947473c9cbe8bc1267519e92f3433ab35357285398309d65427763b2779d0fc4

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Apr-11 17:22:42
Detected languages English - United States
Debug artifacts D:\Developments\Games\SmartSteamEmu\x64\Release\SmartSteamLoader_x64.pdb

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegQueryValueExA
  • RegCloseKey
  • RegSetValueExW
  • RegQueryValueExW
  • RegCreateKeyExA
  • RegOpenKeyExA
  • RegSetValueExA
 Possibly launches other programs:
  • CreateProcessW
 Manipulates other processes:
  • OpenProcess
Safe VirusTotal score: 0/70 (Scanned on 2025-11-23 15:48:19) All the AVs think this file is safe.

Hashes

MD5 7b78baaabf06bf6b2c416de016cc6321
SHA1 061f0f0a78bbcae046ab8622bebd36773c6f3b0f
SHA256 947473c9cbe8bc1267519e92f3433ab35357285398309d65427763b2779d0fc4
SHA3 6e18fdd8b437c5a7a7ad9a2b1ca435924d52251b3fe6042662546ec9a7245a1d
SSDeep 6144:gLRjBveiFY/DslHKH0OspscJN4oGripP6jDIk9G4a:gLRFveiwDaQ4scJN4oG2nx
Imports Hash 903779526007e11b7ce5986ad4a6fbad

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2017-Apr-11 17:22:42
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 10.0
SizeOfCode 0xce00
SizeOfInitializedData 0x48a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000008D38 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x59000
SizeOfHeaders 0x400
Checksum 0x61c10
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 9de63d6156e0bf5ea0aac1b5a9b50ce5
SHA1 3721aa3c5c39beb0bbe9c6650105a1ab165f424e
SHA256 509173070343b477b9d338de7607598656604061a86a9c014b8473a50503e02e
SHA3 e549787e4abbcf9a382e5675e6be80fc88628ec3937bad04de57535c44c1b9b6
VirtualSize 0xcdfb
VirtualAddress 0x1000
SizeOfRawData 0xce00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.05976

.rdata

MD5 61b5cdf26febdd0e33fab68291f9851a
SHA1 ebc74b3d5ad405824d70a3f44548167d78e28c5c
SHA256 b9c5704ea29e592711f37dd38d30656a7f3cf3389bdaaafd976aaee0067b0535
SHA3 969d1c49af6f1f95e989385e8ef0295542c886f893dd35cead94772153d09707
VirtualSize 0x8722
VirtualAddress 0xe000
SizeOfRawData 0x8800
PointerToRawData 0xd200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.66515

.data

MD5 05b377beee33887316576d0c02976743
SHA1 ed8d9fcb352a2b24cb898b42d6476a288380e964
SHA256 8499556bb7be4dc1b3a52541f01b984ffcc61dcd83c7060a8e7038561fc70a78
SHA3 eee653e5ca3f9c47b5210ece72d26db96d6eb6e967e43ababd117d5353d2f062
VirtualSize 0x15050
VirtualAddress 0x17000
SizeOfRawData 0x14a00
PointerToRawData 0x15a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.50562

.pdata

MD5 955f357c8402e2e44ba06778176f274d
SHA1 004e0416a6848776df4a981b48c5a0e9b642f9bc
SHA256 5e99ce7caf8d97cc40f6b0c91731d129af8781d007a18ca7d00a39db505bb858
SHA3 4ccc4e4b8da516a1b5eb6f08cf7e9966f3f9d227fba8be28b9930f19bad06886
VirtualSize 0xaa4
VirtualAddress 0x2d000
SizeOfRawData 0xc00
PointerToRawData 0x2a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.47501

.rsrc

MD5 a52cb649b35c7125cf0bf6e832ff79fa
SHA1 853f02da5161655293c67ca3dca6b43917a19989
SHA256 2c52ca869048f7415eb32813eac6b01433d20375e1aea629a526a27c6e568e08
SHA3 bf4371924fd545e274a21a5cbc572a73f925fdee8697b5c180287f63b17f66f9
VirtualSize 0x28fdd
VirtualAddress 0x2e000
SizeOfRawData 0x29000
PointerToRawData 0x2b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.59712

