83343a563f5e7ce012bf3a59308b6970f8a896b8030e8c998582089eed045869

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2022-Mar-30 10:24:34
Detected languages English - United States
CompanyName YoYo Games Ltd
FileDescription Installer for gamemaker.rpg
FileVersion 1.0.0.0
LegalCopyright
ProductName Josiah's Game
ProductVersion 1.0.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Can access the registry:
  • RegCloseKey
  • RegDeleteKeyW
  • RegDeleteValueW
  • RegEnumKeyW
  • RegEnumValueW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCreateKeyExW
  • RegOpenKeyExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Changes object ACLs:
  • SetFileSecurityW
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 23785131 bytes of data starting at offset 0xe600.
The overlay data has an entropy of 7.99959 and is possibly compressed or encrypted.
Overlay data amounts for 99.7531% of the executable.
Malicious VirusTotal score: 3/63 (Scanned on 2026-07-22 10:02:19) Jiangmin: Trojan.Agent.efgm
Microsoft: Trojan:Win32/Wacatac.B!ml
Trapmine: suspicious.low.ml.score

Hashes

MD5 f4ccb6608923d5e8db44c46ba2395525
SHA1 0dc0e0d9ed8f4e00b966297dfa4c6f41fad80ebc
SHA256 83343a563f5e7ce012bf3a59308b6970f8a896b8030e8c998582089eed045869
SHA3 6f639b42fe8f680c39b95b04e77781ee51870514118448d8040bfdbff1cae0a1
SSDeep 393216:f5VvQPx1RWSZK/MPvkb4sgqPP1LDba7AS7ITej9AWdNK/CjondDV421okvhhB3:RSPRW8KUPvkb4sN12tMT8mWDACjI4211
Imports Hash 3f91aceea750f765ef2ba5d9988e6a00

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2022-Mar-30 10:24:34
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x7200
SizeOfInitializedData 0x2d800
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x000036FC (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x9000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 6.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x52000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 3668d67c78869a28f70344e1d8e85519
SHA1 a829b454da851f9ea87fc7cb4a857621b399e7de
SHA256 94098bfe47b45561e717998630c199f610373a68fcf3a50f0baa7d33a9e12ed4
SHA3 8c5e1cbc821add756f54289ef3b5a20a9454aaed954516ce93f48f90ad4a9c3b
VirtualSize 0x7032
VirtualAddress 0x1000
SizeOfRawData 0x7200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.41221

.rdata

MD5 84ed2873bb9ae54d09ef52f1faebfe9e
SHA1 a292ed7164863434abd65d9230144c1d8e96de1d
SHA256 eb77843bc312664ac6595a3b6cac03372d638f073da6c5e8d0ced97df5db7787
SHA3 c428f966c2da8808ae53738a5889086e8bcd4a5e7293bca41d2b49b540ddb7d5
VirtualSize 0x19a2
VirtualAddress 0x9000
SizeOfRawData 0x1a00
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.04078

.data

MD5 d11ee5d02bcd95455113cdebfc4a87a5
SHA1 3d8e9682397b784c42fafa338e9d8dcc2fdf5bfe
SHA256 f5c0e0a3361f886bbf5992ed4ddf8c4a029d3570bffa170fe31ddf7a5e1d986d
SHA3 6288a53aea5131fb60a57317270533181b9e303d2a7a392fc11ef7bc441916c4
VirtualSize 0x2ab00
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.0355

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x16000
VirtualAddress 0x36000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 5ecf00b2c1883eb46cff996699ce5e0a
SHA1 57589bafd841c463c92c2bae591d371459158f05
SHA256 c9e5066914028b5fabf380f24cda558e3d14d58bc5ebcc5a3218bd78cde5b59c
SHA3 5e8ecd7051065ac8a3501a36af4322fdf1382b5976d6994d206e8a78aab89756
VirtualSize 0x52d0
VirtualAddress 0x4c000
SizeOfRawData 0x5400
PointerToRawData 0x9200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.56164

Imports

ADVAPI32.dll RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
SetFileSecurityW
RegCreateKeyExW
RegOpenKeyExW
SHELL32.dll ShellExecuteExW
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderLocation
ole32.dll OleInitialize
OleUninitialize
CoTaskMemFree
IIDFromString
CoCreateInstance
COMCTL32.dll #17
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
USER32.dll DispatchMessageW
wsprintfA
SystemParametersInfoW
SetClassLongW
GetWindowLongW
GetSysColor
ScreenToClient
SetCursor
GetWindowRect
TrackPopupMenu
AppendMenuW
EnableMenuItem
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
CreateWindowExW
GetClassInfoW
PeekMessageW
CallWindowProcW
GetMessagePos
CharNextW
ExitWindowsEx
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
LoadImageW
FindWindowExW
SetWindowLongW
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutW
SendMessageW
wsprintfW
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextW
DefWindowProcW
SetDlgItemTextW
GetDlgItemTextW
CharNextA
MessageBoxIndirectW
RegisterClassW
CharPrevW
LoadCursorW
GDI32.dll SetBkMode
CreateBrushIndirect
GetDeviceCaps
SelectObject
DeleteObject
SetBkColor
SetTextColor
CreateFontIndirectW
KERNEL32.dll WriteFile
GetLastError
WaitForSingleObject
GetExitCodeProcess
GetTempFileNameW
CreateFileW
CreateDirectoryW
WideCharToMultiByte
lstrlenW
lstrcpynW
GlobalLock
GlobalUnlock
CreateThread
GetDiskFreeSpaceW
CopyFileW
GetVersionExW
GetWindowsDirectoryW
ExitProcess
GetCurrentProcess
CreateProcessW
GetTempPathW
SetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
GetTickCount
GetFileSize
MultiByteToWideChar
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
lstrcmpiW
lstrcmpW
MulDiv
GlobalFree
GlobalAlloc
LoadLibraryExW
GetModuleHandleW
FreeLibrary
Sleep
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesW
ReadFile
GetShortPathNameW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CompareFileTime
SearchPathW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
RemoveDirectoryW
GetSystemDirectoryW
MoveFileExW
GetModuleHandleA
GetProcAddress
lstrcmpiA
lstrcpyA
lstrcatW
SetErrorMode

