Manalyze report for 92fad5dc4f3d1e1d730f69fd9422f16ca297de50e99979cdb15da9227d291784

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Aug-18 17:03:56
Detected languages	English - United States
TLS Callbacks	2 callback(s) detected.

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: http://www.roblox.com http://www.roblox.com/Asset/?id https://git.jonah.cool https://git.jonah.cool/jonah/roblox-dumper roblox.com www.roblox.com`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot FindWindowA` `Code injection capabilities (PowerLoader): FindWindowA GetWindowLongA` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: Process32FirstW Process32NextW`
Malicious	VirusTotal score: 3/71 (Scanned on 2026-09-03 14:12:27)	`CrowdStrike: win/malicious_confidence_60% (D)` `Microsoft: Trojan:Win32/Wacatac.B!ml` `TrellixENS: Artemis!EFBF25FA621A`

Hashes

MD5	`efbf25fa621a1b31a95d4cc58d249a77` 🔍
SHA1	`e12f5e080f31a7c1f7259d6c9233007d86c1d8f1` 🔍
SHA256	`92fad5dc4f3d1e1d730f69fd9422f16ca297de50e99979cdb15da9227d291784` 🔍
SHA3	`85e9c495baa95ecf3fabcc516e5025c69176a80caed35ce0c67d25e54f025c62` 🔍
SSDeep	`24576:oIqnbjm0RyTs/9aXnQLRJA14O6uQcB8KzATRSZutYsFh0lhSMXlgk0nMr:oIgR6XnQL79mutaV` 🔍
Imports Hash	`2a9798b07fffdc17c2e76c0fa1670729` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Aug-18 17:03:56
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0xeca00`
SizeOfInitializedData	`0xbf400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000BD658 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x1b0000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`edc4ce9c8bf1317cecfe3e7e51a167a1 🔍`
SHA1	`f9ac287706230d9fc3926473005bae98d67815d8 🔍`
SHA256	`4c31ff86c4b0bdff1539cb4226d22c319429ed82153895a89f27f976d95fa361 🔍`
SHA3	`f81eefbbc2c80eca068212fe28d3babb6e58955d71376dcf5d689b1831ff7048 🔍`
VirtualSize	`0xec87c`
VirtualAddress	`0x1000`
SizeOfRawData	`0xeca00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.41988`

.rdata

MD5	`ef689e0e854162f5cd8191b47922d397 🔍`
SHA1	`8813a1c271af41f523a6f7faf21cc2270ff3ba4d 🔍`
SHA256	`c68a5d974d36d02a628d081ce0465e2d8b6fd441c8c93740bd56999751ae0efa 🔍`
SHA3	`49f05de0595607f2b68133302908317e20243b3bfa27b56dbbb039b69b046857 🔍`
VirtualSize	`0xa9d28`
VirtualAddress	`0xee000`
SizeOfRawData	`0xa9e00`
PointerToRawData	`0xece00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.45603`

.data

MD5	`f5c64481c8fc8e5e7c377c001729cad3 🔍`
SHA1	`f6a72822737740f772fb533d9e7887006c046a20 🔍`
SHA256	`eb0189b405f4f6cd2a46105d60b780c7cffeb8d29e713c3672605b19a39fb473 🔍`
SHA3	`1a5071353f1b12867a98f1b439974788f96191fd1c70bf0aee09552a54159e85 🔍`
VirtualSize	`0xaa8c`
VirtualAddress	`0x198000`
SizeOfRawData	`0x9200`
PointerToRawData	`0x196c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.54072`

.pdata

MD5	`b82785d64a7eaf01e01e6783bb3ceb6d 🔍`
SHA1	`d56a45e7e0c74512bfcd1a093b4fe0a9badfce3b 🔍`
SHA256	`1cce12e8f5968d7869c19aff372866e0d3b30af369df2a925cf6d4e7e14a0916 🔍`
SHA3	`68f750a5446e509534f863411fe9ec218c96346e2ae46999520b41ab16825500 🔍`
VirtualSize	`0x8a30`
VirtualAddress	`0x1a3000`
SizeOfRawData	`0x8c00`
PointerToRawData	`0x19fe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.02052`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x1ac000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1a8a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`1e15f7e6a35fcc9e47431da6f0af6577 🔍`
SHA1	`39167f50595e8c4d6aa011071b510dd78602c0fd 🔍`
SHA256	`6a4f3629b2b8837f4193ccfe44c2c1725d60ca0d0007f064314f96f87cf0b96d 🔍`
SHA3	`31d249d7cd4238689af1b979b173731fbdf6f126e97b9801c679b8b67b9bd7f9 🔍`
VirtualSize	`0x1e0`
VirtualAddress	`0x1ad000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1a8c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.71768`

