan.MulDrop21.55508` `ESET-NOD32: MSIL/TrojanDropper.Agent.FOV trojan` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Variant.MSIL.Packy.1 (B)` `F-Secure: Trojan.TR/Dropper.Gen` `GData: Gen:Variant.MSIL.Packy.1` `Google: Detected` `Ikarus: Trojan.MSIL.Injector` `K7AntiVirus: Trojan ( 700000201 )` `K7GW: Trojan ( 700000201 )` `Kaspersky: Trojan-PSW.Win64.Salat.ihv` `Malwarebytes: Trojan.Dropper.MSIL.Generic` `MaxSecure: Trojan.Malware.300983.susgen` `McAfeeD: Real Protect-LS!B487409E3B9E` `MicroWorld-eScan: Gen:Variant.MSIL.Packy.1` `Microsoft: Trojan:MSIL/XWormRAT.A!MTB` `NANO-Antivirus: Trojan.Win32.Dropper.lejrxi` `Rising: Malware.Obfus/MSIL@AI.89 (RDM.MSIL2:Pp6GB2p/suttD9y8ncCwCw)` `Sangfor: Trojan.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: Trojan-JARL!B487409E3B9E` `Sophos: Troj/Mdrop-JVT` `Symantec: ML.Attribute.HighConfidence` `Tencent: Worm.Msil.Xworm.16001276` `TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z` `VIPRE: Gen:Variant.MSIL.Packy.1` `Varist: W32/MSIL_Agent.BUD.gen!Eldorado` `VirIT: Trojan.Win32.MSIL_Heur.A` `ZoneAlarm: Troj/Mdrop-JVT` `huorong: TrojanDropper/MSIL.Agent.gx`

Hashes

MD5	`b487409e3b9efb83d5fe58c71c6ccb81`
SHA1	`de4699a19e40af8d2b052c2ec2c6e4d0974496c7`
SHA256	`ede8d55bec5946bb4f9b60a2495ff485849506eb6bdc5a0e1791922973b3e565`
SHA3	`df92e2b857ebcfa3dfc74b727c6e9a89555cf2f32443cd9d6b225342b26847db`
SSDeep	`98304:SRwwHtyk9ObS2l0YsvDi1oyHynRaIYxwCvAiroA:u9pi+rvO7Sno/xwCaA`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Mar-03 16:14:01
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`11.0`
SizeOfCode	`0x35a400`
SizeOfInitializedData	`0x1600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0035C37E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x35e000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x362000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`2e5cf4f0a80147dded071479c269e2ef`
SHA1	`44993bf73bd0c60f5810f3fb3bff4ea48063880e`
SHA256	`da455203e89bb9b75928eeca5a67f255a24d104e449f848ebc74481cc7ed61b9`
SHA3	`39cdaf801252d5c6fd6333f19a48652dd7102803091b6c906a0fa4a020cb42ea`
VirtualSize	`0x35a384`
VirtualAddress	`0x2000`
SizeOfRawData	`0x35a400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99987`

.rsrc

MD5	`c81867b86658dbeb172ee43847c61a21`
SHA1	`2fa1c273cc45427c438200234b43cebb0c4262a8`
SHA256	`ecc27b546f03676e4939da8d6431d668998328ac0a96d6653f4b67fbc94790fc`
SHA3	`025b73e0946516f13aea004991cedb3297c78f5d205a8b18859d185f6c127753`
VirtualSize	`0x13f8`
VirtualAddress	`0x35e000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x35a600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.9915`

.reloc

MD5	`de492c8855d795fa1be08492c94f12cc`
SHA1	`27f8f4e1981fafa74576eb64cba0863a78ada631`
SHA256	`a498ebb6581f0f974bc9405124ac6f647cb88640e71739f0064e0a2ec4558064`
SHA3	`fe8759ad8b49f09181fde7b861854b7515cbadff38cd328621db5e75740bee7c`
VirtualSize	`0xc`
VirtualAddress	`0x360000`
SizeOfRawData	`0x200`
PointerToRawData	`0x35ba00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xe28`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.64214`
MD5	`4b218a5f8f4ab5743bfe59f4aed5b66e`
SHA1	`41f19b2b1071b3d0e200713282171bd4bb3fb14a`
SHA256	`ba3694287a84a642b92e14748f085133de3b6faa3dddb07e234ca2acc78c7bac`
SHA3	`5ab35232955184830318b520784036013dd15019ce692fff2bd2910ded27ae86`

1 (#2)

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.6789`
Detected Filetype	Icon file
MD5	`9ab666f4a7e317d1b99d31a6245f2d29`
SHA1	`b4a78b2ed3434a0c32505a9b97ea2f435a07eee9`
SHA256	`6b117306a47ad300c88f638c641996c8ea0e438a24fa3badd4363544412b86fc`
SHA3	`e5c8a11de7a81e8775ca02af45c03bdc386e38c2d3ed6c405c7140e4b3ccd5b8`

1 (#3)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2a0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.26939`
MD5	`aa49fc8b041ac7e5b0630ae64eb3b4ef`
SHA1	`ea383b5178e684948c9e0b4cefdeb0d4cc584438`
SHA256	`ba0dda7519001b77822141632cc6fe96e5c64b083886ac10f1f7c1ece27ce27c`
SHA3	`30a824b6431c99bf0cf9b535b131976925882cd4e3c7263f0e0fe2373e613932`

1 (#4)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`a19a2658ba69030c6ac9d11fd7d7e3c1`
SHA1	`879dcf690e5bf1941b27cf13c8bcf72f8356c650`
SHA256	`c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f`
SHA3	`93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	3.3.0.0
ProductVersion	3.3.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription	setup
FileVersion (#2)	3.3.0.0
InternalName	Roshade2.0.Setup.exe
LegalCopyright
OriginalFilename	Roshade2.0.Setup.exe
ProductName	setup
ProductVersion (#2)	3.3.0.0
Assembly Version	3.3.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.