.reloc

MD5 b10e6241494265c6c56ad938d32e41ef
SHA1 dc924da81877fd5174eff08b4ded190dc043d4f1
SHA256 bc5676ee6548a77f89d787c5d8284e81d5234626c4dc212cc365728d2cfde6fe
SHA3 7a930ab5a6a2da376d7fed6a23c3289896616dde9b51fde7a7817d0ddfdc5866
VirtualSize 0x1ab0
VirtualAddress 0x57000
SizeOfRawData 0x1c00
PointerToRawData 0x54000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.20199

Imports

KERNEL32.dll GetPrivateProfileIntW
GetPrivateProfileStringW
FindFirstFileW
FindClose
GetCommandLineW
GetModuleFileNameW
GetCurrentDirectoryW
GetPrivateProfileSectionNamesW
GetCurrentProcessId
OpenProcess
CreateThread
CreateProcessW
ResumeThread
WaitForSingleObject
GetExitCodeThread
Sleep
MultiByteToWideChar
GetLastError
DecodePointer
EncodePointer
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
WideCharToMultiByte
OpenFileMappingA
CreateSemaphoreW
SetEvent
CreateEventA
MapViewOfFile
CreateFileMappingA
CloseHandle
GetCurrentProcess
UnmapViewOfFile
USER32.dll TranslateMessage
SendMessageW
PostQuitMessage
DestroyWindow
DispatchMessageW
CreateDialogParamW
IsDialogMessageW
GetMessageW
ShowWindow
MoveWindow
GetDesktopWindow
GetWindowRect
MessageBoxW
ADVAPI32.dll RegQueryValueExA
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExA
SHELL32.dll CommandLineToArgvW
MSVCP100.dll ?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
PSAPI.DLL GetModuleFileNameExW
WINTRUST.dll WinVerifyTrust
MSVCR100.dll _wcsicmp
memset
memcmp
_CxxThrowException
memcpy
__CxxFrameHandler3
??3@YAXPEAX@Z
memmove
??0exception@std@@QEAA@AEBV01@@Z
?what@exception@std@@UEBAPEBDXZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
??2@YAPEAX_K@Z
_wputenv
_vswprintf_c_l
tolower
_wtoi
fopen_s
fread
fclose
atoi
sprintf_s
memchr
??_V@YAXPEAX@Z
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.382
MD5 81a3d0eab1786f4d89b239b01f7e00a4
SHA1 e351382956ae67d39f83bc794da5c9797713d79a
SHA256 35812b0ca62b0182660524a2b1c92fbc0d94e9dc0c89c8d83b0c15241e1151fe
SHA3 e1485262a5f9166ed735b3f87bfa401c2f40408fb82187965a3985f46e75192e

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.77932
MD5 e7ea9a412793eb518996dd4f047cf986
SHA1 2687a217b9ede7d78678caf19fe9a513bb8fa4f8
SHA256 35566e6e7c389d4ea823562e4176bb51ef745b5c25d8bfacfbae739720ee26bf
SHA3 ff5a3c21edbc057847e1ba305ed3d94b942c5946bc65483e5499ce14f185cc31

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.92374
MD5 347ec40f7dfc54288dc163f5667dbd3f
SHA1 38e82a5630fd51dcfec1da0fe3f97b56d3223eed
SHA256 9f7b8b0dc7d710ae5037f33fd38d0588fcb43d1a52f30fe7b2dd3c6e17e0ba22
SHA3 4d0e92f96b8ef1c1f6e0d93887ae36458d222d63e595b8d4b64c2ddfe0a11e35

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.86588
MD5 dd04c8703c653d56026238b7d6beb342
SHA1 2099e36792e9ae2de597ee84ede1abb02c68057c
SHA256 05f1033f2a11fe1e8534b0629eeffd6c1639a92d40c04c21b884cab61f75ee0a
SHA3 0f9911570d279c1aa9cfacaeddadbafcf9c83a11cd759b3263f56685a5f368de