.reloc

MD5	`9bc2cdea815e38c769f265d86f1f24a5 🔍`
SHA1	`158460b2dfbf6fa70fcb19bf395d43b3f82e3640 🔍`
SHA256	`ae2696c0336d8887865058909d8eb92bfd2214723b313409c910007f305932eb 🔍`
SHA3	`3584531e1abd93f7f82c184c9dc640a83b808c428af92eefbcef8eb21d6cc044 🔍`
VirtualSize	`0x192c`
VirtualAddress	`0x1ae000`
SizeOfRawData	`0x1a00`
PointerToRawData	`0x1a8e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.65213`

Imports

KERNEL32.dll	`GetProcAddress` `VirtualQueryEx` `CloseHandle` `GetModuleHandleA` `CreateToolhelp32Snapshot` `Process32FirstW` `Process32NextW` `Module32FirstW` `WriteConsoleW` `FlushFileBuffers` `Sleep` `GetCurrentProcessId` `GetCurrentThreadId` `GetDynamicTimeZoneInformation` `GetStdHandle` `WriteFile` `GetConsoleMode` `WriteConsoleA` `GetConsoleScreenBufferInfo` `SetConsoleTextAttribute` `SetEndOfFile` `HeapSize` `GetProcessHeap` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetOEMCP` `GetACP` `IsValidCodePage` `GetLastError` `WaitForSingleObjectEx` `GetExitCodeThread` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `TryAcquireSRWLockExclusive` `WideCharToMultiByte` `QueryPerformanceCounter` `QueryPerformanceFrequency` `GetSystemTimePreciseAsFileTime` `SleepConditionVariableSRW` `LocalFree` `FormatMessageA` `GetLocaleInfoEx` `GetCurrentDirectoryW` `CreateDirectoryW` `FindClose` `FindFirstFileExW` `FindNextFileW` `GetFullPathNameW` `AreFileApisANSI` `GetModuleHandleW` `MultiByteToWideChar` `RtlPcToFileHeader` `RaiseException` `WakeConditionVariable` `WakeAllConditionVariable` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `EncodePointer` `DecodePointer` `CompareStringEx` `GetCPInfo` `LCMapStringEx` `GetStringTypeW` `SetUnhandledExceptionFilter` `GetStartupInfoW` `GetSystemTimeAsFileTime` `InitializeSListHead` `RtlLookupFunctionEntry` `RtlUnwindEx` `SetLastError` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `CreateThread` `ExitThread` `FreeLibrary` `FreeLibraryAndExitThread` `GetModuleHandleExW` `SetStdHandle` `GetFileType` `CreateFileW` `GetDriveTypeW` `GetFileInformationByHandle` `PeekNamedPipe` `SystemTimeToTzSpecificLocalTime` `FileTimeToSystemTime` `IsProcessorFeaturePresent` `GetCurrentProcess` `ExitProcess` `TerminateProcess` `GetModuleFileNameW` `GetCommandLineA` `GetCommandLineW` `RtlCaptureContext` `RtlVirtualUnwind` `IsDebuggerPresent` `UnhandledExceptionFilter` `HeapFree` `HeapAlloc` `VirtualProtect` `LoadLibraryExW` `GetDateFormatW` `GetTimeFormatW` `CompareStringW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `GetUserDefaultLCID` `EnumSystemLocalesW` `HeapReAlloc` `GetConsoleOutputCP` `ReadFile` `GetFileSizeEx` `SetFilePointerEx` `ReadConsoleW` `GetTimeZoneInformation` `RtlUnwind`
USER32.dll	`EnumWindows` `FindWindowA` `GetWindowLongA` `GetWindowThreadProcessId` `GetClientRect` `IsWindowVisible` `GetWindowPlacement` `MessageBoxA` `AdjustWindowRectEx`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Aug-18 17:03:56
Version	`0.0`
SizeofData	`1132`
AddressOfRawData	`0x184b9c`
PointerToRawData	`0x18399c`

TLS Callbacks

StartAddressOfRawData	`0x140185050`
EndAddressOfRawData	`0x1401851a1`
AddressOfIndex	`0x1401a1ee8`
AddressOfCallbacks	`0x1400ee658`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES`
Callbacks	`0x00000001400BD7A0` `0x00000001400BD66C`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1401982c0`

RICH Header

XOR Key	`0x463b1c41`
Unmarked objects	`0`
C++ objects (33145)	`189`
C objects (33145)	`19`
ASM objects (33145)	`7`
ASM objects (35403)	`10`
C objects (35403)	`17`
C++ objects (35403)	`101`
Imports (33145)	`5`
Total imports	`162`
C objects (35729)	`5`
C++ objects (35729)	`59`
Resource objects (35729)	`1`
Linker (35729)	`1`

Errors

Leave a comment

No comments yet.