Delayed Imports

110

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x666
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.82633
MD5 b6bf70baab40fe438feff063bfb9ff6f
SHA1 7d4659d43e08d368ddacd31945872461c0b06253
SHA256 0e90a9e4b8f3a5bf990e8aadfd8096ad7aeaf1a4e032ac7b6395ce191d61c142
SHA3 cab98fabaf20118d9a8a4d2bcff4383a7291a0e04ff11a8690e71eed619c75e7
Preview

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92603
MD5 f69bf9e15ad85a626f432245d8345728
SHA1 01bd2c08a23347618ec404714aa2a0f2bda7a0fd
SHA256 8333bb1da43d0227b4de2b64737f4e7ee22af6c8758d3068dd381e18171c45f2
SHA3 78249cdf29d658e0ec72496192c09e186fb2b7414a84e274b2d98f024b7c2381

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34487
MD5 e65c7d107384cb9438db5849fe589441
SHA1 789a3ca254a9602fd24b1d0249796ddb1e14fdcf
SHA256 e032c0635a6a3657f89c4634f4a979448faa7a71a54e040be40d04117dcb926f
SHA3 67587e6a846d51ed15185c8b6e96d18ec144165cc274e034b14c93f64f295b2b

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.35704
MD5 3632c122eb0848a3a08717942ab900d3
SHA1 bb156d9ba4bb405bc661ea4d35c4b0f6dd004c41
SHA256 46fc8ea72205fb0ec74703ce70dfcce970c258c09e3ab7449f14e6a4da381676
SHA3 009f4afd01daac39e54fafe4d13d7c556215936746d1cc83c26cd650d1d2ae98

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71813
MD5 a69caf66f3f899403f8b25b02dc61908
SHA1 3e5db9186cf0f75be24676462d88170e5950d9c8
SHA256 7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50
SHA3 1eea945e3712b317143e07560f54b0b9a13b1fd6c2b57cab9176181a9aaf4f79

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff

104

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.70411
MD5 9bf5ce4f6c93b09e4f5659e204c7ef69
SHA1 70260f4f07476e289d4f0da08f6ea81edf377c05
SHA256 4978808cfa3a9f541262585edca9b87268d2025e637f7254b269cef216b39a79
SHA3 006381732c2dfc87ce25f0b93f7446bbeb1549e901e375f8a720af89e0ef211a

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67385
MD5 d1a92272fbd597e1aa19021483110d5a
SHA1 9f75072682b37c6c52361d8c988ebd06dd003f63
SHA256 15663576584c947d634dab9848defcc7d8f05eb0b7e7c6d52d81eca695fc7a6e
SHA3 704756797695ae34f6fae500852bca70e5066a1d1993348fe40ccf626235d0d6

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x30
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.45849
Detected Filetype Icon file
MD5 9e775238925cc4069614be7eb39f3be8
SHA1 369a5c1124fb26493ca45cc142f446cf2440b8f5
SHA256 e8e7c0ff062a72a1341bae28972decbd6bb7f9f04e84c34a186c87ca8e29eb2f
SHA3 12fb17703532745212aa3b17f36ef25a55fba0d80da0b71c740421d546062ea3

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x244
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23539
MD5 4b9c78e60dd42f6a6cb9745010b6a1ea
SHA1 34241b563a2ab05e8a33d8730e7ed1bf2a8ca5e3
SHA256 e31870f73c152b9b7c7a34af938457820c223aa52db5866f3fc911d14170d18b
SHA3 b9de68ab341b6e5a43d709b136af23afb4ac43aaf96e576bf1cc202ade83150e

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x439
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29429
MD5 abe20cd034a940d331a7bcdefb551b8c
SHA1 f33ba68d8e336c1124e56a966dbb7a4e0ecbea31
SHA256 7d057092023135b9be659837a452fe0a698b8e41cead35fec5e028913490978b
SHA3 3dcf0ab4934fdd5eb1ae639ee171f983489f616b74c702d85a0207e4f2d35406

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName YoYo Games Ltd
FileDescription Installer for gamemaker.rpg
FileVersion (#2) 1.0.0.0
LegalCopyright
ProductName Josiah's Game
ProductVersion (#2) 1.0.0.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x6fa9248f
Unmarked objects 0
C objects (29395) 2
C objects (CVTCIL) (29395) 1
Imports (29395) 15
Total imports 165
C objects (VS2019 Update 11 (16.11.11) compiler 30141) 11
Resource objects (VS2019 Update 11 (16.11.11) compiler 30141) 1
Linker (VS2019 Update 11 (16.11.11) compiler 30141) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.