5313618d93640bb29b66baadf2339de85e593a51715290dadece6d58e039a75e
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1970-Jan-01 00:00:00 |
| Detected languages |
English - United States
|
| TLS Callbacks | 1 callback(s) detected. |
| Comments | |
| CompanyName | |
| FileDescription | |
| FileVersion | 6.3.0.0 |
| InternalName | |
| LegalCopyright | |
| LegalTrademarks | |
| OriginalFilename | |
| ProductName | |
| ProductVersion |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: | Uses known Mersenne Twister constants |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Cheat Engine EZ
Issuer: GlobalSign GCC R45 EV CodeSigning CA 2020 |
| Suspicious | VirusTotal score: 1/69 (Scanned on 2026-05-03 23:56:34) | Webroot: W32.Hack.Tool |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 3.0 |
| SizeOfCode | 0x3cd00 |
| SizeOfInitializedData | 0x2a04 |
| SizeOfUninitializedData | 0x2d44 |
| AddressOfEntryPoint | 0x00001830 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x3e000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 1.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x63000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x71b1b |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x1000000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.data
.rdata
.bss
.CRT
.idata
.rsrc
Imports
| kernel32.dll |
GetStdHandle
GetConsoleMode TlsGetValue GetLastError SetLastError RaiseException ExitProcess GetStartupInfoA GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetCurrentProcess ReadProcessMemory GetModuleFileNameA GetModuleHandleA WriteFile ReadFile CloseHandle SetFilePointer SetEndOfFile GetSystemInfo LoadLibraryW LoadLibraryA GetProcAddress FreeLibrary FormatMessageW CreateFileW GetFileAttributesW GetCurrentDirectoryW GetFullPathNameW GetConsoleOutputCP GetOEMCP GetProcessHeap HeapAlloc HeapFree TlsAlloc TlsSetValue CreateThread ExitThread LocalAlloc LocalFree Sleep SuspendThread ResumeThread TerminateThread WaitForSingleObject SetThreadPriority GetThreadPriority GetCurrentThread OpenThread IsDebuggerPresent CreateEventA ResetEvent SetEvent InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection MultiByteToWideChar WideCharToMultiByte GetACP GetConsoleCP RtlUnwind EnumResourceTypesA EnumResourceNamesA EnumResourceLanguagesA FindResourceA FindResourceExA LoadResource SizeofResource LockResource FreeResource GetWindowsDirectoryA GetVersionExA CompareStringA GetLocaleInfoA GetDateFormatA EnumCalendarInfoA GetModuleFileNameW GetCommandLineW CompareStringW GetLocaleInfoW GetDateFormatW FindFirstFileExW VirtualFree DeviceIoControl FindClose GetLocalTime GetCPInfo GetThreadLocale SetThreadLocale GetUserDefaultLCID |
|---|---|
| oleaut32.dll |
SysAllocStringLen
SysFreeString SysReAllocStringLen SafeArrayCreate SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElement SafeArrayPutElement SafeArrayPtrOfIndex VariantChangeTypeEx VariantClear VariantCopy VariantInit |
| user32.dll |
MessageBoxA
CharUpperBuffW CharLowerBuffW CharUpperA CharUpperBuffA CharLowerA CharLowerBuffA MessageBoxW GetSystemMetrics MessageBeep |
| shell32.dll |
ShellExecuteW
|
Delayed Imports
1
MAINICON
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 6.3.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| Comments | |
| CompanyName | |
| FileDescription | |
| FileVersion (#2) | 6.3.0.0 |
| InternalName | |
| LegalCopyright | |
| LegalTrademarks | |
| OriginalFilename | |
| ProductName | |
| ProductVersion (#2) |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
| StartAddressOfRawData | 0x400000 |
|---|---|
| EndAddressOfRawData | 0x400000 |
| AddressOfIndex | 0x440a00 |
| AddressOfCallbacks | 0x44f000 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x004017B0
|
Load Configuration
RICH Header
Errors
[*] Warning: Section .bss has a size of 0!
Leave a comment
No comments yet.