48db9ee9914f898cb723e42e4ea16355b4a766e80ac917ed08e90dc1eb58ecc3

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1972-Dec-06 23:41:50
Debug artifacts D:\a\Wand-Enhancer\Wand-Enhancer\WandEnhancer\bin\Release\ILRepack-7056-186111\WandEnhancer.pdb
Comments
CompanyName
FileDescription WandEnhancer
FileVersion 1.0.8.3
InternalName WandEnhancer.exe
LegalCopyright Copyright © 2025
LegalTrademarks
OriginalFilename WandEnhancer.exe
ProductName WandEnhancer
ProductVersion 1.0.8.3
Assembly Version 1.0.8.3

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to security software:
  • rshell.exe
 Looks for VMWare presence:
  • 00:05:69
  • 00:0c:29
  • 00:1c:14
  • 00:50:56
  • vmware
 Looks for VirtualBox presence:
  • 08:00:27
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • api-cdn.wemod.com
  • api.github.com
  • cdn.wemod.com
  • console.info
  • e.metadata.info
  • github.com
  • http://127.0.0.1
  • http://james.newtonking.com
  • http://james.newtonking.com/projects/json
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/expression/blend/2008
  • http://schemas.microsoft.com/winfx/2006/xaml
  • http://schemas.microsoft.com/winfx/2006/xaml/presentation
  • http://schemas.openxmlformats.org
  • http://schemas.openxmlformats.org/markup-compatibility/2006
  • http://www.w3.org
  • http://www.w3.org/1998/Math/MathML
  • http://www.w3.org/1999/xhtml
  • http://www.w3.org/2000/svg
  • http://www.w3.org/2000/xmlns/
  • https://api-cdn.wemod.com
  • https://api-cdn.wemod.com/steam_community
  • https://api.github.com
  • https://api.github.com/repos/k1tbyte/Wand-Enhancer/releases/latest
  • https://api.github.com/repos/k1tbyte/Wand-Enhancer/releases?per_page
  • https://github.com
  • https://www.newtonsoft.com
  • https://www.newtonsoft.com/jsonschema
  • https://www.nuget.org
  • https://www.nuget.org/packages/Newtonsoft.Json.Bson
  • james.newtonking.com
  • metadata.info
  • microsoft.com
  • newtonking.com
  • newtonsoft.com
  • nuget.org
  • openxmlformats.org
  • schemas.microsoft.com
  • schemas.openxmlformats.org
  • wemod.com
  • www.newtonsoft.com
  • www.nuget.org
  • www.w3.org
Suspicious The PE is possibly packed. The PE only has 0 import(s).
Suspicious VirusTotal score: 1/70 (Scanned on 2026-07-19 06:39:57) MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 82153a6991b09eedab178cffd26a3ff6
SHA1 c3f269ba421e7bbd46dad9169625b3e365383dce
SHA256 48db9ee9914f898cb723e42e4ea16355b4a766e80ac917ed08e90dc1eb58ecc3
SHA3 e4ce86292ed9a4a1d56441677b3c8766976ae592f770131b668ef736cc261c01
SSDeep 12288:0j4daUiIgw6CgE8uEolhlrNt2Hy8wbMFOeBgG7Lro8:0jvwv8uEolhlrNPQVBgG7Lro8
Imports Hash d41d8cd98f00b204e9800998ecf8427e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 2
TimeDateStamp 1972-Dec-06 23:41:50
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 8.0
SizeOfCode 0x108e00
SizeOfInitializedData 0x16800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000000000 (Section: ?)
BaseOfCode 0x2000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x124000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x400000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x2000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 93f56cab90d0a4615690e2b33338c32f
SHA1 6e2a066d12c5503a1a5200eb43276402f76cbb4a
SHA256 bfff144335a1cab263b90c3a58e1d97f73cad2a86e86becb06eb80e67e608314
SHA3 cf08902ee9abff91dc2beb84977c0b00e807c0556ccc41c26f984ca9cfc3e3cf
VirtualSize 0x108c6c
VirtualAddress 0x2000
SizeOfRawData 0x108e00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.19958

