092a6c3df65f4c55132bbc6f0914a10a68eb793e77995f307f9295eab1251162

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2012-Dec-31 00:38:51
Detected languages English - United States
Russian - Russia
CompanyName ByteCorum
FileDescription DragonBurn is one of the best CS2 kernel-mode read-only external cheats. It has a ton of features, full customization, and offset auto-update. Undetected by all anti-cheats except Faceit.
LegalCopyright Copyright (C) ByteCorum 2025
LegalTrademarks
InternalName DragonBurn.exe
ProductName DragonBurn
OriginalFilename DragonBurn.exe
FileVersion 3.7.10.4
ProductVersion 3.7.10.4
Comments
PrivateBuild
SpecialBuild

Plugin Output

Suspicious PEiD Signature: UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h)
UPX -> www.upx.sourceforge.net
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • %Temp%
 Contains domain names:
  • http://sourceforge.net
  • sourceforge.net
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
Info The PE's resources present abnormal characteristics. Resource 1 is possibly compressed or encrypted.
Resource 2 is possibly compressed or encrypted.
Resource 3 is possibly compressed or encrypted.
Suspicious The file contains overlay data. 1131917 bytes of data starting at offset 0x17e00.
The overlay data has an entropy of 7.99984 and is possibly compressed or encrypted.
Overlay data amounts for 92.0475% of the executable.
Malicious VirusTotal score: 49/70 (Scanned on 2026-07-26 11:23:37) ALYac: Application.Generic.4561975
APEX: Malicious
AVG: Win64:MalwareX-gen [Hack]
Antiy-AVL: RiskWare/Win64.Gamehack
Arcabit: Application.Generic.D459C37
Avast: Win64:MalwareX-gen [Hack]
Avira: TR/W64.MalwareX
BitDefender: Application.Generic.4561975
CTX: exe.trojan.driverloader
CrowdStrike: win/malicious_confidence_60% (W)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DrWeb: Tool.VulnDriver.22
ESET-NOD32: Win64/HackTool.GameHack_AGen.BG trojan
Elastic: malicious (moderate confidence)
Emsisoft: Application.Generic.4561975 (B)
F-Secure: Trojan.TR/W64.MalwareX
Fortinet: Riskware/NDAoF
GData: Application.Generic.4561975
Google: Detected
Ikarus: Trojan.Win64.Krypt
K7AntiVirus: Hacktool ( 005cec841 )
K7GW: Hacktool ( 005cec841 )
Kaspersky: Trojan.Win64.Agent.smeyjr
Kingsoft: Win32.Troj.Unknown.a
Lionic: Trojan.Win32.Driverloader.4!c
Malwarebytes: Malware.AI.3927229873
MaxSecure: Trojan.Malware.205175977.susgen
McAfeeD: ti!092A6C3DF65F
MicroWorld-eScan: Application.Generic.4561975
Microsoft: Trojan:Win32/Phonzy.A!ml
NANO-Antivirus: Riskware.Win64.VulnDriver.leovwj
Paloalto: generic.ml
Panda: Trj/CI.A
Rising: Trojan.DriverLoader!8.18C1C (CLOUD)
Sangfor: Hacktool.Win64.Driverloader.Viy5
Skyhigh: BehavesLike.Win32.Dropper.tc
Sophos: Mal/Generic-S
Symantec: Trojan.Gen.MBT
Tencent: Malware.Win32.Gencirc.14a362b1
Trapmine: malicious.high.ml.score
TrellixENS: Artemis!2BF1AAA7E2CC
TrendMicro: Trojan.Win32.DRIVERLOADER.USBLCV26
TrendMicro-HouseCall: Trojan.Win32.DRIVERLOADER.USBLCV26
VBA32: Trojan.Win64.Agent
VIPRE: Application.Generic.4561975
Varist: W64/ABApplication.BFEB-5001
Webroot: W32.Malware.gen
huorong: Exploit/Vulndriver.c!crit

Hashes

MD5 2bf1aaa7e2ccb6b2f7c6cc5d7200a95e 🔍
SHA1 61e8e5dd4b0431cebe024b040dfd1a86f898f791 🔍
SHA256 092a6c3df65f4c55132bbc6f0914a10a68eb793e77995f307f9295eab1251162 🔍
SHA3 f1b12f7b07ef6afdb1018d969debea25b2658f7b0e3383c4df6c1ba70f17e35b 🔍
SSDeep 24576:Qor0uON3thfqrrPC1CgLOFtn/a3LqxkXdcskZ27asTohZxB2:QO0zVy/T/3CkZ2HsZ72 🔍
Imports Hash 254a3a10c7173262c1ad498fb1bffb52 🔍

DOS Header

e_magic MZ
e_cblp 0x60
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x60

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2012-Dec-31 00:38:51
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x13000
SizeOfInitializedData 0x5000
SizeOfUninitializedData 0x17000
AddressOfEntryPoint 0x0002ACE0 (Section: UPX1)
BaseOfCode 0x18000
BaseOfData 0x2b000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x30000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x17000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 8709dc764bec50e74b23c08aba351e9d 🔍
SHA1 3cf18a0a2986aedcb50003e428d5a363e5a1c71e 🔍
SHA256 543505b9b2a11e033807dadebc618de40015d6eb2380f7ada2866ca2f1d8103a 🔍
SHA3 67c22e8d0c02548d3a8950105ac92e4163a388b015ca297bedaf4fe5b9196f68 🔍
VirtualSize 0x13000
VirtualAddress 0x18000
SizeOfRawData 0x13000
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.86715

