cee8b37a4a53088d949e7bf558c510a2d839514f74176ad1346b3ed113c76e83

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Oct-14 20:08:03
Detected languages English - United States
Debug artifacts C:\Users\Monark\Documents\Lootline_v1.4_source_[unknowncheats.me]_\Lootline\x64\Release\Lootline.pdb

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • Virus
  • exploit
  • virus
 Contains domain names:
  • cs2-sdk.com
  • csfloat.com
  • github.com
  • https://csfloat.com
  • https://github.com
  • market.csgo.com
Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • WriteProcessMemory
  • OpenProcess
  • VirtualAllocEx
  • CreateRemoteThread
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Memory manipulation functions often used by packers:
  • VirtualAllocEx
  • VirtualProtect
 Manipulates other processes:
  • WriteProcessMemory
  • OpenProcess
  • Process32NextW
  • Process32FirstW
Malicious The PE is possibly a dropper. Resource 201 detected as a PE Executable.
Resources amount for 97.7824% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 17ba60fd52d2a13e5b6b794a17c80737 🔍
SHA1 89adca2fcd5aee9572a1821573940c5a26fffc92 🔍
SHA256 cee8b37a4a53088d949e7bf558c510a2d839514f74176ad1346b3ed113c76e83 🔍
SHA3 65d4ff2e384e9e6d580174635878fddde7d1cab616a54b987ec45a0ba3fd9eca 🔍
SSDeep 393216:n+nR0VKh6JKS2cvMwwLoO0iuHnFWyQZ435N6Icp3JU7H2u3AL3d1QambftbCEnM:nqR0QhanMBUOHuHF 🔍
Imports Hash 865788e49a5921ef3332ecbbd4dff3d8 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Oct-14 20:08:03
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x30000
SizeOfInitializedData 0xcee200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000E088 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xd22000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 58eea330585a0fa5ab45bcc55b2234fe 🔍
SHA1 29923f357b207f9b23963195c4138dc5730177e3 🔍
SHA256 21c9dbc7a61045a1e460febfa1c59c5a138f9973eb65197105937a9e0b423ffe 🔍
SHA3 01f21d4cc95cfa840f3de85ee8bc44f97f200e71efb695b91ed99ea749dce89a 🔍
VirtualSize 0x2fea0
VirtualAddress 0x1000
SizeOfRawData 0x30000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45984

.rdata

MD5 180a0eafc0223736e2465b5a8a4d9bee 🔍
SHA1 0fafe3d422ddfb5909b6a5003ca692a05325d4c3 🔍
SHA256 0f38220bae32c2699490b3442e3500b64a7ad2751af30ad18573a68b1890841a 🔍
SHA3 131c64b0cbc09dd076a7c768276c0b0545613ed590d67acb47a23aa398749e1f 🔍
VirtualSize 0x15230
VirtualAddress 0x31000
SizeOfRawData 0x15400
PointerToRawData 0x30400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.01113

.data

MD5 69e42fddc2a1d15d1723bd666b49b3f8 🔍
SHA1 3c101ec0665016fb4906070c2ce2c36476cbc6cc 🔍
SHA256 9d32297a24eaf495d54b06775cb59ea5f6f245d3178fb54669b5c2e4b50c40d2 🔍
SHA3 f50d0023f60a7f97c0605e27df78d621b451803ce68e9a1ceef8f14dbb82c246 🔍
VirtualSize 0x2b48
VirtualAddress 0x47000
SizeOfRawData 0x1600
PointerToRawData 0x45800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.87629

.pdata

MD5 c4d8646e5431834a0763a193e0a684e5 🔍
SHA1 6ca05468976fa09af9b0b7dcc55c277fd2ea74d8 🔍
SHA256 ba60d04ccfae4dd106c3462dd9311a455d8cb58c6fae3ac6bff5849f591381a2 🔍
SHA3 74abeba124db1c5b29a5c90a530415c842e92e4e28ab71aff3dbabd27c00268c 🔍
VirtualSize 0x2a00
VirtualAddress 0x4a000
SizeOfRawData 0x2a00
PointerToRawData 0x46e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.46413

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x4d000
SizeOfRawData 0x200
PointerToRawData 0x49800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 1b9ca64c75970d28aeb9f388be6fa541 🔍
SHA1 4a4d359e18fa9638bda198aea99c3f1cec5d33f3 🔍
SHA256 6583ce55a1483168016b19cf4fc782ab77a7125ddb2c806340cb8b9ad086f462 🔍
SHA3 9b83afb2930b9debb25255a6752fea7eb5367990639e3ed78d00c4319d180afe 🔍
VirtualSize 0xcd2b50
VirtualAddress 0x4e000
SizeOfRawData 0xcd2c00
PointerToRawData 0x49a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.1966

.reloc

MD5 630351c059b2a3923800f9117cca4960 🔍
SHA1 044310ba6d7bb54e9f0567d7b28ace7794fe5b53 🔍
SHA256 a8929909a76bf2493af2b21aa1f3deed901dad3666d6297b2f334899d3dfddeb 🔍
SHA3 0fdc8a9d7df354228fe1025ede111ad8fdc21f04abcb2b79bced2cb259afc7b5 🔍
VirtualSize 0x9bc
VirtualAddress 0xd21000
SizeOfRawData 0xa00
PointerToRawData 0xd1c600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.39117

Imports

KERNEL32.dll SizeofResource
WriteProcessMemory
GetModuleFileNameW
GetEnvironmentVariableW
GetTempPathW
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Sleep
FormatMessageW
GetLastError
Process32NextW
LoadLibraryA
LockResource
Process32FirstW
CloseHandle
LoadResource
FindResourceW
Module32FirstW
GetProcAddress
VirtualAllocEx
LocalFree
GetModuleHandleW
FlushInstructionCache
CreateRemoteThread
Module32NextW
VirtualFreeEx
SetConsoleTitleW
SetEndOfFile
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
ReadFile
ReadConsoleW
SetConsoleMode
ReadConsoleInputW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
HeapSize
RtlUnwind

