5bba2dd00ef04cb76adc605e8a9553690f47156e195da0c5a04a85e1697669b2

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-20 00:15:04
CompanyName ACME Teknoloji
FileDescription Knight Evolution
FileVersion 1.0.0.0
InternalName KnightEvolution
LegalCopyright Copyright 2015 ACME Teknoloji
OriginalFilename KnightEvolution.exe
ProductName Knight Evolution
ProductVersion 1.0.0.0

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .retplne
Unusual section name found: _sysc
Unusual section name found: .rAQBca
Unusual section name found: .rAQBcb
Unusual section name found: .rAQBcc
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Uses Microsoft's cryptographic API:
  • CryptAcquireContextA
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 9f34bd4bc7a6119fcf4f82304c767938 🔍
SHA1 0ee15626d83470a71cd09120445e9c0aba996fee 🔍
SHA256 5bba2dd00ef04cb76adc605e8a9553690f47156e195da0c5a04a85e1697669b2 🔍
SHA3 4386cfe22d4a19f424b5e1ae36a84f3be12d04f2245898075dfcc4d5e33a5c5b 🔍
SSDeep 196608:qoUkvp6OEMk3m8yPNOSzsHS8W8CXR/I8FtgDVTJW6jI61gl2+avSCfgNALjwigB:qooPHWz9zX/8Ch/BYrvI6x+avSCfgeL 🔍
Imports Hash 0097f58a1f0a39506a5bf1ae83d385f0 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 14
TimeDateStamp 2026-Sep-20 00:15:04
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xc81200
SizeOfInitializedData 0x29ec00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000018B9E5B (Section: .rAQBcc)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2036000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xc81156
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1e9a14
VirtualAddress 0xc83000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x113c98
VirtualAddress 0xe6d000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x72414
VirtualAddress 0xf81000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.00cfg

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x38
VirtualAddress 0xff4000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x100
VirtualAddress 0xff5000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.retplne

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xc
VirtualAddress 0xff6000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics (EMPTY)

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x9dd
VirtualAddress 0xff7000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x444
VirtualAddress 0xff8000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

_sysc

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1c
VirtualAddress 0xff9000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rAQBca

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x441321
VirtualAddress 0xffa000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.rAQBcb

MD5 33305e849183542a64c31661cdad66e6 🔍
SHA1 245d4a384276264ce2ad7644e0b03fc3874bc02e 🔍
SHA256 8217bb24cd13d6a0efc1a623d93e0bcc353d440461d63d1916bd39fceef5a3a9 🔍
SHA3 e368977ebd9a4e25e29e31531bd5579e05532a7b7c7521ed54b374ebeb833813 🔍
VirtualSize 0x1e2c
VirtualAddress 0x143c000
SizeOfRawData 0x2000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.194475

.rAQBcc

MD5 9696be407f07df422ce13526adb1c0f9 🔍
SHA1 64bc8c1d1bb127d91ae0e55390705fd06b3fc3ca 🔍
SHA256 719b45413909f41be66bed87abdb5c1c30fff7445a5d8f8883b816ecf8cca1d9 🔍
SHA3 2e17990b64a7375f745863a04f2557f10bb3ad522ca2fcd80993f37adc189081 🔍
VirtualSize 0xbdb7a0
VirtualAddress 0x143e000
SizeOfRawData 0xbdb800
PointerToRawData 0x2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.94465

.rsrc

MD5 115f323454ad29770da7cdc0f32eeea0 🔍
SHA1 5a572d4bf6fd4df3010abe7ac7d6994b8e934ed5 🔍
SHA256 bdce1d06aa9703c05b54aea9497b92d2b7000d74f36bc026397119cd9ceca3d8 🔍
SHA3 c0fe408b67393519df8834442c130db701c79d3d29ea9dfe92e480e03ca5af92 🔍
VirtualSize 0x1b1f0
VirtualAddress 0x201a000
SizeOfRawData 0x1b200
PointerToRawData 0xbddc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.64451

Imports

KERNEL32.dll GetVersion
GetVersionExA
GetVersionExW
USER32.dll AdjustWindowRectEx
d3dx9_43.dll D3DXCreateEffect
SHELL32.dll DragAcceptFiles
ADVAPI32.dll CryptAcquireContextA
dbghelp.dll MiniDumpWriteDump
WS2_32.dll WSACleanup
d3d9.dll Direct3DCreate9
GDI32.dll BitBlt
D3DCOMPILER_43.dll D3DCompile
WINMM.dll timeBeginPeriod
IMM32.dll ImmAssociateContext
ole32.dll CoCreateInstance
VERSION.dll GetFileVersionInfoA
OLEAUT32.dll SysFreeString
SETUPAPI.dll SetupDiDestroyDeviceInfoList
KERNEL32.dll (#2) GetVersion
GetVersionExA
GetVersionExW
USER32.dll (#2) AdjustWindowRectEx
KERNEL32.dll (#3) GetVersion
GetVersionExA
GetVersionExW

