Manalyze report for fd245f758530291fafaafe8b61da040ecbfa7d555f2e3cc26ca4eb7bd5eddb76

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Apr-13 17:57:43
Comments
CompanyName
FileDescription
FileVersion	`1.0.0.0`
InternalName	Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Stub.exe
ProductName
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: schtask` `Looks for VMWare presence: vmware` `Looks for Sandboxie presence: SbieDll.dll` `Accesses the WMI: root\Security`
Malicious	VirusTotal score: 54/71 (Scanned on 2026-10-08 08:39:14)	`ALYac: Generic.AsyncRAT.Marte.B.89B0C1FE` `APEX: Malicious` `AVG: MSIL:AsyncRat-E [Pws]` `AhnLab-V3: Malware/Win32.RL_Generic.C4267562` `Antiy-AVL: Trojan[Backdoor]/MSIL.Crysan` `Arcabit: Generic.AsyncRAT.Marte.B.89B0C1FE` `Avast: MSIL:AsyncRat-E [Pws]` `Avira: TR/Dropper.Gen` `BitDefender: Generic.AsyncRAT.Marte.B.89B0C1FE` `Bkav: W32.Malware.9F46ECE5` `CAT-QuickHeal: Trojan.IgenericFC.S14890850` `CTX: exe.unknown.asyncrat` `ClamAV: Win.Packed.Razy-9625918-0` `CrowdStrike: win/malicious_confidence_100% (D)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `DrWeb: BackDoor.AsyncRATNET.2` `ESET-NOD32: MSIL/AsyncRAT.A trojan` `Elastic: Windows.Generic.Threat` `Emsisoft: Generic.AsyncRAT.Marte.B.89B0C1FE (B)` `F-Secure: Trojan.TR/Dropper.Gen` `Fortinet: MSIL/AsyncRAT.A!tr` `GData: MSIL.Backdoor.DCRat.D` `Google: Detected` `Ikarus: Trojan.MSIL.AsyncRAT` `K7AntiVirus: Trojan ( 005c228f1 )` `K7GW: Trojan ( 005c228f1 )` `Kaspersky: HEUR:Backdoor.MSIL.Crysan.gen` `Kingsoft: malware.kb.c.1000` `Malwarebytes: Backdoor.AsyncRAT` `MaxSecure: Trojan.Malware.300983.susgen` `McAfeeD: ti!FD245F758530` `MicroWorld-eScan: Generic.AsyncRAT.Marte.B.89B0C1FE` `Microsoft: Backdoor:MSIL/AsyncRat!atmn` `NANO-Antivirus: Trojan.Win32.AsyncRAT.lhhviy` `Rising: Trojan.AntiVM!1.CF63 (CLASSIC)` `SUPERAntiSpyware: Trojan.Agent/Gen-Dropper` `Sangfor: Suspicious.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: Fareit-FZT!49FCA5E0B67F` `Sophos: Troj/AsyncRat-B` `Symantec: Backdoor.ASync!g2` `Tencent: Backdoor.Msil.Dcrat.16001608` `TrellixENS: Fareit-FZT!49FCA5E0B67F` `TrendMicro: Backdoor.MSIL.ASYNCRAT.SMXSR` `TrendMicro-HouseCall: Backdoor.MSIL.ASYNCRAT.SMXSR` `VBA32: OScope.Backdoor.MSIL.Crysan` `VIPRE: Generic.AsyncRAT.Marte.B.89B0C1FE` `Varist: W32/Samas.B.gen!Eldorado` `VirIT: Trojan.Win32.MSIL_Heur.A` `Webroot: W32.Trojan.Gen` `Zillya: Trojan.Agent.Win32.3247127` `ZoneAlarm: Troj/AsyncRat-B` `huorong: Backdoor/MSIL.DcRat.a`

Hashes

MD5	`49fca5e0b67f0445d8113356abb00c8d` 🔍
SHA1	`f87e44d1ff75b1e8cedbfbb838de8e225f83d1de` 🔍
SHA256	`fd245f758530291fafaafe8b61da040ecbfa7d555f2e3cc26ca4eb7bd5eddb76` 🔍
SHA3	`2d4df22749cbf9d8a5a9f90839affa426e311d61a74146f2e33016a7a1e61c2c` 🔍
SSDeep	`768:TaUhjLQCOAxvEwXRGmx8SFHE4yvIJ2b1PsJIjbwg47F1ZwFEsArVmM5bJf+:TaUhjxL+UlyAJ21sKb34h1+uNAM5bJf` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2026-Apr-13 17:57:43
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`8.0`
SizeOfCode	`0xaa00`
SizeOfInitializedData	`0xa00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000C8AE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0xe000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x12000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`c2e1eebaa85f6ba125db38b2970e07e1 🔍`
SHA1	`353246d0c19648f7a17aa89e00e2c832ba53eac6 🔍`
SHA256	`c5302ee6201df3e9c7cf788e38b79e4c1acb3843e6d1e08e80bffc5f05be1805 🔍`
SHA3	`cb8b0aebd10d7ff6cc43214550466ec549b240dc8e488fae42e02544dc7b8e42 🔍`
VirtualSize	`0xa8b4`
VirtualAddress	`0x2000`
SizeOfRawData	`0xaa00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.50366`

.rsrc

MD5	`76663115a40dfd17c9c592100d268f2e 🔍`
SHA1	`12b8c5ca0bab65ac1073d3d866f395f61e974cec 🔍`
SHA256	`58d628aea7627079886c1ca70237d473f641ea5903da8e65192adae11ab9dc69 🔍`
SHA3	`1f1e1d33599296bc6d7140265fa4766bd73f8dbe53634b68fe9ac5f05a9cf029 🔍`
VirtualSize	`0x7e4`
VirtualAddress	`0xe000`
SizeOfRawData	`0x800`
PointerToRawData	`0xac00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.80595`

.reloc

MD5	`3496e50aa2ba8b77276c06f1251802b3 🔍`
SHA1	`42be4f3a306b78d8a1687431c3fe69d0e144ee1e 🔍`
SHA256	`2dd0424db536a52dcd1dac0cff1cf085d0455529a0ca7fed15d648506a500891 🔍`
SHA3	`cd7bf71b25230fc6dfe15ac0e597f4ccebc810779cfc27a41b137f51478835ea 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x10000`
SizeOfRawData	`0x200`
PointerToRawData	`0xb400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2cc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.15228`
MD5	`16ec11406456535d1de48d96513667e8 🔍`
SHA1	`a60ebbbcae868abd27fc96e22701fae48940e53c 🔍`
SHA256	`23202710be8c5fc9672495b0b62bebcf29a087cc7e07236f6bb155efb6e499ad 🔍`
SHA3	`ec347df0db7e63c15cad3d1f9d2b5b4d497473b5992bd681fc145eb5057ecb7d 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x478`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.18749`
MD5	`fd29301b5d8935606626f78b52b99694 🔍`
SHA1	`0767eeafe33c83161aec47ea2c28a30ba954fdc9 🔍`
SHA256	`3b904ab04cb29f4f2cf083c2b133a494ad05e6ef5c6a0243c31b51fc25e6941f 🔍`
SHA3	`aac8d1e8e7eaa175216600364b770c2bcfe12a8c0894806065ac3601d3ea7aec 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription
FileVersion (#2)	1.0.0.0
InternalName	Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Stub.exe
ProductName
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.