| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Apr-22 21:01:52 |
| Detected languages |
English - United States
|
| TLS Callbacks | 4 callback(s) detected. |
| CompanyName | Rascal |
| FileDescription | Rascal Anti-Cheat for Metin2 |
| FileVersion | 2.4.0.7 |
| OriginalFilename | rascal.dll |
| ProductName | Rascal Anti-Cheat |
| ProductVersion | 2.4.0.7 |
| LegalCopyright | Copyright (C) 2025 Rascal Anti-Cheat by tokuc. |
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. |
Unusual section name found:
Unusual section name found: Unusual section name found: |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Rascal-AntiCheat
Issuer: Rascal-AntiCheat |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Apr-22 21:01:52 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x193a00 |
| SizeOfInitializedData | 0xb5000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x01DA3FDA (Section: ) |
| BaseOfCode | 0x10000 |
| BaseOfData | 0x1b0000 |
| ImageBase | 0x10000000 |
| SectionAlignment | 0x10000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x24c0000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x150ca2b |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
VirtualAlloc
OpenEventA FindFirstFileA FindFirstFileExW GetFullPathNameW FindNextFileA SetThreadPriority ResumeThread OpenMutexA QueryFullProcessImageNameA CreateFileMappingA GetThreadId OpenFileMappingA SetProcessWorkingSetSize MapViewOfFile SetThreadContext K32EnumProcesses LocalFree GetSystemFirmwareTable K32GetDeviceDriverBaseNameA EnumSystemFirmwareTables TerminateThread GetFileSizeEx GetModuleHandleExW K32GetProcessImageFileNameA QueryDosDeviceA GetFileAttributesW SuspendThread GetExitCodeThread GetFinalPathNameByHandleA K32GetModuleFileNameExA GetFileAttributesA DeleteFileW GetLogicalDriveStringsA WTSGetActiveConsoleSessionId CreateEventA CreateProcessW WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetEndOfFile SetStdHandle GetCurrentDirectoryW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlushFileBuffers SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW FreeLibraryAndExitThread ExitThread GetThreadContext ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue AddVectoredExceptionHandler CreateThread Process32FirstW LoadLibraryA GetCurrentThread DisableThreadLibraryCalls SetEvent Process32NextW GetModuleHandleExA QueueUserWorkItem DuplicateHandle GetTempPathW InitializeCriticalSection LeaveCriticalSection GetUserDefaultLocaleName EnterCriticalSection GetModuleFileNameA GetModuleFileNameW FindNextFileW CreateDirectoryW QueryFullProcessImageNameW OpenThread IsWow64Process CreateProcessA GetThreadTimes Process32Next CreateToolhelp32Snapshot OpenProcess WaitForSingleObject Thread32First TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead SleepConditionVariableCS WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle VerifyVersionInfoW VerSetConditionMask GetEnvironmentVariableA MoveFileExA InitializeConditionVariable SleepEx SetLastError VirtualFree FlushInstructionCache HeapCreate RaiseException OutputDebugStringW IsDebuggerPresent GetCPInfo CompareStringEx GetSystemTimeAsFileTime Thread32Next K32GetModuleFileNameExW GetCurrentProcess HeapFree Process32First VirtualQuery WideCharToMultiByte VirtualProtect LCMapStringEx GetLocaleInfoEx EncodePointer GetNativeSystemInfo WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable GetTickCount64 GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW FormatMessageA MultiByteToWideChar lstrlenW GetModuleHandleW GetProcAddress CreateFileA Sleep DeviceIoControl GetVolumeInformationW GetCurrentProcessId GetProcessId CloseHandle CreateFileW FindClose FindFirstFileW K32GetDeviceDriverFileNameW K32EnumDeviceDrivers GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize GetModuleHandleA InitializeCriticalSectionEx SetConsoleCtrlHandler |
|---|---|
| USER32.dll |
RegisterClassA
GetMonitorInfoA ValidateRect GetWindowLongA DefWindowProcA CreateWindowExA SetWindowLongA SetTimer MonitorFromPoint LoadCursorA DestroyWindow CreateWindowExW PeekMessageA TranslateMessage EnumWindows UnhookWindowsHookEx GetWindowTextA SetWindowsHookExA PostThreadMessageA MsgWaitForMultipleObjects GetClassNameA CallNextHookEx EnumChildWindows IsWindowVisible DispatchMessageA GetMessageA GetWindowThreadProcessId LoadIconA SystemParametersInfoA GetClientRect KillTimer GetCursorPos ShowWindow SendMessageA IsWindow |
