b7d23faff834a9f6888dfdde099cafab589c16629b159c149ad2525bf7406e36

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Mar-08 23:05:20
Detected languages English - United States
FileDescription OpenVR-SpaceOverride Installer
FileVersion 2.4.0.0
LegalCopyright Copyright (c) 2026 Nyabsi
ProductName OpenVR-SpaceOverride
ProductVersion 2.4.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
  • paint.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Can access the registry:
  • RegEnumValueW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegCreateKeyExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 1074085 bytes of data starting at offset 0xcc00.
The overlay data has an entropy of 7.99956 and is possibly compressed or encrypted.
Overlay data amounts for 95.3633% of the executable.
Suspicious VirusTotal score: 1/61 (Scanned on 2026-06-25 06:10:28) APEX: Malicious

Hashes

MD5 713f2471b9e091f770b4c25f1bcf08e3
SHA1 37d7ea943f29b6f01cb591df9be0fe0d1fe81c80
SHA256 b7d23faff834a9f6888dfdde099cafab589c16629b159c149ad2525bf7406e36
SHA3 02a710a329a315feaeb51f653f2a7e287f4518fe56b55d8ebde04a6eb7f123ae
SSDeep 24576:r+dPpd/gyDLSP+YWKGbPhCIjjFkPIS9ar+wY0SGhJslpSF8c:iNgWLSP9GbPMIj+ZmrVJs22c
Imports Hash 573bb7b41bc641bd95c0f5eec13c233b

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2025-Mar-08 23:05:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6600
SizeOfInitializedData 0x22200
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x00003557 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x51000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ede5332bf873a891b30bddeca5a001a2
SHA1 1d4c57ede58661e98b07da68b45e4a8d84b9b084
SHA256 394670fa65e3c577b4da87c7811f75a130e202a4a16670de99bc8bd2ae76549a
SHA3 697c727bb45aac7b42ca2d64a24ad26ecf966702f5d507a4d9a785a037be8282
VirtualSize 0x65b1
VirtualAddress 0x1000
SizeOfRawData 0x6600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46728

.rdata

MD5 b37859e18d3b466791dae1eb6c76701b
SHA1 f3d1a9f393f32a63de46af88d271882ae2122c72
SHA256 067fb88304317a6ae430bb3e9f052b66cc6d42f4971fd04f96452c382829863b
SHA3 02327a999c861346bb81d836ca195bd47b69973e3b64e5fecc3861ccf60f7629
VirtualSize 0x1358
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.10393

.data

MD5 d13b23f3b755ccbe7f00e1accf591cab
SHA1 271c548852654cd41880a896ce29cd8b153c0954
SHA256 28dcb815e16f98a93516c2c1c85873e5fd888ddbcb15805ba472b5cbd2f2514d
SHA3 6517591e4489e436d18492fb2fc862e43f30f7d910325340bfd1a8bdc62a597e
VirtualSize 0x1fb38
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x7e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.03046

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x22000
VirtualAddress 0x2a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 f9be0fa705088d0a6f0cb627dac08afb
SHA1 2f45b4723541fb0504a12ff1353c032a01389763
SHA256 f6bc2c35f133ba0effa475a71f85c57b32ecb2cb4b89617ab3c193048dad18c0
SHA3 5a0b7e8a990da78ecc0485904747a63436cd128da398d6e0dc3cdd145968ad02
VirtualSize 0x46a8
VirtualAddress 0x4c000
SizeOfRawData 0x4800
PointerToRawData 0x8400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.83298

Imports

ADVAPI32.dll RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
SHELL32.dll SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32.dll CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
COMCTL32.dll ImageList_Destroy
#17
ImageList_AddMasked
ImageList_Create
USER32.dll MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
GDI32.dll GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
KERNEL32.dll lstrcmpiA
CreateFileW
GetTempFileNameW
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
WriteFile
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CopyFileW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.26612
MD5 0ec0a0948a526b9c7eebe39bb02b6b0b
SHA1 867b304f20fd74abeb5c30515837f1c41cd3bf8f
SHA256 d442adb90ba296c7e617d2f58d6fa6f308bcd8ef65e5e9c66db4dd27f93fcfbe
SHA3 5bc458755a2ca5c7475620389d9b6b67952973c4366c6777d45c969b8bc67cd4

