fc6fb6ad71beb6a89b3a21f1779e56c8ccd5de15380cf2be0e9e28d97a7327c3
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2082-Apr-05 20:07:17 |
| Debug artifacts |
c:\work\cryptor_alf\real_exe\E1\obj\Release\teerthewr.pdb
|
| Comments | |
| CompanyName | |
| FileDescription | j34ytje |
| FileVersion | 1.0.0.0 |
| InternalName | teerthewr.exe |
| LegalCopyright | Copyright © 2025 |
| LegalTrademarks | |
| OriginalFilename | teerthewr.exe |
| ProductName | j34ytje |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for VMWare presence:
|
| Malicious | The PE's digital signature is invalid. |
Signer: Ashampoo GmbH & Co. KG
Issuer: VeriSign Class 3 Code Signing 2010 CA The file was modified after it was signed. |
| Malicious | VirusTotal score: 25/71 (Scanned on 2026-06-04 20:11:32) |
AVG:
Win32:MalwareX-gen [Cryp]
Arcabit: Trojan.Zusy.D94B3F Avast: Win32:MalwareX-gen [Cryp] Avira: TR/Dropper.MSIL.Gen BitDefender: Gen:Variant.Zusy.609087 Bkav: W32.Malware.B095E10F CTX: exe.unknown.zusy Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: MSIL/Kryptik.AQIM trojan Elastic: malicious (moderate confidence) Emsisoft: Gen:Variant.Zusy.609087 (B) F-Secure: Trojan.TR/Dropper.MSIL.Gen Fortinet: MSIL/Kryptik.AOSV!tr GData: Gen:Variant.Zusy.609087 Google: Detected Kaspersky: VHO:Exploit.MSIL.ChecksumController.gen McAfeeD: Trojan:Win/Msilstealers.FYF MicroWorld-eScan: Gen:Variant.Zusy.609087 Microsoft: Trojan:MSIL/PureLogs.BAI!MTB Symantec: ML.Attribute.HighConfidence TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA3 Varist: W32/MSIL_Kryptik.NCZ.gen!Eldorado Webroot: Win.Hacktool.Dcrat huorong: Trojan/MSIL.Obfuscated.jo |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2082-Apr-05 20:07:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x32000 |
| SizeOfInitializedData | 0x11000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00033EEE (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x34000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x48000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0x49a90 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
32512
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | j34ytje |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | teerthewr.exe |
| LegalCopyright | Copyright © 2025 |
| LegalTrademarks | |
| OriginalFilename | teerthewr.exe |
| ProductName | j34ytje |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2079-May-13 04:01:47 |
| Version | 0.0 |
| SizeofData | 82 |
| AddressOfRawData | 0x33e48 |
| PointerToRawData | 0x32048 |
| Referenced File | c:\work\cryptor_alf\real_exe\E1\obj\Release\teerthewr.pdb |
UNKNOWN
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.