| ADVAPI32.dll |
GetTokenInformation
SetKernelObjectSecurity SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorA RegOpenKeyW RegGetValueW RegOpenKeyExW RegEnumKeyExW CryptReleaseContext QueryServiceStatusEx CryptGetHashParam OpenServiceW CryptDestroyHash CryptHashData CryptCreateHash ControlService OpenSCManagerA CloseServiceHandle CryptAcquireContextA LookupPrivilegeValueA OpenProcessToken RegCloseKey RegQueryValueExA GetUserNameA RegOpenKeyExA AdjustTokenPrivileges |
| SHELL32.dll |
SHFileOperationW
|
| ole32.dll |
CreateStreamOnHGlobal
|
| dbghelp.dll |
StackWalk64
SymInitialize SymFunctionTableAccess64 SymGetModuleBase64 |
| bcrypt.dll |
BCryptGenRandom
|
| ntdll.dll |
RtlAdjustPrivilege
NtOpenProcessToken NtAdjustPrivilegesToken NtProtectVirtualMemory RtlCreateUserThread NtQueryInformationProcess NtDuplicateObject NtOpenProcess NtQuerySystemInformation |
| WTSAPI32.dll |
WTSSendMessageA
|
| VERSION.dll |
GetFileVersionInfoSizeExW
GetFileVersionInfoExW VerQueryValueA |
| WINTRUST.dll |
WinVerifyTrust
|
| IPHLPAPI.DLL |
GetExtendedTcpTable
GetTcpTable2 SendARP GetAdaptersAddresses GetAdaptersInfo if_nametoindex |
| WS2_32.dll |
inet_ntop
inet_addr ntohs getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAGetLastError gethostname WSAEventSelect ioctlsocket WSAStartup WSACleanup accept bind closesocket connect getpeername getsockname sendto htons recv WSAResetEvent recvfrom htonl listen freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl WSASetLastError socket setsockopt |
| SETUPAPI.dll |
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiOpenDevRegKey |
| MPR.dll |
WNetEnumResourceA
WNetOpenEnumA |
| d3d9.dll |
Direct3DCreate9
|
| dxgi.dll |
CreateDXGIFactory
|
| discord_game_sdk.dll |
DiscordCreate
|
| CRYPT32.dll |
CertCreateCertificateChainEngine
CertFindExtension CertFreeCTLContext CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertGetNameStringA CertOpenStore CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptQueryObject CertEnumCertificatesInStore CertAddCertificateContextToStore CertFreeCertificateContext CryptMsgClose CertFreeCertificateChain |
| gdiplus.dll |
GdipDisposeImage
GdipGetImageWidth GdipDeleteFont GdipDeleteGraphics GdipCloneBrush GdipFree GdipGetGenericFontFamilySansSerif GdipCreateFromHWND GdipCreateFromHWNDICM GdipCreateSolidFill GdipCreateFont GdipDrawImageRectI GdipAlloc GdipDeleteBrush GdipCreateFontFamilyFromName GdipGetImageHeight GdipDeleteFontFamily GdiplusStartup GdiplusShutdown GdipCloneImage GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipDrawString |
| Secur32.dll |
InitSecurityInterfaceA
|
| Ordinal | 1 |
|---|---|
| Address | 0x7a100 |
| Ordinal | 2 |
|---|---|
| Address | 0x7cd90 |
| Ordinal | 3 |
|---|---|
| Address | 0x7ce80 |
| Ordinal | 4 |
|---|---|
| Address | 0x7a240 |
| Ordinal | 5 |
|---|---|
| Address | 0x7f200 |
| Ordinal | 6 |
|---|---|
| Address | 0x7a3f0 |
| Ordinal | 7 |
|---|---|
| Address | 0x7a490 |
| Ordinal | 8 |
|---|---|
| Address | 0x7a340 |
| Ordinal | 9 |
|---|---|
| Address | 0x7a370 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 2.4.0.7 |
| ProductVersion | 2.4.0.7 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Rascal |
| FileDescription | Rascal Anti-Cheat for Metin2 |
| FileVersion (#2) | 2.4.0.7 |
| OriginalFilename | rascal.dll |
| ProductName | Rascal Anti-Cheat |
| ProductVersion (#2) | 2.4.0.7 |
| LegalCopyright | Copyright (C) 2025 Rascal Anti-Cheat by tokuc. |
| Resource LangID | English - United States |
|---|
| StartAddressOfRawData | 0x10f8061c |
|---|---|
| EndAddressOfRawData | 0x10f806c4 |
| AddressOfIndex | 0x10252eb4 |
| AddressOfCallbacks | 0x11040f38 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x11E4C1F9
0x10079920 0x1015F516 0x1015F59A |
| Size | 0xc0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x10200640 |
| SEHandlerTable | 0x12494e50 |
| SEHandlerCount | 525 |
No comments yet.