5932278437201366239aa80ee196d856b244dc35f8c82b329b1fad2ead74f76e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2025-Sep-17 19:24:40
Detected languages English - United States
Debug artifacts F:\Users\bottom_text\source\repos\GMOD Injector\x64\Release\GMOD Injector_x64.pdb

Plugin Output

Malicious The PE contains functions mostly used by malware. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • WriteProcessMemory
  • OpenProcess
  • VirtualAllocEx
  • CreateRemoteThread
 Possibly launches other programs:
  • system
 Manipulates other processes:
  • Process32First
  • WriteProcessMemory
  • OpenProcess
  • Process32Next
Malicious VirusTotal score: 24/69 (Scanned on 2026-06-17 06:35:55) ALYac: Gen:Variant.Application.Tedy.569
APEX: Malicious
Arcabit: Trojan.Application.Tedy.569
BitDefender: Gen:Variant.Application.Tedy.569
Bkav: W32.Malware.24C5ABA3
CTX: exe.trojan.tedy
CrowdStrike: win/malicious_confidence_100% (W)
DeepInstinct: MALICIOUS
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Application.Tedy.569 (B)
GData: Gen:Variant.Application.Tedy.569
Google: Detected
Lionic: Trojan.Win32.Generic.4!c
McAfeeD: ti!593227843720
MicroWorld-eScan: Gen:Variant.Application.Tedy.569
Microsoft: Trojan:Win32/Yomal!rfn
Paloalto: generic.ml
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!B3378906A472
VIPRE: Gen:Variant.Application.Tedy.569
Varist: W64/ABApplication.SVRZ-0287
alibabacloud: Trojan:Win/Wacatac.B9nj

Hashes

MD5 b3378906a472d4b23d50281b9fe27f77
SHA1 19c649506b568217973c6d6adad6e347aa2c85ae
SHA256 5932278437201366239aa80ee196d856b244dc35f8c82b329b1fad2ead74f76e
SHA3 85dcb641607fd9fa86cf95d2638c8806f2fccd0305d909514ae8e076968c5984
SSDeep 96:2YDj1qMAqRmnBm/93dxHLhfLqsgJBTXUl2USRWQmF48r7kDLXS6mY3Q5tfHSE5S:0BAnWXKVQLi7iLSo3Q5tfHL5
Imports Hash a05ef049802219b937d99b7debd7e4c6

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Sep-17 19:24:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1200
SizeOfInitializedData 0x2200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001610 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x9000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 376e182463113237a10c2106aa1f8c4b
SHA1 19e8a3586ac6285ec6775e2295ebb90abf35aab8
SHA256 be6b9afb8128264a19763468cb9937eb8d68f874fd3ce45ea14d57474e22af07
SHA3 02fdb196509e6949ecaed2d44ee0bdbb3f01a2fd346d8eaf5c37be6e8f58e41c
VirtualSize 0x11dc
VirtualAddress 0x1000
SizeOfRawData 0x1200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.01464

.rdata

MD5 021b1e6af8f2a0b5630f51a70e9c105a
SHA1 89796108ccc1c341d5948fe92342a57c71f9a7ab
SHA256 e513fec460100daa80535f02fe5b8998b9e10cb0e388da18c92bc1136b9742b0
SHA3 5d6aee4b7e3ced1eeb526701100f632f530583707545b6e7dcc875ef910b4b0a
VirtualSize 0x1352
VirtualAddress 0x3000
SizeOfRawData 0x1400
PointerToRawData 0x1600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.25976

.data

MD5 85c2aebd011c5c1b37c1009def59c2b6
SHA1 e6f88330c0bc7698e3f5d77202242a6e10f6e321
SHA256 ab4f194dcbbaf38d8dca700fa10eee22d80c5463d8256b36eb72ed5f7126ba69
SHA3 a5818bd143f172ebe95ef85b8e270e51e0d1ae2330fd892938463b36527155ea
VirtualSize 0x680
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x2a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.53249

.pdata

MD5 4727386ae7ea442fe9c0937237b5a9b9
SHA1 a16d9ed7e4239697d204fa5dd399e7cd62f5d5ee
SHA256 59292ff35ae7f5f9e6f2f43fb49fdf7427292bbda49d4c2489392a98c078fac8
SHA3 41353175b3c9e5bca4126869541ceb9c29f860370748c5c5852e4d39e93f9deb
VirtualSize 0x1a4
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x2c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.21938

.rsrc

MD5 0b35de07beeb30d1d6013cbca2846303
SHA1 c98626ce4d587471d115df6f42cb0f5221f13689
SHA256 c9ed38ed40cfe8c1718cbf78be16bb4aa76b76097a449f9ea315aee9fd20df0d
SHA3 76678b071daa4ec33980be3b819260aea5ade31193b0580e19b41e16156137cf
VirtualSize 0x1e0
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x2e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

.reloc

MD5 0bb9146d1d07958b664c67b112e5e285
SHA1 a92f051024f9e1bd57a774f006beec897fd090ae
SHA256 b21b774130c01f634f124e02491f74198145cad14331e7016594768b2c000a4e
SHA3 09ca4b144e006f652afcd4d4deb2f7e6a845a7b82ad4b6b6b98f119090ca5761
VirtualSize 0x30
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.718005

Imports

KERNEL32.dll Process32First
WriteProcessMemory
GetFullPathNameA
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32Next
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
RtlCaptureContext
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
VCRUNTIME140.dll __C_specific_handler
__current_exception
memset
__current_exception_context
memcpy
api-ms-win-crt-stdio-l1-1-0.dll _set_fmode
__acrt_iob_func
__p__commode
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0.dll _initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
system
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_set_app_type
__p___argc
_c_exit
__p___argv
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_cexit
api-ms-win-crt-filesystem-l1-1-0.dll _access
api-ms-win-crt-string-l1-1-0.dll _stricmp
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Sep-17 19:24:40
Version 0.0
SizeofData 106
AddressOfRawData 0x3664
PointerToRawData 0x1c64
Referenced File F:\Users\bottom_text\source\repos\GMOD Injector\x64\Release\GMOD Injector_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2025-Sep-17 19:24:40
Version 0.0
SizeofData 20
AddressOfRawData 0x36d0
PointerToRawData 0x1cd0

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Sep-17 19:24:40
Version 0.0
SizeofData 644
AddressOfRawData 0x36e4
PointerToRawData 0x1ce4

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2025-Sep-17 19:24:40
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140005000

RICH Header

XOR Key 0xdef74fc3
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 14
Imports (35207) 2
ASM objects (35207) 3
C objects (35207) 10
C++ objects (35207) 19
Imports (33140) 3
Total imports 65
C++ objects (LTCG) (35215) 1
Resource objects (35215) 1
Linker (35215) 1

Errors

Leave a comment

No comments yet.