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.9993
MD5 6b224e01af48ec8e4c17a59d9534e885
SHA1 de787d2a1e840618ba2c7eb69d28f6966c404d1d
SHA256 50279c9885b490e74b49ac0273940b6e0891b62fc9ffb5c52e35422a694f248b
SHA3 71b543301bccda64ba61a27873c952890233e0cbec10e0b59245fc303bcfadbc

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.24459
MD5 ca82d899b1d402941b5c92ed9028cd95
SHA1 fb329ec4455d5caf1753305debcc14ab6ebb9015
SHA256 9da1013c864092e49c2676b3ba68a0d4513457d77d251730ed73cc5f4a4813b1
SHA3 768277223731ffdcb799e50961d0afccf23bbae54118d53b834617ccbd0c5cd9

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.01502
MD5 05e60fd47096a729dda2aaa4ab05ebc7
SHA1 de8ec9b484fa4f565b14f55503c9cd95231b633b
SHA256 61f762babde9942f43ee97154b8734efeed0632a6ea778dc395793ae3e3e7507
SHA3 f8ba0d4a91389414904cc66226099f27f482055e90ba449e2396193f139713d8

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.16057
MD5 d9ee3a2962251a241bce41b0524cfc0e
SHA1 2ba919aaa7237367a158e4b95385ab1ee07643d8
SHA256 69e6579a37fcaec037634e7fecbfc6a26093ea81dc4bd555d8a12187d2cd0866
SHA3 a1699668464f7edf9a748dfc264f9d30e3c69a228be0a18cade30c14aa6c77ba

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34146
MD5 53482d364aa2d4ae7ca05199dad7651a
SHA1 ccb213408acc7f5ddb94753e6410be23aab5cedd
SHA256 ff06189b43a5c1d6cc5d1b7cbf6ab56b1157ec52807945d652274a211462cba5
SHA3 60659e39ef3f267c267093f8bc4c87ed61eea4ef96ac0f583184f580844573e5

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04232
MD5 636ad42555a835e3a94209043df4a45a
SHA1 c878613bda5cba6cb5769846e60229890c5df248
SHA256 491e52ded039ec6684277e6f1f820e288763ae6d20e682bcfffb6cee4518ac23
SHA3 4b79e60727e0f7be7495c59fb949e22bd753cff6e145e4694257a21a7b5dba8c

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71813
MD5 a69caf66f3f899403f8b25b02dc61908
SHA1 3e5db9186cf0f75be24676462d88170e5950d9c8
SHA256 7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50
SHA3 1eea945e3712b317143e07560f54b0b9a13b1fd6c2b57cab9176181a9aaf4f79

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73893
MD5 386770584473e271f23dced36427f4ff
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19
SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014
SHA3 db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.6691
Detected Filetype Icon file
MD5 e624f041c921d299a6da3a8c5f48f989
SHA1 ffa07c86ac3dac45398ee07b26610dfb5c99d8ea
SHA256 fed46e06346fb8f64b14c18408a82caf955929ac0e65151630539dc5bd194584
SHA3 b51d47dbe9cbe18b1f520275504256022a827f919672b081943ae45cd4ff44c9

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x248
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.30285
MD5 b847b15be35c7e7244d2b13bf09dc456
SHA1 1b3d36bb1488f572a3b1dc5198edf28d8aecfb2a
SHA256 4331a443adc74d936a6d3e303b19e83c017b0a3e0a6d388f4bc3ad78ce4a9f6c
SHA3 2282b391ae68c1671d00c64465ad373db949a5a59fab2bb63867438690bd51ef

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x42e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28813
MD5 f1ad3d24615cbac7ca24446a2f50977d
SHA1 735729c60d20293009519237b7fba52ae085b133
SHA256 7737bea785028e74f59b16c2507df38f4b53fdb645ba83e8358b9c6dae7d20cf
SHA3 a0022520ffa0acaff33e56f0d78ca5df8e0d445a52ec08027d51c1df1e46dc6c

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 2.4.0.0
ProductVersion 2.4.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription OpenVR-SpaceOverride Installer
FileVersion (#2) 2.4.0.0
LegalCopyright Copyright (c) 2026 Nyabsi
ProductName OpenVR-SpaceOverride
ProductVersion (#2) 2.4.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd24e50e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 163
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.