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x11671
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98065
Detected Filetype PNG graphic file
MD5 41f14685111ea4b9e401ecc8d0e43cb6
SHA1 d234c2dd51f62babf9a197b3fc5bf1554a00d339
SHA256 f8b6b80b331fd15a04fa19b34f85133290186d1d882ac8b937dc4986bc938e97
SHA3 225dac09deb32fed4ae33219d2ad2b5221e4808955c5d95bbe514beea469887c

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.81797
MD5 b09366b2374522a258568f282d27659e
SHA1 4e3a0af97581a33366403563518b49f5c278b49a
SHA256 1cccaeca509a5a6d97cd2f8d655ed378d4f7512c70e87a3498cf306bae965be2
SHA3 faeb79efa4e69e4307cb486cd41d9a41691b7c93d533c24fb6038a3066b91001

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.88516
MD5 cc306c16651e8da67bd07f9fc25a2aa0
SHA1 4d31a6c1a954e433fdb568a7016300141b67fd1a
SHA256 d76945b6e293581684076d7458ba7784de4e59cd2e46211320f9419cca96eefd
SHA3 d94fec00a736c629e2ced1538e5438829f63e6744408c42f8d7606310253e1b7

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.9534
MD5 883ca7514f1e1a087af59f365a880794
SHA1 6e38de146160f1e245300be5b3d20ae0701b7372
SHA256 bbc915898d20339c044ba930710e7644a7da9ab986765779bfc2bf0826cf176c
SHA3 afb1cc521998ff8bee36743985a9ac1e21b4c446ae2aa6675a2092a96f0a229e

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91061
MD5 4f004f77e054dad29624a062e44f5025
SHA1 aaa4f8a6de3631d9a09900428360446b8ad84e52
SHA256 d259935260bcd17a10b99b28856874027b42ae768350e3d0f846089101a16a4e
SHA3 fa5057f6d046002e2cdc8a482c74a4c8c29407b49a4f43507dbddf05dd20e290

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.84533
MD5 3e7e19bcb936e4fc331749ceb0066957
SHA1 c3138e0e0c2e44c38f19aeb9d19d92d5dedc2c6f
SHA256 d266cd10c3828bbcd14043846f8917a9c0363f3cf6a79cbd5304270d9fac4069
SHA3 c306df0e77d19cb46df5426afc6de3a8c6acfe6b40fd47d795a9b4dc81680e27

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x92
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97556
Detected Filetype Icon file
MD5 e05fe8d6f1db8adc44aa1eec5941ca30
SHA1 bda48f27d0ef32e7aa99c996c268513a018d84c4
SHA256 796b7151a21baefefa0735925c05836118dddefc81a55f666b51835563793e82
SHA3 38b60eb2258b568ee650850011f8cccd54067064a227dbe157fdcc7d049be43f

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x655
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37545
MD5 e64f0e3051453730fcd59e3487fff82c
SHA1 881f9506d98c7244ee2e6cc48de59fb5fe9394a0
SHA256 cc5206d924557aebbb34ea990bff63d51f03f95c9618f11ba16f5bd0d969f3b2
SHA3 e68e9754b0692216d6b7991ec0b28f737203d4f0979404b4bfd5728ed3214e3d

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2017-Apr-11 17:22:42
Version 0.0
SizeofData 97
AddressOfRawData 0x13958
PointerToRawData 0x12b58
Referenced File D:\Developments\Games\SmartSteamEmu\x64\Release\SmartSteamLoader_x64.pdb

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x1ed76732
Unmarked objects 0
152 (20115) 2
ASM objects (VS2010 SP1 build 40219) 3
C objects (VS2010 SP1 build 40219) 18
Imports (VS2010 SP1 build 40219) 4
C++ objects (VS2010 SP1 build 40219) 13
Imports (VS2008 SP1 build 30729) 13
Total imports 118
175 (VS2010 SP1 build 40219) 6
Resource objects (VS2010 SP1 build 40219) 1
Linker (VS2010 SP1 build 40219) 1

Errors

Leave a comment

No comments yet.