cdfcd0d3494e5fb8325255403fcf2fc5

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2022-Jun-30 02:19:48
Detected languages English - United States
Debug artifacts C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_VS2019_nondev_m_r\WindowsPlayer_player_Master_mono_x64.pdb
FileVersion 2021.3.6.8233869
ProductVersion 2021.3.6.8233869
Unity Version 2021.3.6f1_7da38d85baf6

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 86.3953% of the executable.
Suspicious VirusTotal score: 1/72 (Scanned on 2024-05-30 21:16:58) Sangfor: Suspicious.Win32.Save.a

Hashes

MD5 cdfcd0d3494e5fb8325255403fcf2fc5
SHA1 8dc16cc5c23cbccecd273f7257899833bec55b78
SHA256 6aca5817a5e860f65a43117a4ad7729a3a51c0379ab52f23f3a00e8d946bdee9
SHA3 9f4fcdbebd739ac4f317cfb927b27b58190675edfebe71f0cb6c66b7cdb38b92
SSDeep 1536:2CF9Q/QXDbVYcxz63BYnBUCsyaVxYDXosWkd09dl0S6lGzI7GqmSErVluu:xQ/EJhz2WnBUCsyYYDbMmSoH7G2E1
Imports Hash 5f74a5c747508e2822fdb9b687deaf42

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2022-Jun-30 02:19:48
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xa200
SizeOfInitializedData 0x96600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001260 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa5000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 43e962188de594e469b200641672762f
SHA1 fcbfebfb9477168fc5081289707ffa6d58c93530
SHA256 d9efd13dd0f5eb2941ea9a2eb8511e0bacf3cf23f14513be16e4efff9ddf41b4
SHA3 68638e60dd19624f0ba95527528cc343a356b77b8618df6a20dbdd57c8106f4e
VirtualSize 0xa140
VirtualAddress 0x1000
SizeOfRawData 0xa200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.39721

.rdata

MD5 d888b18c9d90134caba3558959b988c7
SHA1 499588f6fb13643287da1013e154ab7cd1475a2d
SHA256 090a8aa4ad0f99f3b92df15b9703b028de36acd3b1b38835c3b510eb2bc2e4bc
SHA3 ae461df5513a57187ca32c07fe9386381b519a87100a73fd85980d32461fc221
VirtualSize 0x8cbe
VirtualAddress 0xc000
SizeOfRawData 0x8e00
PointerToRawData 0xa600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.65326

.data

MD5 2e9924c581c86e57e2e2b0ac87e1aa45
SHA1 a1a176fc5c54e8c996a328e810c15c16cdb5b73d
SHA256 90b0d83be28bc06320f7b2ce10f056ecd17badc2e84e2b1533c0454096a1e5a0
SHA3 8c3bb6dfd1204e833639461f26a41ad45e7fa68dcdc97aa4908992d272dc2237
VirtualSize 0x1ce8
VirtualAddress 0x15000
SizeOfRawData 0xc00
PointerToRawData 0x13400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.6801

.pdata

MD5 a2c626c94e0874a52fc60c6fb5946162
SHA1 6c87be30407854e47baabad24730de02f4c197cf
SHA256 ebe0fbac293026e15cfcb6794e2892b6d1d07d940f89bf1a2294b1e7b5bb795a
SHA3 60674d80e0fd5ed9fe7de19a14d3f29a5bf4970e8b77f5d946634eec07122c57
VirtualSize 0xc54
VirtualAddress 0x17000
SizeOfRawData 0xe00
PointerToRawData 0x14000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.34559

_RDATA

MD5 1960efd573f3d23522c840210d59fb7e
SHA1 47057bb39ae6c80b68d90c47f0cfd7d6bf123ad2
SHA256 ad5bd98e9035110e2e2e7b82ed2fe49ec0fae2d89e05400528a6b48804c441a4
SHA3 225389cba41c0a9e2c3319b0921ec1ef9962e8af175fca30c67bde60763834d4
VirtualSize 0x94
VirtualAddress 0x18000
SizeOfRawData 0x200
PointerToRawData 0x14e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.08512

.rsrc

MD5 477ec299a6133c6ecbf9e74c37028c54
SHA1 96ffca64b0b0c524d39548f3bb3eb6a968ebdeb0
SHA256 6909f8f2ff9323181ac9c465ed4d88c919c5ec73df196d3f02b366a83ecf5373
SHA3 84f1eac18f3be86c341bd6b24df2f3dea61f6633e9788a495d81630526a6630f
VirtualSize 0x8a148
VirtualAddress 0x19000
SizeOfRawData 0x8a200
PointerToRawData 0x15000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.51366

.reloc

MD5 687aa942cda2e64adc67a829f1587240
SHA1 26058e365b4fef9cae39c529017700cd0ccfedb7
SHA256 e5b51406ab27a5065a374454ac72e242a50072d670957430f820af90f479b506
SHA3 8a51aae6ca0ea13d9513cba0336e2446957914c5ba6561a337c3afdf42f3c689
VirtualSize 0x638
VirtualAddress 0xa4000
SizeOfRawData 0x800
PointerToRawData 0x9f200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.79086

Imports

UnityPlayer.dll UnityMain
KERNEL32.dll WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x15004