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0xe77470

NvOptimusEnablement

Ordinal 2
Address 0xe7746c

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.6742
MD5 38e28d4bb2811c4b796745e80e3c1ee0 🔍
SHA1 924740013ccdb2098d098c355f8d0a72bef07c4d 🔍
SHA256 510abcf0408d136ab75cc815a93332e37c8a419f0828405bae14958e69f779fc 🔍
SHA3 1121e0bcdbdf76a2815d934b53e690ce24bc38c33ca0a0c3605e6cea25c9552c 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19974
MD5 859cdcb8a0cc73c3d3fd5ca0a606f10d 🔍
SHA1 48d45914f9c82e648a4ff73f828063de34f7d903 🔍
SHA256 7361e5950c8aea904275eae49bac1b6504f0668694654c7249f27095d146b374 🔍
SHA3 fcbeba1fab8a1a806ebe64a60f2fa5baf7dd4284a75378e02dbaeba1f543ca47 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32756
MD5 046c96a3a78ce30fd4c85a6621fa9c6c 🔍
SHA1 d585932d2cb4be875803c692793aabc02ecbe17b 🔍
SHA256 c8bdf82655ef4fc9f3a34e164968d83785050f1fb89d77ee514d226285ad64b3 🔍
SHA3 5cde5ea91cd49be9cd734797ddcf1ab873f8f36d84b4f3b77cc419985bd89ea0 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8579
MD5 0bb531eb23f7929932c634fa90de0439 🔍
SHA1 691264fc92b95abc17793b237477cf10266f11f3 🔍
SHA256 a1fd0e7767e2bce8bac918c9badcd7fe77ca012bf3e493b6d8cf219478cb8162 🔍
SHA3 73d9f4239eff17f5ef04ff225510ae888096db122d4af43c48b67c49be1013ec 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.6026
MD5 211e85b5512c6497a7c792ec2651090e 🔍
SHA1 799404902a035bc5c9fb4663745bfd63bfba0ed5 🔍
SHA256 aaa5bc8d8deb3db5835bb4122cccbecf984726c71f4b78cb99e765fbc386e5ca 🔍
SHA3 f791b096bf4a645c04ed462ce7be0d6723d28cb457adf0e7a7743931b073155a 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x27ac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93568
Detected Filetype PNG graphic file
MD5 63074bc91ff288f7fbbafe47a26a94c2 🔍
SHA1 c8c92b9d45bacbddf804d65749f61c509e27d823 🔍
SHA256 e27cdd5e3848a22c0127b3bc2c85eca1f1ac5a62a8c7de2d789e0298e3aeb643 🔍
SHA3 7efb1e4c67cba09ddca1d5d368f839fbc80337546880261219e3529c7b28a01f 🔍

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 6c280f14fae589d3a4f16bd14fe900d2 🔍
SHA1 3592d27a40a92b1bfe4f6af30cd40a324d45ba74 🔍
SHA256 cfb51f689e05a6976afd610a02e108816ec036aadf25ed5aef834dcc43d24ead 🔍
SHA3 eb331e3efc28c3027c3b9191949c089cadc3903b2e674f7cf32411f7656916db 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x300
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32115
MD5 915a78192f37b57ad70f977e2b2ad2e9 🔍
SHA1 03d0bf299f33f54275ec90fbdf2760a25e37535a 🔍
SHA256 1b6f2c7f2470820fcd2392f06c41f6b2fe230fb19cb83d1aecf860b62993ee10 🔍
SHA3 c003392bef1bbf5e75183d7bf7d761c67984f351b3a7794b5658bc08af532ba4 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName ACME Teknoloji
FileDescription Knight Evolution
FileVersion (#2) 1.0.0.0
InternalName KnightEvolution
LegalCopyright Copyright 2015 ACME Teknoloji
OriginalFilename KnightEvolution.exe
ProductName Knight Evolution
ProductVersion (#2) 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140e6dec0

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .00cfg has a size of 0! [*] Warning: Section .fptable has a size of 0! [*] Warning: Section .retplne has a size of 0! [*] Warning: Section .tls has a size of 0! [*] Warning: Section _RDATA has a size of 0! [*] Warning: Section _sysc has a size of 0! [*] Warning: Section .rAQBca has a size of 0!
Leave a comment

No comments yet.