b5e55a56465d5dd99a4ed1d409a56fdbbc3d9952c96d210a6813af3346813af4

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Jun-11 19:17:39
Detected languages English - United States
Debug artifacts C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_VS2019_nondev_i_r\WindowsPlayer_Master_il2cpp_x64.pdb
FileVersion 2020.3.12.11776710
ProductVersion 2020.3.12.11776710
Unity Version 2020.3.12f1_b3b2c6512326

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 86.3971% of the executable.
Suspicious VirusTotal score: 1/70 (Scanned on 2024-04-13 15:51:31) Bkav: W64.AIDetectMalware

Hashes

MD5 a5e902ad7a659460bdf62050fcdb5add 🔍
SHA1 42ee77692ad27082f7ee37543d1a45a7e197e7bc 🔍
SHA256 b5e55a56465d5dd99a4ed1d409a56fdbbc3d9952c96d210a6813af3346813af4 🔍
SHA3 c0fc11f009ed6b7dad89f56c483e03fa30571773d0ea9ffa9d1ca76ca5b9d160 🔍
SSDeep 6144:6pC62lkCTi3XT2RBwnebviBFh5hK39XQxvgKSgpGwXU4xoEhcLbuLU36hphGhNh:64eCEXTAoeTiqixxZ7o7wUbhsUaEq 🔍
Imports Hash 5f74a5c747508e2822fdb9b687deaf42 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2021-Jun-11 19:17:39
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xa200
SizeOfInitializedData 0x96600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001260 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa5000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 dc34d9506ae9e3616b5265da7e35b1f6 🔍
SHA1 dce8f4d17ddc08b8460b046a362a27430cbe2e75 🔍
SHA256 e80b2c4dfacb7fab649683f679231937cf85d5498d6d4b5d3a3e61149f064124 🔍
SHA3 08b3146b697934b2f68c0ed66868b3c96973ed20c4a70245a96b304f456d0106 🔍
VirtualSize 0xa120
VirtualAddress 0x1000
SizeOfRawData 0xa200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.39574

.rdata

MD5 1ced7dc1d8f970c12a9e0a1c0d3e2485 🔍
SHA1 497641d7e7932112958aef0a00dca9a1faae06df 🔍
SHA256 ee7206c0cc49e935f14d3853a64edc22c2b5745ec45e6f724b24c3471f04f0a9 🔍
SHA3 76de99cf040b22161032f1234230556925c81caeb1e4bd5219b0a51c94f634c7 🔍
VirtualSize 0x8c6e
VirtualAddress 0xc000
SizeOfRawData 0x8e00
PointerToRawData 0xa600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.65255

.data

MD5 a9e79420695e9bc679ca784c3876e94f 🔍
SHA1 85d68049c56be1369a584c2cef1f26bece917c8f 🔍
SHA256 a64f2a1dd771a4ddc2a8b9ebecec8d75683a19da0fcb7c92b1ca380ca540a055 🔍
SHA3 902fec18ac997b92fb99b25384f1c089fc9ae1ab1d849e846fff2b3a4d2bd9fa 🔍
VirtualSize 0x1cd8
VirtualAddress 0x15000
SizeOfRawData 0xc00
PointerToRawData 0x13400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.67624

.pdata

MD5 789f36f907239c1ceca2f8ec3f79fcb5 🔍
SHA1 11b2d5522be4b2558a7e492c53b4d86184702c90 🔍
SHA256 5e2c8dede33e201308d3fabb30b57b487ba34d524537e56449f854c9d6e560e4 🔍
SHA3 0b06f78c7fe1c1611e2e7abfd4a78a87cf82474f2ac5b4a8daa9c07fbbf85778 🔍
VirtualSize 0xc48
VirtualAddress 0x17000
SizeOfRawData 0xe00
PointerToRawData 0x14000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.36097

_RDATA

MD5 1960efd573f3d23522c840210d59fb7e 🔍
SHA1 47057bb39ae6c80b68d90c47f0cfd7d6bf123ad2 🔍
SHA256 ad5bd98e9035110e2e2e7b82ed2fe49ec0fae2d89e05400528a6b48804c441a4 🔍
SHA3 225389cba41c0a9e2c3319b0921ec1ef9962e8af175fca30c67bde60763834d4 🔍
VirtualSize 0x94
VirtualAddress 0x18000
SizeOfRawData 0x200
PointerToRawData 0x14e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.08512

