0daa12848fac7543ae0eab8e44891423d189cf0347600488f6dd25190b565ddf

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2022-Jun-15 13:00:00
Detected languages English - United States
CompanyName NetEase, Inc.
FileDescription MuMuPlayer
FileVersion 2022
InternalName 7zS2.sfx
LegalCopyright Copyright (C) 2022
OriginalFilename NemuDownloader.exe
ProductName MuMuPlayer
ProductVersion 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • %TEMP%
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Info The PE is digitally signed. Signer: Netease Interactive Entertainment Pte. Ltd.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Suspicious VirusTotal score: 1/70 (Scanned on 2026-08-08 15:29:24) DeepInstinct: MALICIOUS

Hashes

MD5 87888c9f365f2f01bd3c115903d80e81
SHA1 c6d09e082f13dcfc271e8b4735d51739dd460812
SHA256 0daa12848fac7543ae0eab8e44891423d189cf0347600488f6dd25190b565ddf
SHA3 0b5467213656a917d58609f32d821ad96dfd0696c58440cc066d5a036a23abf4
SSDeep 98304:Ker6uFFkOuPp3cjtFYEUO9u97ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSwVNJS:zr6uFFkOuPO7c7ZHlLbjXLWjI+SvFCjS
Imports Hash 77f81ec12eacdb769388a8e410647817

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2022-Jun-15 13:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x7000
SizeOfInitializedData 0x30400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00007C84 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x3a000
SizeOfHeaders 0x400
Checksum 0x5d7e9c
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 58d174b634405bb5c0ec30e621bfd739
SHA1 d2e9c4efa499ce81fcefee82ca9e07ed0bb3643f
SHA256 a14b8a8a18c844e289e05a856bbe680159d4ab09bc3708fcc6d82089f20b5c8e
SHA3 6dbcb3b871cbbe86d638a6ca68c06820cc81ed88c97f796062baeec2f1085cfa
VirtualSize 0x6e1c
VirtualAddress 0x1000
SizeOfRawData 0x7000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.58396

.rdata

MD5 418bd2f33dd247e2908ab66f9395dd5c
SHA1 b20b2ed7b7cb80216d7df498e4446dcb72be9b46
SHA256 9726e0f43ae793a3cbea90b0c43ad28bb98224d6f4f6f790f757439da0366ca1
SHA3 7b4732af514391e77d86730d8c64540bff060b4ecc0abebffa895336e343646d
VirtualSize 0x8ac
VirtualAddress 0x8000
SizeOfRawData 0xa00
PointerToRawData 0x7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.6765

.data

MD5 598e1aae6ecbd8237c4383f4be94b9f1
SHA1 ab4a6d7509b109b24572e011b0696647c7af25f0
SHA256 f60983e21c9cca08114b490d798ca0c0435a6857fd6176a2da8222694af0e852
SHA3 6a6b8c71015beef8a08636cc20b9dc37e55151b2ebf483b758e88d727edf68cb
VirtualSize 0x2054
VirtualAddress 0x9000
SizeOfRawData 0x200
PointerToRawData 0x7e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0203931

.rsrc

MD5 a8160aaeb4b8a53fbab1b3d48bcda953
SHA1 7140620b01e14eb29f68125c59325e9a246fcbb7
SHA256 4395f8e4bdf29159b6632f75219837812d69a652a7b3c88848c52ee09e785220
SHA3 9f0173748bc05a0481e7966afa667a2367d9b2b711f5704955a5229c9b0be894
VirtualSize 0x2d73c
VirtualAddress 0xc000
SizeOfRawData 0x2d800
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.41328

Imports

USER32.dll MessageBoxA
SHELL32.dll ShellExecuteExW
MSVCRT.dll _controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
memcpy
free
malloc
wcscmp
memcmp
memmove
strlen
wcslen
wcscpy
wcscat
memset
KERNEL32.dll CreateProcessW
GetStartupInfoA
GetModuleHandleA
GetSystemDirectoryW
lstrlenW
lstrcatW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetVersionExW
SetFilePointer
WriteFile
ReadFile
CreateFileW
DeleteFileW
FindNextFileW
RemoveDirectoryW
FindFirstFileW
FindClose
GetModuleFileNameW
GetCommandLineW
GetTempPathW
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
CreateDirectoryW
GetLastError
SetFileTime
GetExitCodeProcess
WaitForSingleObject
CloseHandle
SetCurrentDirectoryW
GetCurrentDirectoryW
SetFileAttributesW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.80589
MD5 9fef9676ae7c2069b24da67e98f0539b
SHA1 906d5eeb14c92ad810063b1906b029c68bbb7256
SHA256 6805a90dc52c437cd2aa120a28900f2da8d447b94a3e2796040e74ecaa80df73
SHA3 281cb61acc2308bd530c20446b5c974c68be689be72720f7948a702da3f33ee8

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.18403
MD5 a792cef939f02d76cd876d1da1ffd1b7
SHA1 63e2d98ac53e5763e269277d05a1d1737dc04974
SHA256 fe174802e7a3a9d4ef79ae6e9baf2f3dedb02b8c0f5f5342ad04a37e3b9d6eeb
SHA3 39848cd80ec893f2971c96b27a6bdce65825c9f9dfb824e4b3f86ab87df3e3e7