.rsrc

MD5 252706b585378fa0438fe596c031b8ad
SHA1 7183df4bf0827cc560ba1c7b4942f0ae0bcc9d3c
SHA256 3f8efa2cac8930ccc56ccb0e72dd6373b7e7f4bb238c762fff9a9b219b4d31bb
SHA3 621b8a24fe3775eb260e74b1235fee0570fe588baa45b511f407f4fc67760b0c
VirtualSize 0x167b6
VirtualAddress 0x10c000
SizeOfRawData 0x16800
PointerToRawData 0x109000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.45456

Imports

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x469
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.02428
Detected Filetype PNG graphic file
MD5 d031daceedf9f26d985abc4c4ca8586f
SHA1 ad37bea4f31e64d8afa0eb1d7db9a690cf69718d
SHA256 2a2d744b1611b2a222d2d427dc165265057051494f831fb64b05ada782ca1d6f
SHA3 3149606b31863ae9508afcf1dd14dcf929aa610122f544a3a366c25ca252cc54

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x971
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36619
Detected Filetype PNG graphic file
MD5 4b7df4f19128bd83904d668aff74bb09
SHA1 c6644d9d51a19f8b53e2fc1d1b4fc7860d30023e
SHA256 49f7cd62e6a2912192220786395340a3a0bf83cbb1bae97cca5f2c995fd45aa6
SHA3 0a35762204a10a1f0fd3c00df04a93f4061595ec4e43a97d1357f3a8ec71d185

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x1079
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08393
Detected Filetype PNG graphic file
MD5 1bda69037692e04f396633ea11990a20
SHA1 490208647ab593f890e9c948e8ba9e3c8d6538b4
SHA256 89b4527ed664a52e99fb00e11b28418532b34b316341a26399e9949e740ec68f
SHA3 a10d7abb273fce44c1eea9b6ee68449b3ab0d7d6f0c5e0b3c2eb9108beb0243d

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x40b1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.38562
Detected Filetype PNG graphic file
MD5 dea376b84f9f27c1a0e0d60ef4466464
SHA1 53237d918150c89787f94f23cae9a55771e8cb48
SHA256 00a4470a5e167413646bc8230e9919fd636cc0d3d09df2f4899732cc4af14871
SHA3 8bdf7e34a4b4c518c17ce4962fabc3a6f2cc81078b1141a1db9eca6238d34526

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10143
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.08425
Detected Filetype PNG graphic file
MD5 cab0ef0d6cf933e670e11f7ee695368e
SHA1 07243600ee359ec0aec8f75846f3bd722efa035c
SHA256 0cfd2eaa944211cab5763e4424a11170834a4709f8079e7528a2aa467399222d
SHA3 4d64172439397392c0754ecc1770e8987519e0cc3ab8702bd1eef7611beb2c9f

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.83911
Detected Filetype Icon file
MD5 6211b1808d20c8a1323ed8510dde2723
SHA1 516a12854131f196a2cbe08bf4d75b4b303d519a
SHA256 2d0d3f16be4272435a2a37206e61c9eb57201b25e2a3bb186dddf189fb9ec1ad
SHA3 1464a135ef699dc0e36a1888a4b8c38cf7efc3fd9c508721d22dcf6f1b4d1080

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x33c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32307
MD5 95e1e7a4e3697910184811afa032e1f2
SHA1 5edd9f8d9adcc1342a8fe44c66f65d2d1a0683f5
SHA256 9773fd74a99d29e18479084c45b6c3d5f2ac9d5047e28fe6546d9d0d99a4f574
SHA3 fdb621ed758aceb737a3ac16cfa400296ed8a92c8b7fffdbc0827c8b6d2f9e71

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.8.3
ProductVersion 1.0.8.3
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription WandEnhancer
FileVersion (#2) 1.0.8.3
InternalName WandEnhancer.exe
LegalCopyright Copyright © 2025
LegalTrademarks
OriginalFilename WandEnhancer.exe
ProductName WandEnhancer
ProductVersion (#2) 1.0.8.3
Assembly Version 1.0.8.3
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jun-06 08:00:47
Version 0.0
SizeofData 120
AddressOfRawData 0x10abf4
PointerToRawData 0x108df4
Referenced File D:\a\Wand-Enhancer\Wand-Enhancer\WandEnhancer\bin\Release\ILRepack-7056-186111\WandEnhancer.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.