f381e338212079c3a03fbbb532cdec44b1d27db03e8cc4c47408ef038885d934
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2022-May-10 07:48:18 |
| Comments | |
| CompanyName | BASeCamp Software Solutions |
| FileDescription | JobClock Administration Applet |
| FileVersion | 1.4.8.0 |
| InternalName | EncoderFallbackExcept.exe |
| LegalCopyright | Copyright © 2011 BASeCamp Software Solutions |
| LegalTrademarks | |
| OriginalFilename | EncoderFallbackExcept.exe |
| ProductName | BASeCamp JobClock |
| ProductVersion | 1.4.8.0 |
| Assembly Version | 1.4.8.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ 8.0 .NET executable -> Microsoft |
| Malicious | VirusTotal score: 61/72 (Scanned on 2025-06-02 11:03:11) |
ALYac:
Trojan.Ransom.Loki.DBZ
AVG: Win32:MalwareX-gen [Pws] AhnLab-V3: Trojan/Win.Infostealer.R491212 Alibaba: Trojan:MSIL/Tnega.1403fd51 Antiy-AVL: GrayWare/MSIL.Kryptik.enu Arcabit: Trojan.Ransom.Loki.DBZ Avast: Win32:MalwareX-gen [Pws] Avira: TR/AD.SnakeStealer.mpbph BitDefender: Trojan.Ransom.Loki.DBZ Bkav: W32.AIDetectMalware.CS CAT-QuickHeal: Trojan.YakbeexMSIL.ZZ4 CTX: exe.trojan.msil ClamAV: Win.Dropper.LokiBot-10026309-0 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.PackedNET.331 ESET-NOD32: MSIL/Spy.Agent.AES Elastic: malicious (high confidence) Emsisoft: Trojan.Ransom.Loki.DBZ (B) F-Secure: Trojan.TR/AD.SnakeStealer.mpbph Fortinet: MSIL/Kryptik.AEZD!tr GData: MSIL.Trojan-Spy.Snake.XMTIRX Google: Detected Ikarus: Trojan.MSIL.Crypt Jiangmin: Trojan.MSIL.amrha K7AntiVirus: Trojan ( 00592bc01 ) K7GW: Trojan ( 00592bc01 ) Kaspersky: HEUR:Trojan.MSIL.Taskun.gen Lionic: Trojan.Win32.Loki.4!c Malwarebytes: Neshta.Virus.FileInfector.DDS MaxSecure: Trojan.Malware.74644571.susgen McAfeeD: ti!F381E3382120 MicroWorld-eScan: Trojan.Ransom.Loki.DBZ Microsoft: Trojan:MSIL/Tnega.ST!MTB NANO-Antivirus: Trojan.Win32.Taskun.jsflgf Paloalto: generic.ml Panda: Trj/WLT.G Rising: Backdoor.Androm!8.113 (KTSE) SUPERAntiSpyware: Trojan.Agent/GenericKDZ Sangfor: Spyware.Msil.Tnega.Vtrm SentinelOne: Static AI - Malicious PE Skyhigh: GenericRXSW-EH!411019BCB582 Sophos: Troj/Krypt-LX Symantec: Trojan.Gen.MBT Tencent: Malware.Win32.Gencirc.13b6022a Trapmine: malicious.moderate.ml.score TrellixENS: GenericRXSW-EH!411019BCB582 TrendMicro: TrojanSpy.MSIL.SNAKELOGGER.JPQ TrendMicro-HouseCall: TrojanSpy.MSIL.SNAKELOGGER.JPQ VBA32: TScope.Trojan.MSIL VIPRE: Trojan.Ransom.Loki.DBZ Varist: W32/MSIL_Kryptik.HFI.gen!Eldorado VirIT: Trojan.Win32.MSIL.BUO Webroot: W32.Trojan.Gen Xcitium: Malware@#1m1caykgusd8e Zillya: Trojan.Agent.Win32.2800454 ZoneAlarm: Troj/Krypt-LX Zoner: Trojan.Win32.135735 alibabacloud: Trojan[stealer]:MSIL/AgentTesla.NCH2XJC huorong: HEUR:VirTool/MSIL.Obfuscator.gen!A |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2022-May-10 07:48:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0xf4e00 |
| SizeOfInitializedData | 0x15a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000F6CCE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0xf8000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x110000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
32512
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.4.8.0 |
| ProductVersion | 1.4.8.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | BASeCamp Software Solutions |
| FileDescription | JobClock Administration Applet |
| FileVersion (#2) | 1.4.8.0 |
| InternalName | EncoderFallbackExcept.exe |
| LegalCopyright | Copyright © 2011 BASeCamp Software Solutions |
| LegalTrademarks | |
| OriginalFilename | EncoderFallbackExcept.exe |
| ProductName | BASeCamp JobClock |
| ProductVersion (#2) | 1.4.8.0 |
| Assembly Version | 1.4.8.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.