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25181
MD5 95e28d14cdf7b43fbaaa65a336374ef5
SHA1 66c09bf86cb7eedc2f77f020a48e951b236c0045
SHA256 258ce73e3fde3b3be01ead8d1c53652d59eba8ad000c1b1e2eb7a9ccfcb5e604
SHA3 3a15e1595f6661aae990da741e1f90423e1cd1da3019e5a70d58c00a78ab607e

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.11939
MD5 dc7afce47abe9370d4f6490942cadfbf
SHA1 1c32e9f75897222b273c8ef455590888734fe80a
SHA256 95d85cb152fda9c382686fea72bff5d7d814ebe009ca6a1df58aa73b91428e57
SHA3 20338bbe95d643af7240105e1c9bc1f5e27f1f16c081568988e9aecd592601e8

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.04044
MD5 9256ebdf1e4619127b152d04d81b262a
SHA1 8b86e6e951c85430ce914032a4b2ec67cacbc32d
SHA256 0a0906e2a0337ab1526c2cf68b14144e59827ce01d880e1ccdd890560d079762
SHA3 34f4ebd7a09d2d3d1f8962595677bd2613cca5ef3ea1124623704114acceba3e

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.78579
MD5 07e9651faf2628c95e5d5bb7dc7a94dd
SHA1 e595349e4010b1ca16b22b8f7f98a94fb13937d7
SHA256 b35c1fff5dcd4b4fdb7fc1f443a43b699059e6cdbeb7b4fdc18f0c7d71af10eb
SHA3 b03c95bacfc301c80cb16dd7b78a1e3bda25e7a8a91ea781da0c56fce689f499

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.66755
MD5 33358bdd1a3d946511cadbe44256639d
SHA1 76c604404ffeb35aa4864e48c89455830b2c180d
SHA256 cb32a8c42a30338c0bd647ddeae13eb0e8ccbb29476ed9fd954c4fb9d5463ee7
SHA3 80541fd52dee6c5b0e7d4584463ee19e715f06d77aeed3f3998200e17f5d9e37

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.54838
MD5 71b49908c95dd6a277416fc46136e762
SHA1 cc3cbfc565cf1b3dc873ced9d1723c61eea8ad81
SHA256 56d7fe6fd2489e91b3b204f0c232c629db0b3244a65f2db9c5c2f61e4100a7c4
SHA3 6dd175fe470fe93572c2fe79a58eb381d68ddea46048c8fd480dec7967de68a1

9

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x7d48
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.5792
MD5 5214e84482165578772786611d6ba304
SHA1 ac4506c87bb12797d39a62c8b76a2c8164788c46
SHA256 a10d149e0800a0ebe6377cd71fcb387f0646e1e1d94bd0b51483283872ef78ac
SHA3 59810ea0511dd6463f97a1864db5225453b0658f8a9bd43dbede67dd84126f36

10

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.41814
MD5 fe87d3d944ec01ee75a662e3d640e15c
SHA1 dc913ee4a52a53235a6a5afad97ac931e1ce21f6
SHA256 e9af463f735c58a3897f9d2b1b02514edcf63993f1ebeb90f1e05c8bfed5203a
SHA3 698331541b64e85a275285ed0413e663ae883cd586e0724ede485e65bf4db4cf

11

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x6c55
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9318
Detected Filetype PNG graphic file
MD5 2dc8827d191977c26fd082503d8ee309
SHA1 36f8b52fcb04041beed368f1fb1e0fdd96d4aa0a
SHA256 77b1f2b7844fdb78581f77a5c27cce16d04ff1e8d93db7182ddd318478d3f3a0
SHA3 f59c3c62047feabec61934c22de75b085356714a7a5897e295ea55c5040dc026

MAINICON

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.07228
Detected Filetype Icon file
MD5 558bcb6906914186ae1b42cb63428927
SHA1 de5c3a733d99338c15fe53a5488ef52e54171c55
SHA256 67b52182c25294ffee9544db3404519d32ea4174a8b7308d33453d19777b90c9
SHA3 6f0d089e50b929a8a0e2d0cf77bbf6c19d9a87aa38d98e83019b4a372f70d3bb

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.37086
Detected Filetype Icon file
MD5 d59e0d372ea5fd8c1f4de744376a6af4
SHA1 6883ce60e71a83424db0b41d0ab6bf61080e3de2
SHA256 b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b
SHA3 5e39df982879204dd9f129a37d1e1c2ff906e88de9ae01b4418db5e8455e7ae1

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2c0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32625
MD5 4c148abf37a748f505136da75917c02e
SHA1 2d3320504d0f5d239bd52aec277a1ebe3ac75d87
SHA256 7cb6beeb8bdc99b3bee31f71854ba2d8fbf2992f8e80765e56d8fcc6ce5744b8
SHA3 87b47bcd87315044348d27dad2d8b98a8d135b8c32ba03a39fff317fb377af26

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 22.0.0.0
ProductVersion 22.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName NetEase, Inc.
FileDescription MuMuPlayer
FileVersion (#2) 2022
InternalName 7zS2.sfx
LegalCopyright Copyright (C) 2022
OriginalFilename NemuDownloader.exe
ProductName MuMuPlayer
ProductVersion (#2) 1.0.0.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x3b61099c
Unmarked objects 0
C objects (8047) 11
14 (7299) 5
Linker (8047) 2
Total imports 65
Imports (2179) 7
C objects (VS98 SP6 build 8804) 19
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

Leave a comment

No comments yet.