NvOptimusEnablement

Ordinal 2
Address 0x15000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.34755
MD5 835061d318c16286fe24506da2a5b0e8
SHA1 fe4319971afbaac3336ab68bb8804da84d2f0617
SHA256 7025a4e9d4ae5f30a0aa18cabba0f11f62531c0bfdec1fd85d42717cf94fcae2
SHA3 f312eb1a0fa886d57f47444817e0503d1645c4ea797fb095ba993822fffc9a5c

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.41352
MD5 dad3f972710d856da9d1728ed9ff26de
SHA1 f044291574e3b852a628b48c5c97a94d8896d317
SHA256 a591ec0eff36611f44e6916eb973ee6f94a2b0b42edf47cadb318af07f9e60b0
SHA3 c7ebe5481b1f1261588659685063e044bf6d260037c17d5f48b2a1f5d141ac2b

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.50302
MD5 911109fde0f365988e0f835d615a1578
SHA1 5248e01aa74e90a44d7a8dd97fe44bd138c29788
SHA256 97671b57e650569ebf108db78e917862208f1044bea9ec2879f3a4f00bea5f12
SHA3 7672c18b098e0ae8d0335e13048797976b027bb9b84e80e919ca59cc66c80442

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62141
MD5 15988a6b07717785da47bd93ecd4328a
SHA1 afbbe35e0c2885b7481c2b1cf3572d8cd04c6534
SHA256 39adebaa6f932b7490a9c3f18830c1e4af8986fcbe8148ee2c275a916cbae042
SHA3 b515d74138b0cd8fd6644e09536e998b392a50ff8ed8067c04cc081eada46420

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.09752
MD5 d66bb26dfc2e29737080857e993c1ee1
SHA1 a931c380f8bcbe031c27ffefaef8e69841384565
SHA256 7c35fb58603fe4701c3afaa7afa92a9451c8afa3cb43d38737a16bea22733cf0
SHA3 08d6bdd76e1e49f86462028f31a6989e094559d23c6c9cca35d05ecc64b8cac6

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.99856
MD5 f33411df1d0be871b99c775f56600d55
SHA1 dbac7d4f4725d9b7b242929329d2263f7d3d2994
SHA256 8332a757c8c1c5d78ab5ab26dc40ffb56f8704c9ab214c95983c115a34d3694d
SHA3 eeeaec81477154a65d1593dcd3aa02cd461839b25003ab2eaaf9968ea1ec99ec

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25684
MD5 3ecf28ba61f4cae9a0231cf13a443806
SHA1 2bc549a52b91b00e3190d36c941b4386cfbf3f76
SHA256 73a75ccc43f626b3647174ae75d84a5c43fd2bb73f0d8bb2f6b02245504b1fca
SHA3 570475454c5d6310e5c141088fb6c186d23ad2b3eb548ce5acec8ba2bfa3bd0a

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4393
MD5 fe45a4ddd5872687a3bd509411e93c8d
SHA1 3666d781f10f668f71fa530618e4a6c105595de9
SHA256 3111f74c44d09072fc8f5a9ddf2d79f45ba95839c209dc7c1489149153b4d9a5
SHA3 b5866e3ab169f9d8ab6e703db90f9671c13126a94c37cef7eca7015a9dbddb2b

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.61501
MD5 85fbab50f9065a80a713add7c11ad7ee
SHA1 fe40afa6c9671787869de717e06e7f512b9915c6
SHA256 9bc18b4aa30bc4e8801df6e07e1574a75a71da4ce383c82645be47fb6acef5ee
SHA3 ac0f480fdcd4023d475c7f8c96145be94bcb662dca2c1a921fb207a4f31cfa2c

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 f7731730720cfe035cf030b40d0e2eb6
SHA1 d046e23f2ee2b93ad96be8e1dc9120ecf3915091
SHA256 5c92a41adaf3265071482fd1a182ae8702c168636a7d9ff51798ee3a1dfc8500
SHA3 6f2d12e4c63c131a3f7f48293996e2be05da351536d013affe5d2265965ce657

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43445
MD5 88c948329329402c6941e05e1a07f880
SHA1 6353d502d1b64137d35029d311ee429992560464
SHA256 9a132466a37cd8bd5a42b34a8642c567bf7e57c3875ddbae4ba5991cde4941c5
SHA3 a36ca36b71160a205523b57268caf1018f51e118b17d9c1b33ade6972220ac9f

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x6c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37708
MD5 aab7e8aafe7b06ab3d003b54ab5e18ed
SHA1 dccf0408f43059df37b755f3241a8b4b35c728af
SHA256 fb88b19523afd8fed48eddfd10805a3a0a45997bbf8fac04d595ddf93c1a88a8
SHA3 a981b8e907b79cd9448766ace938dfd96560d11c29e6ba165912a8508bd52ca7

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2021.3.6.41869
ProductVersion 2021.3.6.41869
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 2021.3.6.8233869
ProductVersion (#2) 2021.3.6.8233869
Unity Version 2021.3.6f1_7da38d85baf6
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2022-Jun-30 02:19:48
Version 0.0
SizeofData 139
AddressOfRawData 0x13780
PointerToRawData 0x11d80
Referenced File C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_VS2019_nondev_m_r\WindowsPlayer_player_Master_mono_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2022-Jun-30 02:19:48
Version 0.0
SizeofData 20
AddressOfRawData 0x1380c
PointerToRawData 0x11e0c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2022-Jun-30 02:19:48
Version 0.0
SizeofData 712
AddressOfRawData 0x13820
PointerToRawData 0x11e20

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140015030

RICH Header

Errors