39aee9aadbb963bd07419c2bec1682beb06e44e849900cf885b6e8b15ab1dcff

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 1970-Jan-01 00:00:00
Detected languages English - United States

Plugin Output

Suspicious PEiD Signature: XWD graphics format
HQR data file
Info Interesting strings found in the binary: Contains domain names:
  • .hash.net
  • apple.com
  • apps.apple.com
  • ftp://pal.example
  • github.com
  • golang.org
  • google.com
  • http://127.0.0.1
  • http://cli.example
  • http://page.example
  • http://pal.example
  • http://palworld.gamevault.ina
  • http://www.w3.org
  • http://www.w3.org/2000/svg
  • https://apps.apple.com
  • https://apps.apple.com/app/id6788249554
  • https://discord.gg
  • https://evil.example
  • https://go.dev
  • https://pal.example
  • https://palworld.gamevault.in
  • https://palworld.gamevault.in/i/#ABCDbytes.Buffer
  • https://palworld.gamevault.in/live/
  • https://palworld.gamevault.in/live/beacon-version.jsonfmt
  • https://palworld.gamevault.in/live/the
  • https://palworld.gamevault.in/map
  • https://palworld.gamevault.in/mapbytes.Buffer.Grow
  • https://play.google.com
  • https://play.google.com/store/apps/details?id
  • https://www.patreon.com
  • https://www.patreon.com/cw/grannymaster
  • https://www.patreon.com/cw/grannymasterthe
  • https://www.reddit.com
  • https://www.reddit.com/user/AwkwardShake
  • n.style.top
  • patreon.com
  • play.google.com
  • reddit.com
  • style.top
  • www.patreon.com
  • www.reddit.com
  • www.w3.org
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Suspicious VirusTotal score: 2/71 (Scanned on 2026-08-18 12:17:49) Microsoft: Trojan:Win32/Wacatac.B!ml
Trapmine: suspicious.low.ml.score

Hashes

MD5 5475ffc5a548a770bb7b487c2f83b7eb 🔍
SHA1 7acec703bad6358f1494eca8de02040b96c2d437 🔍
SHA256 39aee9aadbb963bd07419c2bec1682beb06e44e849900cf885b6e8b15ab1dcff 🔍
SHA3 96584b2f051483f61303cc370a7e62ef1aa0951b94d98fda6a28e3faf21da40f 🔍
SSDeep 49152:mX2LsymB1D3ynIXc0ihRGTEfoHjym4DDHcH8ulXiUCxPCVJsk4RneSzBkxGx3nA:mX2VWxlQK+vwDweMcUKoL0jyDuzmv9E 🔍
Imports Hash ed8b780a3ce7ca4aba78a21f6bc3d4e0 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x95c200
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x42f200
SizeOfInitializedData 0x6be00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000008C720 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x29cc000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 3fcb29e389752a82a67dc27f9ce74108 🔍
SHA1 a9e1315092e48cd310aa6d1417a47efc676634ab 🔍
SHA256 78b315ecd570e807fc351af8e5fce3c7db1a7bd9172141eabcd4d8b9523b30ae 🔍
SHA3 2f35b79bd6d1ce7e11fb953b0839b9f5430a4054552105af68825c7a8e062107 🔍
VirtualSize 0x42f0f1
VirtualAddress 0x1000
SizeOfRawData 0x42f200
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.18466

.rdata

MD5 6149f26b7104737b35c6327eaa5b1c4e 🔍
SHA1 b82787259ab7b3686e6a4c272b3fea3a3c464464 🔍
SHA256 2404eeb6e2cfbc4effaf7a34d7ac2433b83459795823bffa06ccc66fe71d25b6 🔍
SHA3 8cf7029d019948e9fc1647c0cc0cc677e6314ad906eaa2f6185ae94e77645313 🔍
VirtualSize 0x48ff40
VirtualAddress 0x431000
SizeOfRawData 0x490000
PointerToRawData 0x42f800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.66277

