9d6955463a0a509a2355d2227a4ee9ef0ca5da3f0f908b0c846a1e3c218cb703

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Dec-23 08:27:36
Detected languages English - United States
FileVersion 2020.3.24.7980941
ProductVersion 2020.3.24.7980941
Unity Version 2020.3.24f1_79c78de19888

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentControlSet\Services
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The file headers were tampered with. Unusual section name found: peC\x00|\xc3\xc3\xf7
The PE only has 8 import(s).
The RICH header checksum is invalid.
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExA
Suspicious The file contains overlay data. 687883 bytes of data starting at offset 0x5c220.
The overlay data has an entropy of 7.1124 and is possibly compressed or encrypted.
Suspicious VirusTotal score: 2/71 (Scanned on 2026-10-14 03:32:53) Bkav: W32.Malware.26897A6E
Cylance: Unsafe

Hashes

MD5 8a56b7ef5db3536ff56e9152651f6afc 🔍
SHA1 1549ea2650d4078f3dfa267b6e04375d66668aac 🔍
SHA256 9d6955463a0a509a2355d2227a4ee9ef0ca5da3f0f908b0c846a1e3c218cb703 🔍
SHA3 042ed84ad33d9355c7d5918ab284d9db6ef0a0df76101e37ca17d8d89aeb2f72 🔍
SSDeep 24576:A+b9JUKVqlCsDe7VryTY2F8EsSLcPwsVxklRL:HRmKQl5USn 🔍
Imports Hash ef064fcadc04c265ebd7921064b411aa 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2024-Dec-23 08:27:36
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x43e00
SizeOfInitializedData 0x59c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000001F3F9 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1028db
SizeOfHeaders 0x1000
Checksum 0x6436a
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7aa27a278d8c839e300a53a0b51f4b5f 🔍
SHA1 922ba1eeb9dedd6b02cf20343f831df5204c9452 🔍
SHA256 4be1b05d6a7d3ab22c27751cdbec3e7a95b35e46b495ccdee36efa8229da779d 🔍
SHA3 f35a3a720414a8d0ceec162b12a0161f52a8421462586f98fa0114b04c3a12c5 🔍
VirtualSize 0x44000
VirtualAddress 0x1000
SizeOfRawData 0x44000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.43671

.rdata

MD5 e1db4946213638dd0ae5872ebe81b686 🔍
SHA1 22ec68a84941e3f7f8b91f6c6db26e5416ea6bdd 🔍
SHA256 e0f4e04155fa3509760c1fdbbd9ae1ba4241030368dd97cc56189161e6a345dc 🔍
SHA3 ab1107235c0feaceb762b7171b4e99f0711f570adbe6ac2ce453bb4e23e5d552 🔍
VirtualSize 0x19000
VirtualAddress 0x45000
SizeOfRawData 0x19000
PointerToRawData 0x45000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.02476

.data

MD5 79b59f54265ab6b53e075a6fb8917fb3 🔍
SHA1 a41545aa94974e78a1da241a2c0dacf46a728909 🔍
SHA256 9ba66f3913ed655504f0b30e2e23159ec9c98ebb5bf57fa496ce094e27ad4319 🔍
SHA3 8f9f3791442cd9bbe6cabc1f9a758bc406031dde909f0405a9b2bfd994874424 🔍
VirtualSize 0x3000
VirtualAddress 0x5e000
SizeOfRawData 0x3000
PointerToRawData 0x5e000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.61912

.pdata

MD5 8a3cf987a71c392979941790224fc7ba 🔍
SHA1 672a3574b83d62a402e4bdac935922541e4bb168 🔍
SHA256 886f5778ca77e263f0d6962e8fb27b0d23feb6b12e4448cb4d08599594df22dc 🔍
SHA3 67f7b7a5a8f3a054006cf25a09f5ac6704d84b083cae4ddaa56c70f435bff100 🔍
VirtualSize 0x4000
VirtualAddress 0x61000
SizeOfRawData 0x4000
PointerToRawData 0x61000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.66873

_RDATA

MD5 798d0d5b4af409ba817ddfef343f6528 🔍
SHA1 3cf4e7bb5465fb5397a3ce8e3cce99d55581c734 🔍
SHA256 ddfc110e42f7d76eb24f8138da645c3b314858bc2760cc35ae2ac31b82d88467 🔍
SHA3 6e17d25f5ada03a14261ff7ed0eacec80d1f040ef32d2c0eca3885f942d4410a 🔍
VirtualSize 0x60000
VirtualAddress 0x65000
SizeOfRawData 0x60000
PointerToRawData 0x65000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.8386

