0d5c1630ec16dfb80eea59d3b08c6edc200415c726c80704cfc1d53cf53136e8

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-08 17:40:53
Comments 星环跑酷 Windows 游戏启动程序
FileDescription 星环跑酷
FileVersion 1.0.0.0
InternalName StarRingRun.exe
LegalCopyright
OriginalFilename StarRingRun.exe
ProductName 星环跑酷
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://127.0.0.1
Suspicious The PE is possibly packed. The PE only has 0 import(s).
Suspicious The PE is possibly a dropper. Resources amount for 83.4201% of the executable.
Malicious VirusTotal score: 7/56 (Scanned on 2026-10-11 07:53:28) APEX: Malicious
Bkav: W32.Malware.7AA0D6C3
CrowdStrike: win/malicious_confidence_70% (W)
Cylance: Unsafe
DeepInstinct: MALICIOUS
McAfeeD: ti!0D5C1630EC16
SentinelOne: Static AI - Suspicious PE

Hashes

MD5 7db5629e09180fb116f85a31ea0b06ba 🔍
SHA1 57977e3422d816b2f354eb8b758c086e7cf50497 🔍
SHA256 0d5c1630ec16dfb80eea59d3b08c6edc200415c726c80704cfc1d53cf53136e8 🔍
SHA3 80ca020cb7648a1976100cc069086248104d87e2b82c67428092620cfb845bf8 🔍
SSDeep 1536:iEuM9B0PG226R57DtiXFGEALoB0GASSS50ohxer3/8TwIjLgUoJYSSS:V9BUGz6/3iWSSSyo6jaLgUfSSS 🔍
Imports Hash d41d8cd98f00b204e9800998ecf8427e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 2
TimeDateStamp 2026-Oct-08 17:40:53
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 11.0
SizeOfCode 0x2a00
SizeOfInitializedData 0xf400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000000000 (Section: ?)
BaseOfCode 0x2000
ImageBase 0x140000000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x16000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x400000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x2000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 1e2e047f7a836e8ba417aaf3a86d4c77 🔍
SHA1 b6c97427a3e9c3e774afac0a15156109830aff10 🔍
SHA256 b5809a3b5b9159421668ad19a723c5246eea5b45a757a879887e07c9b34a6cb0 🔍
SHA3 9aa1bf10cd7b7269ad07e94577cf47d282745a234b91a8cc2696a8632a376d43 🔍
VirtualSize 0x2964
VirtualAddress 0x2000
SizeOfRawData 0x2a00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.48213

.rsrc

MD5 456422dbab46cd9072a17aaef339c550 🔍
SHA1 1326b2655530e053e748ab6a47029d47332ae556 🔍
SHA256 1a5fe97688bee6d6148b9e3504611cafb8ac4943ab5d012477c37d602fa5792d 🔍
SHA3 85f966b452e6982b01d7b5b818912b4a34b841e3dc58165fffb3a2861196f0fb 🔍
VirtualSize 0xf280
VirtualAddress 0x6000
SizeOfRawData 0xf400
PointerToRawData 0x2c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.94516

Imports

Delayed Imports

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x33c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.73627
Detected Filetype PNG graphic file
MD5 e199c389864bc53bd596521ddd55805c 🔍
SHA1 f92e8df84043ed706c3fe3852c6032fd224dfbc1 🔍
SHA256 2b3adee3465b4e1500981adda6f1a7b63fdaf21afc0c0f379db4693582d0a70b 🔍
SHA3 0b5b2ba231f016e8346c1ed95bd0bd6a5eb1af385c511cea5a32ac3288c49e7c 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x816
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.90602
Detected Filetype PNG graphic file
MD5 d95238f6eb3cb3c018dc6864fc95610f 🔍
SHA1 32d86c4993f9f94cc60b19d107bb22b85a1f6252 🔍
SHA256 a585a536e3c2b2b1b6e8429c3909e3a97f8d9d36c2664d6f4fcfec33d1495f92 🔍
SHA3 5b344474359309aeb4214886d53966d09795f6f75d121f49517d7c3c6817f74d 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xdc8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93721
Detected Filetype PNG graphic file
MD5 18e2a35814ba10fdb7aa2fe0fc047bdd 🔍
SHA1 5a60f80851ae40c1f826912bea2a8e331cdb2ecf 🔍
SHA256 37669e192549d1a6906d70a709e230e3fe9c1fb7d257f076abb29cc0c9510456 🔍
SHA3 3ec4c935d611458b90aca011b055a2c6481d46ef496d3d6483df6b2f6a2cdab6 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x148a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95675
Detected Filetype PNG graphic file
MD5 bd59182e73af674d9679c665d1b72f05 🔍
SHA1 d7785874256e735c194db89fb36c7813c3fab8fe 🔍
SHA256 98cd44b90461e3d6af88672886c7e827eab95a42073fd24a3687563862ec0fbb 🔍
SHA3 299f86ca9c67ae13a71cbe1bb2f8b3fec5a4612a104be32aa56bbe7cad6e1253 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x35b2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97701
Detected Filetype PNG graphic file
MD5 bcb6ce90fed8c75c7cc4a0565e8379b0 🔍
SHA1 3ce25149475d6dafd63d65a56e3d1ca5a0bdb4a2 🔍
SHA256 83a85f80d96929e5159144d389042a00e9e9e5cad94f1c4573c9c126a0054808 🔍
SHA3 6125878005e5d8c007f17b179770696312a1fa4e5b931a27b41994caef16843e 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x87de
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97871
Detected Filetype PNG graphic file
MD5 407a5e276741358b4f614bf6f1d00861 🔍
SHA1 4cb9d1d839075a432bbc90277d3ff762c4250602 🔍
SHA256 b76cfacb6d1a907568e7bd8b5f8cf09e8babe589cb174f2dd10abc89a209c32f 🔍
SHA3 c10b2a3d3cfe2a0c9087b8a6ca2db580f9cd5e89280b8cc588a3c525f4355620 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.63892
Detected Filetype Icon file
MD5 255e6bb0723493cd0af1ddf0c060f27d 🔍
SHA1 b9528c544394a451979f21ca9748be3b3c441aa9 🔍
SHA256 a3343bcb4010192eb157998c5999c48ca142d14478f9d64a88c996804521a1fe 🔍
SHA3 09c71c54ec79ca2e98fecc508b1399963302a78b5828ffab520c9d8a6eddb719 🔍

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x2c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.52792
MD5 6f8c5b5ff4b26a83ea1e4d48e9a8c87c 🔍
SHA1 e65d547a00fd31e4d70a36c4c6fab8d656a7043d 🔍
SHA256 565c5eb8ea9f86fb28683e3809b0daa40fcd51621b15b27330d8f08ca1260265 🔍
SHA3 68eef0f23f5f1d0f0d7047319fa00db6032844f4d49069c14a76249b076cc99c 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 a19a2658ba69030c6ac9d11fd7d7e3c1 🔍
SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650 🔍
SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f 🔍
SHA3 93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments 星环跑酷 Windows 游戏启动程序
FileDescription 星环跑酷
FileVersion (#2) 1.0.0.0
InternalName StarRingRun.exe
LegalCopyright
OriginalFilename StarRingRun.exe
ProductName 星环跑酷
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.