.data

MD5 7453bf43d593b6bf435c84d5eedcd7ed 🔍
SHA1 051f229661b7fa0354b8aaba3190aa5384682422 🔍
SHA256 5fb9d359a4653dd192bb405c23214f1f950a241a138d94a0aa7fd3c4c9644fac 🔍
SHA3 c851b50433fb95b77ce3dbaeff7dcc6da6f4b986e0737944b9955e6158035614 🔍
VirtualSize 0x20c30c0
VirtualAddress 0x8c1000
SizeOfRawData 0x6be00
PointerToRawData 0x8bf800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.59402

.pdata

MD5 3483567ce4b64cb0021dc5dc2c6f91fd 🔍
SHA1 c1cd661fb091404354f69884f7b5a5021bf31087 🔍
SHA256 6f09c98011680d9835c23befe573c4ae3df808c5466347869840d5b8394cdea3 🔍
SHA3 a0ee2bcdbf6e7b98d3b8c4e5140a63ac70818bde37be8b182801abc92ead3d7a 🔍
VirtualSize 0x1aa0c
VirtualAddress 0x2985000
SizeOfRawData 0x1ac00
PointerToRawData 0x92b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.55799

.xdata

MD5 defa0302e152de6b4adf3e24261f6f66 🔍
SHA1 af030bf3e608c45cd9fdfd7de43f89e6d48e85f2 🔍
SHA256 85b5fe75a6013b7fd1d6fd735235de635e2041f3a128db76f3bc08d31b68b337 🔍
SHA3 c0db174358363ccf0d14f0dd3a4eb5c6b1bccd8f180a2aef55e6edafce489853 🔍
VirtualSize 0xb4
VirtualAddress 0x29a0000
SizeOfRawData 0x200
PointerToRawData 0x946200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78173

.idata

MD5 0bd2eec2b9853fa64c7620bbf6dff3af 🔍
SHA1 fcd945f4800bbda9beaf9aaf8f6e45bfe887df18 🔍
SHA256 d7757136a66e0c47791989217c83e6296768b815020cd01f9e65377b31da726b 🔍
SHA3 522e9e3551b40af92a36c2e17d0eff050c2ea738b50c1e5029bbdfcd56faf9f4 🔍
VirtualSize 0x57c
VirtualAddress 0x29a1000
SizeOfRawData 0x600
PointerToRawData 0x946400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.30574

.reloc

MD5 e5d075110cebb4a92eb4775f83dc5752 🔍
SHA1 03aa050af7dac7fe39ad1488da95a7a53ea778b5 🔍
SHA256 8ceaaa3a545b3e49fc3ea8b18be11657243ef06625e193c33968250ded0c3e30 🔍
SHA3 c970f0584629126b99d04a4cce7f3cbd941d38c83ce5522b87c1714526f22e29 🔍
VirtualSize 0x15684
VirtualAddress 0x29a2000
SizeOfRawData 0x15800
PointerToRawData 0x946a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.438

.symtab

MD5 07b5472d347d42780469fb2654b7fc54 🔍
SHA1 943ae54f4818e52409fbbaf60ffd71318d966b0d 🔍
SHA256 3e67f4a7d14b832ff2a2433e9cf0f6f5720821f67148a87c0ee2595a20c96c68 🔍
SHA3 a70a3e18515c06557b62676f2a8eb6d7d41962d8c9c7c49f4641c429cc65b977 🔍
VirtualSize 0x4
VirtualAddress 0x29b8000
SizeOfRawData 0x200
PointerToRawData 0x95c200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0203931

.rsrc

MD5 c563694bd6992c4f3bfb6804e4c45ea4 🔍
SHA1 44e6ed40dfdf709aa49f77e1ded75e3f1c532428 🔍
SHA256 f21d92c6b8733e0b3e9da3d61cd26d0dc996c6e6e09beb4127c75aed17eedaae 🔍
SHA3 6dcd3e889116c5c70b1e1b6aea7d4487fdbfb6cd28b4ff127195efd152a2175f 🔍
VirtualSize 0x12058
VirtualAddress 0x29b9000
SizeOfRawData 0x12200
PointerToRawData 0x95c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.97647