.rsrc

MD5 32166b5fb21f4a2c47fd929e25b75fdb 🔍
SHA1 1ed6b85acd4840f0e2a66d4dca9a3783ac7f2843 🔍
SHA256 4ede800ba269b0faa4cc68271fce55710a132d40f4a2f544d109c8a7e69f109f 🔍
SHA3 e04463827383373f089644409779d25bef9a215d4e66778e0e9eca3059e538af 🔍
VirtualSize 0x3b000
VirtualAddress 0xc5000
SizeOfRawData 0x3b000
PointerToRawData 0xc5000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.27221

peC\x00|\xc3\xc3\xf7

MD5 d5dd4ab5f9904a6900dd36b9d5a82467 🔍
SHA1 8da0131b62fae354bed86aaf506cac80553a9081 🔍
SHA256 d15876849a84bbcad9998875f746ee4588d4bc79440ca0e536fca1b29fe1311b 🔍
SHA3 d8ca963937e20a0ec1dabb2959886e09c81b128e00ceda06a0a5ed7144072fdb 🔍
VirtualSize 0x28db
VirtualAddress 0x100000
SizeOfRawData 0x28db
PointerToRawData 0x100000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.66241

Imports

KeRnEl32.dLl FreeLibrary
RaiseException
GetProcAddress
ExitProcess
GetLastError
LoadLibraryExA
Kernel32.dll GetCommandLineW
UnityPlayer.dll (delay-loaded) UnityMain

Delayed Imports

Attributes 0x1
Name UnityPlayer.dll
ModuleHandle 0x5f7d8
DelayImportAddressTable 0x5f6f8
DelayImportNameTable 0x5c568
BoundDelayImportTable 0x5c588
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x5e004

NvOptimusEnablement

Ordinal 2
Address 0x5e000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2281d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99497
Detected Filetype PNG graphic file
MD5 40aae4dafa15b4727c091a254771e7b4 🔍
SHA1 ff2f7738d6440ba7cfe965ab183f72835437ffee 🔍
SHA256 50aaed523345c7a67ce6cc0e11a4e89e89e7a94bf4477ee1b1098f404d08ece5 🔍
SHA3 80a68b9ee6018acc37ac164ae6cd4b522145808ccd0add64c20cc8bd4a213ab3 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa088
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98862
Detected Filetype PNG graphic file
MD5 99a4f9d397120a748e020347d868f775 🔍
SHA1 321121cfdfedb377be0582f49ca94eeaf480f790 🔍
SHA256 3d42f42680d3a0d65b53bdc83c5514d22812897ec28d6ff694fd83efaf9bc65c 🔍
SHA3 c8fec5e3d04a5c95a7e759a8591c8774871cec6780544192c682c2fc888ec3d6 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5f18
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9823
Detected Filetype PNG graphic file
MD5 934e89e0a4cce4f0682eec35f030c1ce 🔍
SHA1 973e0c895cfd462201e46e41ac272296a598258c 🔍
SHA256 a8e15b388462beabcc18e6cd3d119c89e39b0090eacbb225352b1bb29ce3a030 🔍
SHA3 26052260bffc0b5a8d10941883272c6c573fde3c99626b98c87753aefb55b8ea 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2ce9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97754
Detected Filetype PNG graphic file
MD5 1eeeaf8de8ffa2ff449ac85498fe74b3 🔍
SHA1 434260272544f75a6c7b59cedc0ea42d707313bc 🔍
SHA256 2e29eeeea0e58671cbf2827af570315ef81ab18d62e9de5ea22be0f55b93099b 🔍
SHA3 72618879620609fea26d4cfb42cd9359a917521a955658ace85710bb6223b014 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1a49
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96536
Detected Filetype PNG graphic file
MD5 e1f8d58eb8213d07e8e200520087717b 🔍
SHA1 e4fc9418d3bb9abd2db2b9577389bde33df79dc7 🔍
SHA256 a8b3cbd09efa17f4f39985181bbaefe0ea4f4c58c3ff5828a6a9ffdebbc09639 🔍
SHA3 e52c42e18f468e8aaee29bc524bfeb7c28fc7106666e898caf873416345cec4f 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x12bb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95877
Detected Filetype PNG graphic file
MD5 da4ba32e1b4444d9f6432bb3d7cfcbb2 🔍
SHA1 bfb655fb0190a4b46f4c47de1f4063e397dc4bcf 🔍
SHA256 0fe604ff873bf80aa76201efc5dbeddbcf69a43ccb8c274fa66f8fd838df472a 🔍
SHA3 703abd43011f7d97e4051b7078b0335a5697831cfe11ca23b21a934535880329 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xc50
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93125
Detected Filetype PNG graphic file
MD5 7c81fa0bdf467186da83766c765daf63 🔍
SHA1 e69af28f55713504699b742748e13897b2cb4d5a 🔍
SHA256 1575456318954a30d6aa8af03f062e1a13a36f54491053d200647422dc98dd22 🔍
SHA3 45881764ed27464562f11a2ad34768e2e7e1a625bcbb1bcf1e23666d7fd8ef75 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x737
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88248
Detected Filetype PNG graphic file
MD5 79a2fd7845379b55a2d01c041ea516af 🔍
SHA1 9f4e30ecd2b86a09b8261afb5442dabc1cbda343 🔍
SHA256 6589d5cb5bc556fa6731489c457d96caaa5d8ab81e94b82809ab49e9dd61ebd6 🔍
SHA3 1308ac2934238511df48d2ad55822c84615c5f92b712ec75160a7289dc4ebc3f 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x535
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.827
Detected Filetype PNG graphic file
MD5 24d1d40e975e139518ad1ffedc9b8e3d 🔍
SHA1 eefed7c18f4ba70c0c152a6cefc5d6e01a2bda2a 🔍
SHA256 5d9523dd3ecb22dd4bb278dbb56a3d068d467297d4cd842254102fa99f76b890 🔍
SHA3 3aafb5d863fb6f014fc7843c4a2f60bd58102cfe33994caea91857f58d06056b 🔍

