Manalyze report for 7d2e07a21bdc99a307ba0750c8a907c5dc95a0b472650a637809e9351834a196

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2022-Aug-19 10:45:25
Detected languages	English - United States
Debug artifacts	X:\gta5\src\dev_ng\rage\script\tools\scriptcompiler\win64_beta_2012\sc_2012.pdb

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: cmd.exe`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to AES`
Suspicious	The PE is possibly packed.	`Unusual section name found: .text.sy`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: LoadLibraryW LoadLibraryExW GetProcAddress` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Can access the registry: RegCreateKeyExA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCloseKey` `Possibly launches other programs: CreateProcessA` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Manipulates other processes: EnumProcessModules`
Malicious	VirusTotal score: 4/71 (Scanned on 2024-01-30 20:15:20)	`Bkav: W64.AIDetectMalware` `Cynet: Malicious (score: 100)` `Gridinsoft: Trojan.Heur!.02892023` `Skyhigh: BehavesLike.Win64.Dropper.fh`

Hashes

MD5	`3146a21d3e30c62c972fbadfd0fa9784` 🔍
SHA1	`13b4d0fe3f8185d91ff5a33158f20c2c3f2a7fca` 🔍
SHA256	`7d2e07a21bdc99a307ba0750c8a907c5dc95a0b472650a637809e9351834a196` 🔍
SHA3	`f0ba07988407cd21b1aef2a190379280fd81c22a69c8c78b7d7d5a58c9161fc2` 🔍
SSDeep	`12288:oaNWWyY88viZIcy4w2J/ApBlllUQv6iFTXpLNjJLFla1DhjK39d:PyY886ZZwYAXluQvJTXJGJm` 🔍
Imports Hash	`6b78d888c9a01e49b7131e8791177401` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`8`
TimeDateStamp	2022-Aug-19 10:45:25
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`11.0`
SizeOfCode	`0x6e200`
SizeOfInitializedData	`0xa0c9e00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000044588 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`5.2`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xa13d000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x1000000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`cb5a499d48c3c253d515ff53e938a398 🔍`
SHA1	`a3c5b4efc1ffd5527200ba1303712e4acb4ab83e 🔍`
SHA256	`ac508ed97bf022284a97853730b5c9dd1e70c65e963428100f32fe1e64ea99dc 🔍`
SHA3	`9b1a87658a2b7f9a1dbf21cfe62f7114caf94095087526111ea36ab27f78a5fa 🔍`
VirtualSize	`0x6deef`
VirtualAddress	`0x1000`
SizeOfRawData	`0x6e000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.46758`

.text.sy

MD5	`f100287d50ebec495523bc2f22791fc9 🔍`
SHA1	`8ce1ca8164584d78d95d6aa018b8859d1fd8b9e4 🔍`
SHA256	`c9bfc929fb3541eb37fb574248ebc606bc12394c2d25e7587668e84c80e26a47 🔍`
SHA3	`fe0686846be33128a1d22b2bb7d7394109977db8c2fc7d81306281e790b6dc47 🔍`
VirtualSize	`0x89`
VirtualAddress	`0x6f000`
SizeOfRawData	`0x200`
PointerToRawData	`0x6e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`1.15813`

.rdata

MD5	`98748c91fdab60072f9d0452c981b824 🔍`
SHA1	`302791f32027a855732eb7a52147b9937a74fa1c 🔍`
SHA256	`781468b7dd3b425990581d76380cc141015dabc27b0b86ab4ebf06ea34aeaf95 🔍`
SHA3	`12ea19d421738faf92ca444169715f15fe6131cb7202125ad737b6fc878e9f44 🔍`
VirtualSize	`0x3462b`
VirtualAddress	`0x70000`
SizeOfRawData	`0x34800`
PointerToRawData	`0x6e600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.69589`

.data

MD5	`831a70a3a5137662fa8c85758bc99cf4 🔍`
SHA1	`1fdaeb04d9e9b3ee6909e0c77ef8ac7e35dc302a 🔍`
SHA256	`6f7508dcfaee18ef7f153d9edf6b3dd0447cb01d99af48e5b2d174eebdaa28b2 🔍`
SHA3	`31523adf4e1dcb441eab9f49fd39a6ef49a9cc6391186e53c7ee5508c9a6a9d7 🔍`
VirtualSize	`0xa07cc00`
VirtualAddress	`0xa5000`
SizeOfRawData	`0x3ee00`
PointerToRawData	`0xa2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.88522`