Imports

kernel32.dll GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2f3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.64839
Detected Filetype PNG graphic file
MD5 91b17a69bc0835664d71facefbcaeda7 🔍
SHA1 6c0b9501b0a395f6151efe5dd86031c40b0f543d 🔍
SHA256 9a1ffb756f44a86f4046dbc857f3e44acc4255f11f161a237f86afc582085317 🔍
SHA3 a4430b3a1a20de8ef1f1f328ff6eb348095be882c02c11a07a25e9aa4f1e196e 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4ce
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.82109
Detected Filetype PNG graphic file
MD5 a0dc02605b6800ed54a3b2d1e000a4e3 🔍
SHA1 84792f63bd7ab72394f64be03575232da847b42c 🔍
SHA256 c7696e3a3be991f984d912e53bcb495ab49f34958496b07a935a90b7b65a1acf 🔍
SHA3 5701ef1511aa9a8e81e1f9be83dde9ac439e77cd0d44bec0eb6ea3ea70f3e4c1 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x74e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88672
Detected Filetype PNG graphic file
MD5 5dce8e31e48185c82682e9703f55aba8 🔍
SHA1 8b2b19d6b6e418e9a6fda6e8bc92fee4b88693b3 🔍
SHA256 b64719949efe71244d23f052d496c5f438a6d0ad1a3f39620f3c03b423057c74 🔍
SHA3 6ca2c0ec74d00fecb4ab45ea097c1f87748b303fd3e682da8facef061f5a5da3 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xd64
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93544
Detected Filetype PNG graphic file
MD5 b890a08990182593ecc4c76b3a5f7790 🔍
SHA1 42e089c96ced85e3abda62a1801dd98a4f98f7bb 🔍
SHA256 5275c9c7fc8ce7aca462ad858a88be42cefb49019daafd41cfba8670dedf1a7e 🔍
SHA3 f378e0b5daa4f18f3a0b59e3386f9bc504e882713007ec543111de3670455369 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14d9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9493
Detected Filetype PNG graphic file
MD5 dce185861c5346b944c7fb58b268f10b 🔍
SHA1 864e8453d8fca5400f7b4e13dc8875b245966a60 🔍
SHA256 4b90045d2dc13dbe20ed1c9ef0d673b01080b50794bdcf741c4adeb69a53ce4e 🔍
SHA3 947b80bc0ed6a4be6ff6946ee1098157f886ec81f53d9ea9bc4df2c547d31f0f 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3eb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98504
Detected Filetype PNG graphic file
MD5 5ef85a41f6b31ef983670cebe78fc134 🔍
SHA1 aed7a4c2dc37530b92b51981366f06b2b19eb42d 🔍
SHA256 be6e4ea247a5145c57b4aa908fdcab058a2270325052960b78e96e3538122298 🔍
SHA3 60b5c4e1e2bf97d6765a577fb18da5df64d316dd1575a55a8529d87935b18e67 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xae17
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99127
Detected Filetype PNG graphic file
MD5 acdee8360d62e6da7e2709e4a5ca42f8 🔍
SHA1 d09ddf2a83c954c94b8cf282ae103a0f9767e53a 🔍
SHA256 144ca34d173b486608803fbf99aea640e7d6117e556228868befb70f562f3a77 🔍
SHA3 b2020d2122c717947e852b3f37365e08e0ba49150167406f1835437e0171c74e 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67694
Detected Filetype Icon file
MD5 dd45e2d55f3af4f9f96a7fb1ec037587 🔍
SHA1 94812d2fb131bda9fbb2b4a05b9b110fc441d2e1 🔍
SHA256 f2cb650d54c9457153d0625fc7df9604dc46bd1398cd1ba49b8ae84593368fe3 🔍
SHA3 5eaf275ade495b9355d3c4f9732bb7351d5167a24785dd4b32c8cd677f8f0bd2 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.