1fb707b113f25388a6dacdd81140bf2205f4fe93c71e83d3169e58ab98f95455

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2018-Dec-10 17:14:16
Detected languages English - United States
Debug artifacts C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_nondev_m_r\WindowsPlayer_Master_mono_x64.pdb
FileVersion 2018.3.0.7248423
ProductVersion 2018.3.0.7248423
Unity Version 2018.3.0f2_6e9a27477296

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 86.7865% of the executable.
Safe VirusTotal score: 0/69 (Scanned on 2026-07-08 19:35:17) All the AVs think this file is safe.

Hashes

MD5 5a2fba1048b1d90804ee1bd834994b87
SHA1 6369b949e99080f0f3fdb1f94472c6a757092553
SHA256 1fb707b113f25388a6dacdd81140bf2205f4fe93c71e83d3169e58ab98f95455
SHA3 1e9aa6ed5ba6130b9bc82c208fd7ddab58ef14a5f62177621151169ea7decd83
SSDeep 6144:vBCic2D7kN3QVcd5N1y1aNRZ5qIcJLtuB0wTAy0Qol6cnlLmcU4YnaQE:pLkNf5KMqI8gB0GPaBnv
Imports Hash 2903938ebca26120e91d0905dbfde587

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2018-Dec-10 17:14:16
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xa000
SizeOfInitializedData 0x95c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001268 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa3000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e3959a3353a0c73333174f549d388e74
SHA1 ddd6e2efb0cca809074dfd5597e3c51a0b74fc6d
SHA256 40308324ce0101e9106893e9c2aa57981cbb7d275d154727ad8e54657eff05cd
SHA3 3bc5704bfa603c12d782251d650603bfe76d880487157a0efbb3c52ddd367f21
VirtualSize 0x9e80
VirtualAddress 0x1000
SizeOfRawData 0xa000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.37547

.rdata

MD5 21b4745b72490cfacacb6f0e61ca97b7
SHA1 390a061530fb6f9488bf5007e6a1b155c9b97b51
SHA256 ebd7338ad964e836e85b41dfc97ef63a661cb18a7ba4d2418edeb08cd27430b3
SHA3 e0edb2e812f7219f2678ab9bcac844680b4ca666a1e45c358cff0d91c22d7ed1
VirtualSize 0x87ce
VirtualAddress 0xb000
SizeOfRawData 0x8800
PointerToRawData 0xa400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.75448

.data

MD5 e5723f0a96548881b4089bde74a34fc6
SHA1 1cc548e1b83bbe5f362a98ca6da244de6dade3bc
SHA256 ecf3f7a52f8a031db5c7ce8d9d8e05965b7fbde8e543ba56ea1662fdcd093dd7
SHA3 ea9bf9671edf6c6262b017ec3e6f18e282e6e1b832a5a96fc43b0d53d5a18c97
VirtualSize 0x1bb8
VirtualAddress 0x14000
SizeOfRawData 0xa00
PointerToRawData 0x12c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.81096

.pdata

MD5 e66db456ae04138dcb237c5291e8eee0
SHA1 cf319e03da59e0027dbc745063b4877b4751f613
SHA256 a430de6014c7ac4e917ef44bfb3056041eaa1826bfc3fd9b5ae49854754fae8f
SHA3 f88e3bb467530326a62ce7d52572c594e43178feffb8a762d40420b094a4a5e2
VirtualSize 0xc30
VirtualAddress 0x16000
SizeOfRawData 0xe00
PointerToRawData 0x13600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.31128

.rsrc

MD5 f07e9e400c601d0698f5b0b3ff539385
SHA1 441b62cc1cfe35e8cc36d2d7201e3bb420b24716
SHA256 e82527e85a7bf70712236269fbe801c03beb5d964d0fb58b764eee88c24e386a
SHA3 4f04bde9dbeebbd798060bcab4d8f5d50e5871b7af1372db5f0d761875a9febc
VirtualSize 0x8a0d8
VirtualAddress 0x17000
SizeOfRawData 0x8a200
PointerToRawData 0x14400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.83197

.reloc

MD5 e3aac30c773e88c2700a0e0f950592be
SHA1 2bf91fe5fe83ccb77977059ad2d6dbfefb19c443
SHA256 ced816cb4e98622677b5ca96407ddb8fddd97a04969717422058fd431560654a
SHA3 1e658d88e531b0977ab24a26bba64dd18e03ef3c7db199c804c3a262c9ffb89e
VirtualSize 0x614
VirtualAddress 0xa2000
SizeOfRawData 0x800
PointerToRawData 0x9e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.74269

Imports

UnityPlayer.dll UnityMain
KERNEL32.dll TerminateProcess
CloseHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CreateFileW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
WriteConsoleW
GetModuleHandleExW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x14004

NvOptimusEnablement

Ordinal 2
Address 0x14000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25043
MD5 6eef58b9e7db1980edcf5dcdb37609fb
SHA1 a1f5a6aa3265ae504e7a1680d00ddf84c6367a55
SHA256 05cb2ca24778fce770c238023d27fbd1e4ba9a166bfa632e7b311707eb915419
SHA3 747a6c18c86edb418b75971ca5bc017545dc95e73752528d706c1bcd23057d70

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29822
MD5 4f2a627d5f881810c823fbc93e1bd0c1
SHA1 8a53b4f53e5c8c4c650c96fc3b93e4e0ef3e68cd
SHA256 4617e70c32e02928ff00bb888cb3eb4fc9001ae0fd50e956bab524493cfbcd8d
SHA3 b7c8557310e5828adc79d359ce9eb2e0e6d24159480816f621d7b66d62fd5a1f