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2bb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.59574
Detected Filetype PNG graphic file
MD5 21e1fd6e9e25891ef0de36e1c1fe1ba9 🔍
SHA1 13e2f85a9faf83ba0eb2baeca4b55c6fd8c65cb4 🔍
SHA256 019d3130948073166d9562b788055e841169657ef9d2819eacf613445f016c5a 🔍
SHA3 44d1874e8704bd8cb4f50e1d3427b670ba67ec7e246f06553cdc4232409a6131 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x455
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.79906
Detected Filetype PNG graphic file
MD5 b9fa9d89d34ad4e8b794de53b9975ab0 🔍
SHA1 ccdd118fff9c55def880ad44f87ad2aad58ab561 🔍
SHA256 5e083e5a5469bf28a97e95f424cd0a1090694c03946a9749d6b39ddd8a34dd4e 🔍
SHA3 9ead83d5f26b8e8836bf1f6006aa42e54c6d8195a7846b5b34c974513c7517f4 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5e2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.83852
Detected Filetype PNG graphic file
MD5 a25ada16c6e20ee4c93fbb93c7684a90 🔍
SHA1 5b33678f01db029f136848227baeaf00b336467d 🔍
SHA256 a30d1136d5b5ebe5c47c96c7656c2998f3cc0a4587a26fd711c2242ecdbc84bf 🔍
SHA3 9384d1be6db2a4b5b3128206f0522e81e7030ef6e708c963d37c836a05487e9d 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x844
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88734
Detected Filetype PNG graphic file
MD5 e6a7a39167523d6d2382a5bdd8e141f5 🔍
SHA1 5e24a86853f9718cef97ea7a067dd4f698cbd76a 🔍
SHA256 84c747ff7eb9c94ab90b6da4e9585d7000f24237ce1712c44e71e758b995e906 🔍
SHA3 6c2145f31a675057624d1ec221c6979c116b6af5b182e22a8632f2a6d10053aa 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xb67
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.91615
Detected Filetype PNG graphic file
MD5 30f72cfd7380693cddfe688a6c0788bd 🔍
SHA1 7420f47a3abb7928228b06155630f444bce93072 🔍
SHA256 af7cd2767986126017d0f055bfd0deab88bc626b5fbb2bb8f76f223fb0fb6dd5 🔍
SHA3 ea0c4f09480b759177af8725726b5170a2ec7aca296000163c1b9a6409b4881a 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95233
Detected Filetype PNG graphic file
MD5 28b0b2b169aa0f5e2e48e7a409d9f3ca 🔍
SHA1 a5202f04ca7711320d80d168393550b797950094 🔍
SHA256 d3d880f1ccc470f37898d2ed1c35d89fc794e6d603ae4865160722e7c02eba6c 🔍
SHA3 92441209a86e5dc6bcffe74795b9c677787f761df66f6ac5f93d67ade36927d2 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x766
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.4504
Detected Filetype PNG graphic file
MD5 2815b2e7e8e28d0e9c86cbc27987417f 🔍
SHA1 f3ba1418c538f94871a7fb766b2e9fb3c8a49766 🔍
SHA256 bfd99461aa9b410292a62251d58bf242be718dc5ca15df2d09a010625b6711a4 🔍
SHA3 d8d09b96882cb8450a82033601421b6f8cd4a0f7e37da5d4d524f69fc6445f63 🔍

201

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xccea00
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.19513
Detected Filetype PE Executable
MD5 df2e622fb80ba6aae1fc437e5a897762 🔍
SHA1 f7efa0ea5c584ed5d62bd43eac1781b18fde86b8 🔍
SHA256 6c9323343818b065860a238a6e0d776fb347df85fd710c4a6f49325a604737e9 🔍
SHA3 9006b358f3bacd1f9e2c6c36c01096a92df5754df647cd045b224ddfb2e93a3f 🔍

101

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.89478
Detected Filetype Icon file
MD5 877a35f7504afe11c67579f8cc7f66f9 🔍
SHA1 73a1a9ca8aabcd23cd6fe2e54487d348963880ed 🔍
SHA256 61d00aa21715b68775d790ad8d688b312fc3265831f3cdc218aedd383828e222 🔍
SHA3 896ac048d7246bfbbb04d3cee7aa5f03376e2823d929d2962dc08439c8f10636 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Oct-14 20:08:03
Version 0.0
SizeofData 125
AddressOfRawData 0x41a3c
PointerToRawData 0x40e3c
Referenced File C:\Users\Monark\Documents\Lootline_v1.4_source_[unknowncheats.me]_\Lootline\x64\Release\Lootline.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Oct-14 20:08:03
Version 0.0
SizeofData 20
AddressOfRawData 0x41abc
PointerToRawData 0x40ebc

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-14 20:08:03
Version 0.0
SizeofData 920
AddressOfRawData 0x41ad0
PointerToRawData 0x40ed0

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Oct-14 20:08:03
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140047080

RICH Header

XOR Key 0x4bc11563
Unmarked objects 0
C++ objects (33145) 177
C objects (33145) 17
ASM objects (33145) 8
ASM objects (35207) 10
C objects (35207) 16
C++ objects (35207) 81
Imports (33145) 3
Total imports 148
C++ objects (LTCG) (35211) 1
Resource objects (35211) 1
151 1
Linker (35211) 1

Errors

Leave a comment

No comments yet.