.pdata

MD5	`9c62f539617c76021fdfdf0bf24f2b64 🔍`
SHA1	`a4908444dec30a3f3fed9e846ab43507ddb13916 🔍`
SHA256	`87eb40aa3f8540fdafcb4036b75a029151cbf9d9846b7888ece4063900f8ae92 🔍`
SHA3	`07018fa9f0b19676894701ddfb1c04a4ee4fbeabccc57bfd36724dc007e81dcb 🔍`
VirtualSize	`0x55d4`
VirtualAddress	`0xa122000`
SizeOfRawData	`0x5600`
PointerToRawData	`0xe1c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.89826`

.tls

MD5	`882921db7e8f46f507b42479af5576a6 🔍`
SHA1	`efca0755b65c3d7af927c284031b37dbecc7d47a 🔍`
SHA256	`5fa52db05a28c03c8a2dfabfb820b2dbeda0dec5d717de18980a7d16e3b2724e 🔍`
SHA3	`549e8e1a93248e51729f3acf5201454a56ce1ad42faaf265b990c65011c4dc62 🔍`
VirtualSize	`0x11ea`
VirtualAddress	`0xa128000`
SizeOfRawData	`0x1200`
PointerToRawData	`0xe7200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.0238955`

.rsrc

MD5	`2e358e299e01f32040847d81ef0223e1 🔍`
SHA1	`64bf5bbfa0fc6cf7795ab5fa9dc70927c6fbca88 🔍`
SHA256	`f611e6cf82f9c0df1b5a2ddda37b458765164f12e1be48a5800548a4a95daae5 🔍`
SHA3	`638447afbac8686f3d95f6507885fb1f058e0b91cbe565f94142efad0484b4e3 🔍`
VirtualSize	`0x1e0`
VirtualAddress	`0xa12a000`
SizeOfRawData	`0x200`
PointerToRawData	`0xe8400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.72439`

.reloc

MD5	`aa4f8c952144937162e31a89cf408102 🔍`
SHA1	`0e2b7c6f63f0c96ca76564452d0b5ac34f1bb30e 🔍`
SHA256	`8cd86ce1948e5437109ea58455b81650b56c83f5a59f5ddb10bf0ff4c4e8793e 🔍`
SHA3	`cceaa218840a4c3112eed0adc9f0d689ec39a1b2215842650ffbf6d7544586e5 🔍`
VirtualSize	`0x11e14`
VirtualAddress	`0xa12b000`
SizeOfRawData	`0x12000`
PointerToRawData	`0xe8600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`1.07827`