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27344
MD5 6fb5532d6ea0eee8df4b67e18a54aa81
SHA1 90d90c6fe063336d1a5df6cc841b309c35c0152b
SHA256 2f2c3074bafcfa27e0ddb610d4d20b829ec313c36eaedfdfa4d9b71bfa562510
SHA3 f2b417952c86738e3e77127722f20412975d38adbbc0697837eeefdeb6ffb2b4

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.09189
MD5 7204d3af709e5362b0f5bdbe1a8ec49b
SHA1 2c8bdd14a07087769fe53bbaa591e1fc272d11ee
SHA256 975d0367aa60d087476b0ef51ee6ae55e6156477901a73ea3a2b0a6a17291e0e
SHA3 330ec7a69119cdbd4a7dbb57f345e0dd8b8127f3bc6f313c52813d988591b0d1

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.9689
MD5 15c1561540c006d3218bb67faaa69c29
SHA1 8395d979714fb29067a33356f870990b99341d57
SHA256 c9511971cad812f9d8afb8e0ebb19f664aa6b084cb1b4a462f8eb8fd5344cfa1
SHA3 091e70241ff7a922d97fe51a8ad187e55b8537bf78db127ecc25f0c8f9d86014

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.766
MD5 338ccd363b83d0de75fbae2fbf9223ed
SHA1 b175f7a69e0079237f4ed1339f2758199e4fc513
SHA256 46d94d71eec217468fea5ed52357bce7d669a54bce6404b3d38ccf37db902063
SHA3 b77ade52274519222c369531c09bd4b5d7f3989faad88deab1f572569c891318

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.8864
MD5 fc4f671103d289f9f51afcd01c0c6e40
SHA1 7d6ba1f30be53e598a512323663fe3ad11b71b9b
SHA256 10df15691dfe04cd8f3303aa60e409941664feb6c24a9ad55f6a957c4af9e71f
SHA3 691d48ffa9693a0a59cc21677171dbef5ddd10215b1e180210281cea2c468f47

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89663
MD5 64439c24a3891c381f666fef22351761
SHA1 607778a3485ac8fb32c47f392e4082d0b5f3d323
SHA256 50e0eaabe4b0e3a7c30dccdf23400b54e3a4399aed2759a86c5cbb0d5056df46
SHA3 0882b2986b0d47f6f3bbf3d39fe96af6c5dc2256d9485f73f6dfac662d96e605

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89366
MD5 f9f8f187cb092f25503c46624a1afdbb
SHA1 58094aa7bb92db36137d6d51d72a42d24eafb288
SHA256 dabb1f723c5bb9071e858adfaaa53a4f2e850c63050659563f6cc88dd3301b41
SHA3 a3302200f2917665239be6b1d25f0e5857c8dcddf9cf4e652986ed08622f5088

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 3bf2dac037ce87794e66ff7f054e913f
SHA1 52ca961fd37ad960905a681d1db5157508ef1602
SHA256 2a87b1f32c5d0435090c72c392b75394f706e5750eff64fd85d25e1c622ee581
SHA3 8454d3273522657b5926068082b2cb88f6dbf352e7e9568008c0e33c792f349b

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37153
MD5 91e64b609f0521831a0a451a4b6d1d1a
SHA1 8d272c51ebb1e324e608add472138904e47b6879
SHA256 ba3cc0a62f2e4f2a379e4a14df04efc8ee180f9ca2e9d885b1fe449c90261536
SHA3 9a31e23eb74da65dbb81b73a49e187f528038019e1f42c300d6f4b55453e54ae

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x655
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37545
MD5 e64f0e3051453730fcd59e3487fff82c
SHA1 881f9506d98c7244ee2e6cc48de59fb5fe9394a0
SHA256 cc5206d924557aebbb34ea990bff63d51f03f95c9618f11ba16f5bd0d969f3b2
SHA3 e68e9754b0692216d6b7991ec0b28f737203d4f0979404b4bfd5728ed3214e3d

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2018.3.0.39463
ProductVersion 2018.3.0.39463
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 2018.3.0.7248423
ProductVersion (#2) 2018.3.0.7248423
Unity Version 2018.3.0f2_6e9a27477296
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2018-Dec-10 17:14:16
Version 0.0
SizeofData 125
AddressOfRawData 0x122b0
PointerToRawData 0x116b0
Referenced File C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_nondev_m_r\WindowsPlayer_Master_mono_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2018-Dec-10 17:14:16
Version 0.0
SizeofData 20
AddressOfRawData 0x12330
PointerToRawData 0x11730

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2018-Dec-10 17:14:16
Version 0.0
SizeofData 696
AddressOfRawData 0x12344
PointerToRawData 0x11744

TLS Callbacks

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140014020

RICH Header

XOR Key 0x5bef5e40
Unmarked objects 0
C objects (VS2015/2017 runtime 25711) 10
ASM objects (VS2015/2017 runtime 25711) 5
C++ objects (VS2015/2017 runtime 25711) 140
Imports (VS2015/2017 runtime 25711) 2
ASM objects (VS2017 v15.?.? build 25930) 9
C++ objects (VS2017 v15.?.? build 25930) 34
C objects (VS2017 v15.?.? build 25930) 19
Imports (VS2017 v15.6 compiler 26128) 3
Total imports 81
C++ objects (VS2017 v15.6 compiler 26128) 2
Exports (VS2017 v15.6 compiler 26128) 1
Resource objects (VS2017 v15.6 compiler 26128) 1
Linker (VS2017 v15.6 compiler 26128) 1

Errors

Leave a comment

No comments yet.