.rsrc

MD5 06bdb7cfa6c22bdc31e7bb4f5ebd96fb 🔍
SHA1 1d98d8b861d1c399cecec596fa3f1c09908c828e 🔍
SHA256 92c08336f57487cf46210a148338effb6858bb9d0a0de96ed677276dac637e29 🔍
SHA3 53566775d15268ff1c6be6bb3c15570990388ceb0ec64602f7fee46e0ecbdab9 🔍
VirtualSize 0x5000
VirtualAddress 0x2b000
SizeOfRawData 0x4c00
PointerToRawData 0x13200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.65783

Imports

KERNEL32.DLL LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
ADVAPI32.dll FreeSid
COMCTL32.dll #17
GDI32.dll DeleteDC
MSVCRT.dll free
ole32.dll CoInitialize
OLEAUT32.dll SysAllocString
SHELL32.dll SHGetMalloc
USER32.dll GetDC

Delayed Imports

1

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.70483
MD5 a78be480d4e850560f7aaab98212bbaf 🔍
SHA1 6ad040048f13f0a7a14c06d3de14ac2c2a85233b 🔍
SHA256 78ba9f3c5acc60c9b56b0894787c537ead728065be151ef1e9d9f4107ee3ccae 🔍
SHA3 f7435cfaf5832858192c313c53fcdf5027a1bab063a1e9dac0b525fe9085e782 🔍

2

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.57442
MD5 dbc41dde5370bce3fecbfbd057a1935e 🔍
SHA1 54093029e1aaaf86ff4b2a9002ecfc98cab7c0d3 🔍
SHA256 4191edc93d585f6343d847872b23a93dbdf27d615a2e544fd7d339c55b8c2b64 🔍
SHA3 f452fcfdf7aececba244d0c25e1232a327b8133ccf125cf0c5212404ef2aaa42 🔍

3

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x1e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.3163
MD5 f31d4e1906030942cb0d82bb6f262ea8 🔍
SHA1 a5a2581fd0eb82f6eeec45dedf2313c98adcd55f 🔍
SHA256 5d17aba028a2ef35b6c26234c08a8fbeb59cd3b74654b15fb156d5a798263c0f 🔍
SHA3 1f2a564e69306c629261887e194b9fbfad706485ad37f9f5acf28ed308df9d19 🔍

4

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.89604
MD5 a0b4c85d93dc861620e7e5439d0ef4b8 🔍
SHA1 03c987010cd0583ede77327935a91dded1ae14af 🔍
SHA256 ca287c94561d6a31a6102fd1b49f641a0173c54e8a8eeca797f33d91615a374f 🔍
SHA3 32ab6caf284dcb48edd8a4406d59dfceb0c893de47b86b4264fc108615f7417e 🔍

50

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x3e8f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95272
Detected Filetype PNG graphic file
MD5 4be76e4b7dc9e372db7acbd69b8a509e 🔍
SHA1 c9d6a9b5aac375bee6d3e7254504e33a07df7ac8 🔍
SHA256 8648fd586acbd84a75502b6ce6e8e8310336cd47861155ba00a5036540f35b64 🔍
SHA3 e02fe89f7e55102825623d72f3cec0317ed3c9e752820f69726c765c1b1e76b8 🔍

101

Type RT_GROUP_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.6789
Detected Filetype Icon file
MD5 3d78f0c6fa88e08e314d8fc39c1bd760 🔍
SHA1 db5e4fb0729a4a9feb00df3180059c3c7d281ccf 🔍
SHA256 4f08da2068d6229cf46e60a2dba4e820693b3ea7978a7041480f2262e9ab1803 🔍
SHA3 789db078a1bcb1e72b2ab3e08d7c4c8000cedc16e2319d6465f86aaf19f89a8a 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x4cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.41699
MD5 c234d40c8ce14cbe8173fddd86c09e38 🔍
SHA1 655e92c9268d200d2cd3e77b18952b2a72bb6fec 🔍
SHA256 84bb4c89367e8250ea5301404bf8f577205d6efeecc62489b3c3002b79527963 🔍
SHA3 500d73c018fe545b38fecbbc9b1c85bdfcebce5aad43b6611285364d8561a5e6 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x346
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.23138
MD5 e32a5384ce1d3d6ce2f07bae63580af4 🔍
SHA1 ecd92eb0584dc4e5b87b9d87aac587c1fb5a3538 🔍
SHA256 e7c9872b3f255430bf4a174164305dfefbe2affd5b942c942b349047d9289297 🔍
SHA3 02ee32c8bcdd6cefb446c2a5d7f6073bc3f316daf7571f7befa4a3eb018c1315 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 3.7.10.4
ProductVersion 3.7.10.4
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language Russian - Russia
CompanyName ByteCorum
FileDescription DragonBurn is one of the best CS2 kernel-mode read-only external cheats. It has a ton of features, full customization, and offset auto-update. Undetected by all anti-cheats except Faceit.
LegalCopyright Copyright (C) ByteCorum 2025
LegalTrademarks
InternalName DragonBurn.exe
ProductName DragonBurn
OriginalFilename DragonBurn.exe
FileVersion (#2) 3.7.10.4
ProductVersion (#2) 3.7.10.4
Comments
PrivateBuild
SpecialBuild
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section UPX0 has a size of 0!
Leave a comment

No comments yet.