39301819498909be7128a07e2518b40a
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Jun-09 11:07:51 |
| Detected languages |
English - United States
|
| Comments | This installation was built with Inno Setup. |
| CompanyName | |
| FileDescription | ЕngineGame Downloader |
| FileVersion | 7.5.0 |
| LegalCopyright | © ЕngineGame |
| OriginalFileName | |
| ProductName | ЕngineGame |
| ProductVersion | 7.5.0 |
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: .itext
Unusual section name found: .didata |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | The binary may have been compiled on a machine in the UTC+2 timezone. |
| Info | The PE is digitally signed. |
Signer: EngineGame
Issuer: Sectigo Public Code Signing CA R36 |
| Malicious | VirusTotal score: 29/72 (Scanned on 2025-01-10 16:31:46) |
Alibaba:
AdWare:Win32/OfferCore.56ad88b8
Avira: PUA/OfferCore.Gen Bkav: W32.Common.939E080B CAT-QuickHeal: Trojan.Ghanarava.173640663318b40a CTX: exe.adware.offercore Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: a variant of Win32/OfferCore.B potentially unwanted Elastic: malicious (moderate confidence) F-Secure: PotentialRisk.PUA/OfferCore.Gen Fortinet: Riskware/OfferCore GData: Win32.Trojan.Agent.3ZPYLW Google: Detected Gridinsoft: PUP.Win32.OfferCore.dd!c Ikarus: PUA.OfferCore K7AntiVirus: Adware ( 0058a4f11 ) K7GW: Adware ( 0058a4f11 ) Kaspersky: not-a-virus:AdWare.Win32.Agent.xxzxva Lionic: Adware.Win32.OfferCore.2!c Malwarebytes: PUP.Optional.BundleInstaller.DDS MaxSecure: Trojan.Malware.314448349.susgen McAfee: Artemis!393018194989 Microsoft: PUADlManager:Win32/OfferCore Rising: Adware.OfferCore!1.DF2E (CLASSIC) Skyhigh: Artemis Sophos: Generic Reputation PUA (PUA) Symantec: PUA.Gen.2 VBA32: Adware.Agent Varist: W32/ABApplication.DKLQ-3234 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 10 |
| TimeDateStamp | 2024-Jun-09 11:07:51 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xa7400 |
| SizeOfInitializedData | 0x16000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000A83BC (Section: .itext) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xa9000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xcb000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x1ca362c |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.rsrc
Imports
| kernel32.dll |
GetACP
GetExitCodeProcess CloseHandle LocalFree SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime GetEnvironmentVariableW WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
|---|---|
| comctl32.dll |
InitCommonControls
|
| user32.dll |
CreateWindowExW
TranslateMessage CharLowerBuffW CallWindowProcW CharUpperW PeekMessageW GetSystemMetrics SetWindowLongW MessageBoxW DestroyWindow CharUpperBuffW CharNextW MsgWaitForMultipleObjects LoadStringW ExitWindowsEx DispatchMessageW |
| oleaut32.dll |
SysAllocStringLen
SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate |
| advapi32.dll |
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW OpenProcessToken FreeSid AllocateAndInitializeSid EqualSid RegQueryValueExW GetTokenInformation ConvertSidToStringSidW RegCloseKey |
| kernel32.dll (delay-loaded) |
GetACP
GetExitCodeProcess CloseHandle LocalFree SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime GetEnvironmentVariableW WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | kernel32.dll |
| ModuleHandle | 0xb6080 |
| DelayImportAddressTable | 0xb6090 |
| DelayImportNameTable | 0xb60b4 |
| BoundDelayImportTable | 0xb60d8 |
| UnloadDelayImportTable | 0xb60f0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
dbkFCallWrapperAddr
| Ordinal | 1 |
|---|---|
| Address | 0xb063c |
__dbk_fcall_wrapper
| Ordinal | 2 |
|---|---|
| Address | 0xfc10 |
1
2
3
4
5
6
7
8
9
10
11
12
13
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
DVCLAL
PACKAGEINFO
11111
MAINICON
1 (#2)
1 (#3)
String Table contents
| Windows Server 2016 |
| Windows Server 2019 |
| Windows Server 2022 |
| Windows 8 |
| Windows 8.1 |
| Windows 10 |
| Windows 11 |
| Observer is not supported |
| Cannot have multiple single cast observers added to the observers collection |
| The object does not implement the observer interface |
| No single cast observer with ID %d was added to the observer collection |
| No multi cast observer with ID %d was added to the observer collection |
| Must wait on at least one event |
| Cannot call BeginInvoke on a TComponent in the process of destruction |
| VAR and OUT arguments must match parameter type exactly |
| %s (Version %d.%d, Build %d, %5:s) |
| %s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s) |
| 32-bit Edition |
| 64-bit Edition |
| Windows |
| Windows Vista |
| Windows Server 2008 |
| Windows 7 |
| Windows Server 2008 R2 |
| Windows 2000 |
| Windows XP |
