30b77dff2299bf911d45b20d8bd7537bf7c301c903b166e0e34687f282a9cf74

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-29 17:38:12
Detected languages English - United States
Debug artifacts C:\Users\rukia\Documents\workspace\nova-cs2\bin\Release\nova-cs2.pdb

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • github.com
  • https://exo-api.tf
  • https://github.com
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteW
 Uses functions commonly found in keyloggers:
  • GetForegroundWindow
  • GetAsyncKeyState
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 8/70 (Scanned on 2026-08-29 17:42:29) Bkav: W32.Malware.AA86BC31
Cynet: Malicious (score: 100)
Elastic: malicious (high confidence)
Kaspersky: HEUR:Trojan-Downloader.Win64.LuckyWare.gen
McAfeeD: ti!30B77DFF2299
Microsoft: Program:Win32/Wacapew.C!ml
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 818d33688c478e405c03ca1e0fde0bed 🔍
SHA1 83653ecd6d8313b64986d363ab60184d278c32dc 🔍
SHA256 30b77dff2299bf911d45b20d8bd7537bf7c301c903b166e0e34687f282a9cf74 🔍
SHA3 a09c0cfe25b76ac0e923b0852999338f430eed75609bb4cc10dcb3accd1f5e02 🔍
SSDeep 12288:LsHwHHqjElpCqU6P1dfMRjcaAzo3Ot6vRgUQrn86XzYirtn0oK:LsH556PvijcaKocU+UyvciJn0 🔍
Imports Hash c55bb289fc5a1d3fa1fafbf2f3e0f089 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Aug-29 17:38:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x8ec00
SizeOfInitializedData 0x32e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000065FD4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xc7000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 aacce399aa73d4bb59a490946d2a38f6 🔍
SHA1 4b5078dfac9b21d9cfff8cf457edf7f49cc89687 🔍
SHA256 914ffbf94e8ba8d733be0af452954d20936c8aa2d945a71a6f587435981f9479 🔍
SHA3 4cc1c5c45afc79b4a64e0391c6a85eada6d4321a1083b2e79ca1e083a7ef133c 🔍
VirtualSize 0x8ea7c
VirtualAddress 0x1000
SizeOfRawData 0x8ec00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.69175

.rdata

MD5 b0e163c40bb1e32f51a9d39c624486b8 🔍
SHA1 f59a115e6f420ac26583fb6a98addfc4272fc5e2 🔍
SHA256 b4788a5f0c89229c75a63909eebd31eb9fb8d0f5ac96541a46266212b30f8aa3 🔍
SHA3 666fd2b21521469463efd8b81b9adc7dfd46492c072e49b4cbb248ac3764d26b 🔍
VirtualSize 0x27534
VirtualAddress 0x90000
SizeOfRawData 0x27600
PointerToRawData 0x8f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.23859

.data

MD5 e478611412bb79b0854b74ddb75fb0c7 🔍
SHA1 38287962a586f53f74e6023ded847bc5fe4ae402 🔍
SHA256 69546d37f5f27c493b07cc9a332f6dff9f58f478b5da2496a55af98ef1ede629 🔍
SHA3 4ecf216e51aa2e0e5878606f4c9f2122e6236f4bb6e4aa653bf72c375688173f 🔍
VirtualSize 0x1eec
VirtualAddress 0xb8000
SizeOfRawData 0xe00
PointerToRawData 0xb6600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.18616

.pdata

MD5 99bc76aace15a5c67c16f48cac9f150c 🔍
SHA1 1ba6a17cd7710d5c4cd14818a7f17d4134f0fd45 🔍
SHA256 13a836a0ffc7be929e33a9f86be381f51c3ad54c6b7fca2c8afcbf43623660f8 🔍
SHA3 ce92994460e1ef82b5cdd3ffadc4080b325558f9f65fd384986d9a65324345e2 🔍
VirtualSize 0x64d4
VirtualAddress 0xba000
SizeOfRawData 0x6600
PointerToRawData 0xb7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.95469