.rsrc

MD5 efe12eeec504e130231be8fa49840959 🔍
SHA1 d25b18c36bc0770df8b6ea8065e4ef7be1c2b791 🔍
SHA256 9136d5aedba4680c89607bbf2c74bf7cee7c7efc966bf78ec3638baeb424800e 🔍
SHA3 4d32f696da06ed520364a83e6b33d841162a8ff7d77924456ff15a6dcde0bb92 🔍
VirtualSize 0x8a150
VirtualAddress 0x19000
SizeOfRawData 0x8a200
PointerToRawData 0x15000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.3655

.reloc

MD5 a9c3cf69888151777a2a472fa85313df 🔍
SHA1 a5410c074ce059a802887d8ef48a198d601aa9e3 🔍
SHA256 02d5b365a568a1cfd46be8549a8fee9793a57a8d69c3544d8232330a87a3d7ad 🔍
SHA3 874351b3eea840f9c0337e4533e9a1b535fab5c0ccdeba911f149a1902c60a44 🔍
VirtualSize 0x634
VirtualAddress 0xa4000
SizeOfRawData 0x800
PointerToRawData 0x9f200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.78467

Imports

UnityPlayer.dll UnityMain
KERNEL32.dll WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x15004

NvOptimusEnablement

Ordinal 2
Address 0x15000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.37408
MD5 7344dfb958310ed498e1f3d364dfef06 🔍
SHA1 503408884137735288855795992c8eb9375c5fe0 🔍
SHA256 0c8b629d79d3691e827e9872852f55c6e692a9e1478eba5826cb3fafb40d44af 🔍
SHA3 6fcf122e983d0600752ba55702758d4201d8c4802dff372a4f74eb8fd5c1e9fb 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.37314
MD5 b58bc0ddcd779b8c70e00e3a40f0bc74 🔍
SHA1 24d4fccec7351d16f0df3c465009fc76588464c3 🔍
SHA256 8f51200cb80173783b3be8f560129b3e8ee0a93d0a3922a53dce943681ea94dd 🔍
SHA3 25fe91c7bca5726250df50762b36878e0d729d5dfbc875c2323edc5cb86a248f 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.96217
MD5 43f3667f345e2d5f86d35c095c1953f0 🔍
SHA1 bbade4b58a78e1b473c8321f18405bd7634eeb45 🔍
SHA256 4e0f6d7b72dc2a06ac48204c1d98656e669cc0188500fa35bd3be751872901e6 🔍
SHA3 4e245924e944d90e21f8db2f8630fdc88583c3898ce57e28e658e4d43a7aee71 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.363
MD5 31fdecd7288dd194e07c3d9d37c4f986 🔍
SHA1 8b44adb6f33fbe8c90e536354e3d334c93d8ba18 🔍
SHA256 9f31c52f1ccea4ac358a4048583f61c700b455c38badd859dcf0d7852981b7be 🔍
SHA3 a446ff70b8d997ef0311dec6b4826e19087eba3efa2dc7986e3dc7d5087eae3b 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.35857
MD5 55670e74bba4dda39349f2a31fdb62e1 🔍
SHA1 eee9f5721dafc6cb16837b2cfba0a0b8f441ef90 🔍
SHA256 55eae2a0be65bbb9c11cde8bf5dae6f4153c2df83ea3ce97bed6bcc5cb03977f 🔍
SHA3 e10a14b561668f8fa45624f1ff4fa682a20e3732f597df219e47c6cd379c98ed 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.31027
MD5 fde169c6c664617425e1b8beac87e014 🔍
SHA1 bc331dc145a14a02624979cfabbdf56d1e348b0b 🔍
SHA256 544fdebc6cee6caac4efd0876e27f8c6f73b924660a8f4c6e7f0a9f8f4eb6852 🔍
SHA3 33be943315a0427aeb29e933467a071e8753269f73ada2eabe719f5073b898f7 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.32512
MD5 9869b5f20d933edf4ef7438318ddfd5e 🔍
SHA1 34ea44d187dec77015c557ed24f508beed2cf653 🔍
SHA256 fd3771633f7285086b94a7b35793701660f66bef2a339a826517a78a3bb327c8 🔍
SHA3 9d7addad2bfd9fd3ad06395a9ab3c16bdabf64beb91ee41987f647b6b35e9bd1 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.23841
MD5 0c7cf953310e1b905d82045c3dcca57b 🔍