| Windows Server 2003 |
| Windows Server 2003 R2 |
| Windows Server 2012 |
| Windows Server 2012 R2 |
| Property is read-only |
| %s.Seek not implemented |
| Property %s does not exist |
| Stream write error |
| Thread creation error: %s |
| Thread Error: %s (%d) |
| Cannot terminate an externally created thread |
| Cannot wait for an externally created thread |
| Cannot call Start on a running or suspended thread |
| Invalid argument |
| Source and Destination arrays must not be the same |
| Argument out of range |
| Duplicates not allowed |
| Insufficient RTTI available to support this operation |
| Parameter count mismatch |
| Type '%s' is not declared in the interface section of a unit |
| Cannot assign a %s to a %s |
| CheckSynchronize called from thread $%x, which is NOT the main thread |
| Class %s not found |
| List does not allow duplicates ($0%x) |
| A component named %s already exists |
| ''%s'' is not a valid component name |
| Invalid property value |
| Invalid property path |
| Invalid property value |
| List capacity out of bounds (%d) |
| List count out of bounds (%d) |
| List index out of bounds (%0:d). %2:s object range is 0..%1:d |
| Out of memory while expanding memory stream |
| %s has not been registered as a COM class |
| Error reading %s%s%s: %s |
| Stream read error |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Saturday |
| Invalid source array |
| Invalid destination array |
| Character index out of bounds (%d) |
| Start index out of bounds (%d) |
| Invalid count (%d) |
| Invalid destination index (%d) |
| Invalid code page |
| No mapping for the Unicode character exists in the target multi-byte code page |
| Invalid StringBaseIndex |
| Ancestor for '%s' not found |
| May |
| June |
| July |
| August |
| September |
| October |
| November |
| December |
| Sun |
| Mon |
| Tue |
| Wed |
| Thu |
| Fri |
| Sat |
| Sunday |
| Jan |
| Feb |
| Mar |
| Apr |
| May |
| Jun |
| Jul |
| Aug |
| Sep |
| Oct |
| Nov |
| Dec |
| January |
| February |
| March |
| April |
| Invalid variant type |
| Operation not supported |
| Unexpected variant error |
| External exception %x |
| Assertion failed |
| Interface not supported |
| Exception in safecall method |
| Object lock not owned |
| Monitor support function not initialized |
| Feature not implemented |
| Method called on disposed object |
| %s (%s, line %d) |
| Abstract Error |
| Access violation at address %p in module '%s'. %s of address %p |
| System Error. Code: %d. |
| %s%s |
| A call to an OS function failed |
| Variant method calls not supported |
| Read |
| Write |
| Execution |
| Invalid access |
| Error creating variant or safe array |
| Variant or safe array index out of bounds |
| Variant or safe array is locked |
| Invalid variant type conversion |
| Invalid variant operation |
| Invalid NULL variant operation |
| Invalid variant operation (%s%.8x) |
| %s |
| Could not convert variant of type (%s) into type (%s) |
| Overflow while converting variant of type (%s) into type (%s) |
| Variant overflow |
| Invalid argument |
| Invalid floating point operation |
| Floating point division by zero |
| Floating point overflow |
| Floating point underflow |
| Invalid pointer operation |
| Invalid class typecast |
| Access violation at address %p. %s of address %p |
| Access violation |
| Stack overflow |
| Control-C hit |
| Privileged instruction |
| Operation aborted |
| Exception %s in module %s at %p. |
| %s%s |
| Application Error |
| Format '%s' invalid or incompatible with argument |
| No argument for format '%s' |
| '%s' is not a valid integer value |
| '%d.%d' is not a valid timestamp |
| Invalid argument to time encode |
| Invalid argument to date encode |
| Out of memory |
| I/O error %d |
| File not found |
| Invalid filename |
| Too many open files |
| File access denied |
| Read beyond end of file |
| Disk full |
| Invalid numeric input |
| Division by zero |
| Range check error |
| Integer overflow |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 7.5.0.0 |
| ProductVersion | 7.5.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | This installation was built with Inno Setup. |
| CompanyName | |
| FileDescription | ЕngineGame Downloader |
| FileVersion (#2) | 7.5.0 |
| LegalCopyright | © ЕngineGame |
| OriginalFileName | |
| ProductName | ЕngineGame |
| ProductVersion (#2) | 7.5.0 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
| StartAddressOfRawData | 0x4b8000 |
|---|---|
| EndAddressOfRawData | 0x4b8018 |
| AddressOfIndex | 0x4a9c24 |
| AddressOfCallbacks | 0x4b9010 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |
Load Configuration
RICH Header
Errors
[*] Warning: Section .bss has a size of 0!
[*] Warning: Section .tls has a size of 0!