Imports

KERNEL32.dll	`ResumeThread` `SetEvent` `ReleaseSemaphore` `WaitForSingleObject` `Sleep` `CloseHandle` `CreateEventA` `CreateSemaphoreA` `GetModuleHandleA` `VirtualFree` `VirtualProtect` `HeapAlloc` `HeapFree` `GetProcessHeap` `GetCurrentProcessId` `IsDebuggerPresent` `SetEnvironmentVariableA` `WerSetFlags` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionAndSpinCount` `TryEnterCriticalSection` `DeleteCriticalSection` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RtlCaptureStackBackTrace` `OpenThread` `GetThreadContext` `SuspendThread` `GetModuleHandleExA` `CreateToolhelp32Snapshot` `Thread32First` `Thread32Next` `SetUnhandledExceptionFilter` `GetLocalTime` `GetEnvironmentVariableA` `CreateDirectoryA` `CreateFileA` `FormatMessageA` `WriteFile` `ReadFile` `SetEndOfFile` `SetFilePointerEx` `FindClose` `SetFileTime` `CreateDirectoryW` `RemoveDirectoryW` `CreateFileW` `SetFileAttributesW` `GetFileAttributesW` `GetFileAttributesExW` `DeleteFileW` `FindFirstFileW` `FindNextFileW` `MoveFileExW` `MultiByteToWideChar` `WideCharToMultiByte` `GetLastError` `GlobalAlloc` `GlobalLock` `GlobalUnlock` `LocalAlloc` `LocalLock` `LocalUnlock` `LocalFree` `MulDiv` `GetModuleFileNameA` `GetVersionExA` `SetStdHandle` `LoadLibraryW` `OutputDebugStringW` `CreateProcessA` `GetExitCodeProcess` `LCMapStringW` `CompareStringW` `GetStringTypeW` `HeapReAlloc` `SetFilePointer` `ReadConsoleW` `LoadLibraryExW` `GetTimeZoneInformation` `GetConsoleMode` `GetConsoleCP` `FlushFileBuffers` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetModuleFileNameW` `GetFileType` `GetModuleHandleW` `GetStartupInfoW` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `UnhandledExceptionFilter` `RtlVirtualUnwind` `RtlCaptureContext` `SetLastError` `GetCPInfo` `GetOEMCP` `GetACP` `IsValidCodePage` `WriteConsoleW` `HeapSize` `AreFileApisANSI` `GetModuleHandleExW` `GetSystemTimeAsFileTime` `IsProcessorFeaturePresent` `RtlUnwindEx` `RtlLookupFunctionEntry` `RtlPcToFileHeader` `DecodePointer` `EncodePointer` `SetThreadPriorityBoost` `SetThreadPriority` `GetThreadId` `GetCurrentThreadId` `CreateThread` `RaiseException` `VirtualQuery` `GetProcAddress` `SetConsoleTextAttribute` `OutputDebugStringA` `GetStdHandle` `TerminateProcess` `ExitProcess` `GetCurrentProcess` `GetCommandLineA` `GetProcessAffinityMask` `VirtualAlloc`
USER32.dll	`LoadStringA` `DestroyIcon` `LoadIconA` `GetLastActivePopup` `GetClassNameA` `GetParent` `SetRect` `FillRect` `GetSysColor` `RedrawWindow` `IsDialogMessageA` `BeginPaint` `SetForegroundWindow` `DrawTextA` `DrawIcon` `EnableWindow` `KillTimer` `SetTimer` `MessageBoxW` `DestroyWindow` `SetWindowPos` `SendMessageA` `GetMonitorInfoA` `MonitorFromPoint` `EndPaint` `WinHelpA` `ShowWindow` `MessageBoxA` `TranslateMessage` `DispatchMessageA` `PeekMessageA` `PostQuitMessage` `GetActiveWindow` `GetAsyncKeyState` `EmptyClipboard` `CreateWindowExA` `GetSystemMetrics` `GetSystemMenu` `EnableMenuItem` `GetClientRect` `GetWindowRect` `GetWindowLongPtrA` `SetWindowLongPtrA` `WaitMessage` `SystemParametersInfoA` `SetClipboardData` `CloseClipboard` `OpenClipboard` `GetDialogBaseUnits` `CheckDlgButton` `GetDlgItem` `CreateDialogIndirectParamA` `MoveWindow` `FlashWindowEx` `IsWindow` `MessageBeep` `GetWindowTextA` `SetWindowTextA` `SetFocus`
GDI32.dll	`SetTextColor` `SetBkColor` `SelectObject` `GetTextExtentPoint32A` `DeleteDC` `CreateSolidBrush` `CreateDCA` `CreateFontIndirectA` `DeleteObject`
ADVAPI32.dll	`RegCreateKeyExA` `RegOpenKeyExA` `RegSetValueExA` `RegQueryValueExA` `RegCloseKey`
WINMM.dll	`timeBeginPeriod` `timeGetTime` `timeEndPeriod`
PSAPI.DLL	`GetModuleBaseNameA` `EnumProcessModules` `GetModuleInformation`
dbghelp.dll	`SymGetModuleBase64` `SymFunctionTableAccess64` `SymSetOptions` `StackWalk64` `SymInitialize` `SymFromAddr` `MiniDumpWriteDump` `SymGetLineFromAddr64`
WS2_32.dll	`gethostname` `gethostbyname` `socket` `setsockopt` `send` `recv` `listen` `WSAStartup` `htons` `getsockname` `ioctlsocket` `connect` `closesocket` `bind` `accept` `WSACleanup` `inet_addr` `WSAGetLastError`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2022-Aug-19 10:45:25
Version	`0.0`
SizeofData	`104`
AddressOfRawData	`0x982d8`
PointerToRawData	`0x968d8`
Referenced File	X:\gta5\src\dev_ng\rage\script\tools\scriptcompiler\win64_beta_2012\sc_2012.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2022-Aug-19 10:45:25
Version	`0.0`
SizeofData	`16`
AddressOfRawData	`0x98340`
PointerToRawData	`0x96940`

TLS Callbacks

StartAddressOfRawData	`0x14a128000`
EndAddressOfRawData	`0x14a1291e9`
AddressOfIndex	`0x14a11f6f4`
AddressOfCallbacks	`0x1400711b0`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x70`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1400b8040`

RICH Header

XOR Key	`0x9f1ef8d5`
Unmarked objects	`0`
C objects (VS2008 SP1 build 30729)	`1`
Unmarked objects (#2)	`1`
C objects (VS2013 UPD4 build 31101)	`4`
C++ objects (50929)	`65`
C objects (50929)	`188`
ASM objects (50929)	`20`
Imports (VS2008 SP1 build 30729)	`21`
Total imports	`291`
C objects (VS2012 UPD4 build 61030)	`2`
C++ objects (VS2012 UPD4 build 61030)	`139`
Resource objects (VS2012 UPD4 build 61030)	`1`
Linker (VS2012 UPD4 build 61030)	`1`

Errors

Leave a comment

No comments yet.