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0xc1000
SizeOfRawData 0x200
PointerToRawData 0xbda00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

_RDATA

MD5 a40195987236fe85a29643934a2b6e66 🔍
SHA1 21443eb394dce4347bf75252569d548f83580a73 🔍
SHA256 01684f5e191844c307a49bdba7555f08f9862c9085f8d7d090b96e19542df3b1 🔍
SHA3 e0b0042020a0cbf47f16c42cd00f2b1641a42057d69ebf3e5e74a959aad3152e 🔍
VirtualSize 0x2208
VirtualAddress 0xc2000
SizeOfRawData 0x2400
PointerToRawData 0xbdc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.04224

.rsrc

MD5 cf1eb3d1a669b8eda18e98a3f570ddb4 🔍
SHA1 74758d0d30ac670b6ca3d00783569a65a80208dc 🔍
SHA256 9b046f1fb619c8c518a3082ea7908da026803d679c04939a59a2b43173cac7bb 🔍
SHA3 7bd264f0479f1ccb1096713319b0a3c5503fa1035fa8c94254fde23d495c1d85 🔍
VirtualSize 0x1e0
VirtualAddress 0xc5000
SizeOfRawData 0x200
PointerToRawData 0xc0000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71935

.reloc

MD5 4a1c2723f52b3a928ff8ee471abeac4b 🔍
SHA1 db22a22d28f35363d977841ff638d39bc5a2efdf 🔍
SHA256 3297a6cc192dd87e0d392c3c1deb2335c6a6ccea4a67db6c1e62a71deb5544bd 🔍
SHA3 1131bc81a612ebd1b43b07561d18607e33e9501c7926df3c26f0066cc35cf642 🔍
VirtualSize 0x8ec
VirtualAddress 0xc6000
SizeOfRawData 0xa00
PointerToRawData 0xc0200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.17222

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
KERNEL32.dll GetModuleHandleW
OutputDebugStringA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
IsDBCSLeadByte
GetProcAddress
FreeLibrary
QueryPerformanceCounter
SetEndOfFile
WriteConsoleW
HeapReAlloc
HeapSize
CreateFileW
SetStdHandle
GetStringTypeW
CreateThread
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
GetFileSizeEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
CloseHandle
DisableThreadLibraryCalls
GetTickCount64
GetModuleHandleA
LCMapStringW
FreeLibraryAndExitThread
VirtualProtect
CompareStringW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
Sleep
GetCurrentThreadId
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
WakeAllConditionVariable
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
USER32.dll SetCursor
SendInput
IsWindowUnicode
GetForegroundWindow
DefWindowProcW
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
SetCapture
GetClientRect
GetAsyncKeyState
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
CallWindowProcW
SetWindowLongPtrW
LoadCursorW
SHELL32.dll ShellExecuteW
IMM32.dll ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

Delayed Imports

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Aug-29 17:38:12
Version 0.0
SizeofData 93
AddressOfRawData 0xac6c8
PointerToRawData 0xab6c8
Referenced File C:\Users\rukia\Documents\workspace\nova-cs2\bin\Release\nova-cs2.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Aug-29 17:38:12
Version 0.0
SizeofData 20
AddressOfRawData 0xac728
PointerToRawData 0xab728

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-29 17:38:12
Version 0.0
SizeofData 968
AddressOfRawData 0xac73c
PointerToRawData 0xab73c

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Aug-29 17:38:12
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1800acb50
EndAddressOfRawData 0x1800acb58
AddressOfIndex 0x1800b9284
AddressOfCallbacks 0x180090500
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1800b8040

RICH Header

XOR Key 0x80e53925
Unmarked objects 0
C++ objects (33145) 171
C objects (33145) 25
ASM objects (33145) 21
ASM objects (35207) 15
C objects (35207) 15
C++ objects (35207) 42
Imports (33145) 17
Total imports 180
C++ objects (LTCG) (35228) 7
Resource objects (35228) 1
Linker (35228) 1

Errors

Leave a comment

No comments yet.