SHA1 4a087fc22b82518bd632386f2cea3d5f95905b4d 🔍
SHA256 7b6f6c8607f95616fb23a6dd7de58c8bd9d7205bfa46e892eab9a1822e672bc7 🔍
SHA3 ccfe880fb3af6a8948e1146df7c2b6a50bd6c94d72a86b4ac67a3eeea85879a9 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05883
MD5 48eeabd9ba3690ad09ea0e5e512b3b84 🔍
SHA1 be9ffa84a40e3ea7ff7a0deb4b0cec7bd9369f46 🔍
SHA256 5b22e7cd7898fd472f159b13706ca31387c815c117cc66597682a4df25c7ff04 🔍
SHA3 016f871a20f950ca4cc822ef80bbb0241ce93a635ea5ed0828b551d5bdd47047 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 f7731730720cfe035cf030b40d0e2eb6 🔍
SHA1 d046e23f2ee2b93ad96be8e1dc9120ecf3915091 🔍
SHA256 5c92a41adaf3265071482fd1a182ae8702c168636a7d9ff51798ee3a1dfc8500 🔍
SHA3 6f2d12e4c63c131a3f7f48293996e2be05da351536d013affe5d2265965ce657 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.39248
MD5 f5cdf438e2401717bd523dc67079be4c 🔍
SHA1 8dfe7ebffa5e7983de51930aa10564873975220d 🔍
SHA256 338138838f9cb6d997610b20119e07b35c635eb21f4cb7724a3e4584602f527a 🔍
SHA3 e3a615c666a08e8e151ca9b8c5a0b9e4267c25853dfd193d79ec032ad8a6f782 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x6c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37708
MD5 aab7e8aafe7b06ab3d003b54ab5e18ed 🔍
SHA1 dccf0408f43059df37b755f3241a8b4b35c728af 🔍
SHA256 fb88b19523afd8fed48eddfd10805a3a0a45997bbf8fac04d595ddf93c1a88a8 🔍
SHA3 a981b8e907b79cd9448766ace938dfd96560d11c29e6ba165912a8508bd52ca7 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2020.3.12.45766
ProductVersion 2020.3.12.45766
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 2020.3.12.11776710
ProductVersion (#2) 2020.3.12.11776710
Unity Version 2020.3.12f1_b3b2c6512326
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2021-Jun-11 19:17:39
Version 0.0
SizeofData 134
AddressOfRawData 0x13730
PointerToRawData 0x11d30
Referenced File C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_VS2019_nondev_i_r\WindowsPlayer_Master_il2cpp_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2021-Jun-11 19:17:39
Version 0.0
SizeofData 20
AddressOfRawData 0x137b8
PointerToRawData 0x11db8

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Jun-11 19:17:39
Version 0.0
SizeofData 712
AddressOfRawData 0x137cc
PointerToRawData 0x11dcc

TLS Callbacks

Load Configuration

Size 0x130
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140015030

RICH Header

XOR Key 0x69197163
Unmarked objects 0
C objects (VS2017 v14.15 compiler 26715) 10
ASM objects (VS2017 v14.15 compiler 26715) 5
C++ objects (VS2017 v14.15 compiler 26715) 136
Imports (VS2017 v14.15 compiler 26715) 2
C++ objects (VS 2015/2017/2019 runtime 28427) 37
C objects (VS 2015/2017/2019 runtime 28427) 16
ASM objects (VS 2015/2017/2019 runtime 28427) 8
Imports (VS2019 Update 5 (16.5.4-5) compiler 28614) 3
Total imports 85
C++ objects (VS2019 Update 5 (16.5.4-5) compiler 28614) 2
Exports (VS2019 Update 5 (16.5.4-5) compiler 28614) 1
Resource objects (VS2019 Update 5 (16.5.4-5) compiler 28614) 1
Linker (VS2019 Update 5 (16.5.4-5) compiler 28614) 1

Errors

Leave a comment

No comments yet.