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x380
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.73581
Detected Filetype PNG graphic file
MD5 c188193464c37518957f07f50ceddad9 🔍
SHA1 6c8b697d97a596e185296f1d6a5bc394f054ee55 🔍
SHA256 83ccae65bbc92a736da215ea19a3ae4a71be055bccfaf1f8b134be6992155924 🔍
SHA3 10c71b831a9e67ef8aa4634d8f323f42fe819742bbba81235f8fa749ee75123a 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x92
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16609
Detected Filetype Icon file
MD5 d6b651f52dd630b146afc0ea0684a12d 🔍
SHA1 11553886d63dad0a0f3cdb3d889615e0e78b2b82 🔍
SHA256 f08743ae2531d5d851153f012691924b652ca85c081c0673827a6bbccc110837 🔍
SHA3 c9bc9e4210eaaa05ff2d223678319f486d1f711370cc49989d6f609e33a4254e 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1c0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.41376
MD5 e4e911797335766f41fc805fc107b668 🔍
SHA1 d7fa488338406cda11565e48a211e6f512bfa59a 🔍
SHA256 c458a55c23ea187ee107ce5f589748af9ef68492230941151ab208afbd7df7ce 🔍
SHA3 29b1f13dc40ba80b5315869cd927fd88cf6e26f45cde97632a5b23dab71649b3 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x6c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37708
MD5 aab7e8aafe7b06ab3d003b54ab5e18ed 🔍
SHA1 dccf0408f43059df37b755f3241a8b4b35c728af 🔍
SHA256 fb88b19523afd8fed48eddfd10805a3a0a45997bbf8fac04d595ddf93c1a88a8 🔍
SHA3 a981b8e907b79cd9448766ace938dfd96560d11c29e6ba165912a8508bd52ca7 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2020.3.24.51085
ProductVersion 2020.3.24.51085
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 2020.3.24.7980941
ProductVersion (#2) 2020.3.24.7980941
Unity Version 2020.3.24f1_79c78de19888
Resource LangID English - United States

TLS Callbacks

StartAddressOfRawData 0x1400573c8
EndAddressOfRawData 0x1400573d0
AddressOfIndex 0x14005fc20
AddressOfCallbacks 0x140045410
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

XOR Key 0xba594a9c
Unmarked objects 0
ASM objects (28900) 10
C++ objects (28900) 174
C objects (28900) 19
C objects (30034) 16
ASM objects (30034) 10
C++ objects (30034) 85
Imports (28900) 3
Total imports 119
C++ objects (30154) 8
Exports (30154) 1
Resource objects (30154) 1
Linker (30154) 1

Errors

[!] Error: Could not read PDB file information of invalid magic number. [*] Warning: The WIN_CERTIFICATE appears to be invalid.
Leave a comment

No comments yet.