e6222ab0fbbe6a74d8db9def7a1bc604ad6455306a83b61290c011651db8f65a

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-29 09:04:40
Detected languages English - United States
Debug artifacts D:\fa\Cheat\x64\Release\Cheat.pdb

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses known Mersenne Twister constants
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • FindWindowA
  • CreateToolhelp32Snapshot
 Uses functions commonly found in keyloggers:
  • GetForegroundWindow
  • GetAsyncKeyState
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 fa0283fb29f93f829599832767d133ec
SHA1 19a8be8dfff283c905f139a3576c52eca4d85509
SHA256 e6222ab0fbbe6a74d8db9def7a1bc604ad6455306a83b61290c011651db8f65a
SHA3 657d55ea28da5f8af2f5568f45eac1b835d320f2019561b2ab5762d7372ad0d2
SSDeep 3072:ywtXQXVVt4zRscL+jW93CQ1BBrgGlkgwQw2tLQrvk40VgbS0chz9lWY074HglE+:yeNRSq9y6dwg+vz20A9n0Kg5
Imports Hash 55a4ec7d8a3d045aaa49915803dd4b33

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Apr-29 09:04:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2dc00
SizeOfInitializedData 0x31600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000162B4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x64000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 1235ee667b707009d87ae29b86930cd8
SHA1 8d4190a23735212a433cc13e3dfc8bffd8bb7ceb
SHA256 1675594f32a918588408be000fd7e63d97ada33ed9c3954730ebbdb4fc0a228a
SHA3 ac77213eac8fd824140856c21a30c7f0066bc04f1b3ee3a805a81ebf00fd81e7
VirtualSize 0x2daa3
VirtualAddress 0x1000
SizeOfRawData 0x2dc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.54909

.rdata

MD5 957614375ed9da58d266fd77de298cf8
SHA1 6e64c9fe08f482343fdf1c547dd821e89677ee59
SHA256 ec1531f7c44e1ebf70232d0e017c1c54a6b6cdaee8ee632047609bd6925272be
SHA3 d6e7d8344384e1923d65c16063805266bd082151af7bc8bff6ad8cd6e105f852
VirtualSize 0x14472
VirtualAddress 0x2f000
SizeOfRawData 0x14600
PointerToRawData 0x2e000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.73149

.data

MD5 d148bc7a423ab1ee5580a1bdec070733
SHA1 39abe638e444b2e6e1b26e1ab7a6335caaaf7d3b
SHA256 1bc0eec150f7d61e7f6f0306d838be742381bb19b338553d8d85d9c7075bcf15
SHA3 ea9d3bf787428ea5b1d402c6b2682869e4869e386b9a18e13c4dc887482295d2
VirtualSize 0x19a10
VirtualAddress 0x44000
SizeOfRawData 0x1400
PointerToRawData 0x42600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.08345

.pdata

MD5 03068989d36d11b1adc650281b87c419
SHA1 9ba5f163994d897b04b3a4388a49cbf900cb1890
SHA256 b2593dcb01b7361eaa37c178497f961c053699f9448880f0aea09177be697c87
SHA3 5a01d4f76e96b5fd1b32dc49662097b4a40a637ad6d599cede8a0bd4ffc0678d
VirtualSize 0x267c
VirtualAddress 0x5e000
SizeOfRawData 0x2800
PointerToRawData 0x43a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.43839

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x100
VirtualAddress 0x61000
SizeOfRawData 0x200
PointerToRawData 0x46200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 ff67f60e977bc1523a669dc80ac47ce5
SHA1 381c48707c88ab805c89a48ba4e787363bee3ba3
SHA256 25df4b7850b9cabe3a32dae42d75cbf04fa5270110f439469c2ffa668ea54cae
SHA3 1873db1ceee62e95977a5726fb82e7ab637f5081ec94626465d4d45770e76700
VirtualSize 0xf8
VirtualAddress 0x62000
SizeOfRawData 0x200
PointerToRawData 0x46400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.52368

.reloc

MD5 5cba5ac958253058ae966da08f9ac5a0
SHA1 8eb72080682cf62d9695632f12e98b571cfe2b16
SHA256 157cca2e393d18c3c3d20865743d82e186cf9a36477a45ea81a886acd67cf276
SHA3 91e934a04c725b911e5307c2c3230957cc2c14eb18183df81108a273f7c93102
VirtualSize 0x710
VirtualAddress 0x63000
SizeOfRawData 0x800
PointerToRawData 0x46600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.12705

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
USER32.dll CallWindowProcW
GetCursorPos
GetForegroundWindow
GetAsyncKeyState
FindWindowA
SetWindowLongPtrW
KERNEL32.dll WriteConsoleW
FlsGetValue
CreateFileW
GetConsoleMode
GetConsoleOutputCP
WriteFile
Sleep
GetCurrentProcess
CreateThread
VirtualProtect
GetModuleHandleA
GetProcAddress
GetTickCount64
VirtualQuery
DisableThreadLibraryCalls
FreeLibraryAndExitThread
K32GetModuleInformation
HeapCreate
HeapFree
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FlushFileBuffers
RtlUnwindEx
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStdHandle
GetFileType
LoadLibraryExW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

Delayed Imports

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x91
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8858
MD5 f7ad1eab748bc07570a57ec87787cf90
SHA1 0b1608da9fef218386e825db575c65616826d9f4
SHA256 d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04
SHA3 6c9541b36948c19ae507d74223621875b3af4064f7cd8200bdb97e15a047e96a

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Apr-29 09:04:40
Version 0.0
SizeofData 58
AddressOfRawData 0x3b5bc
PointerToRawData 0x3a5bc
Referenced File D:\fa\Cheat\x64\Release\Cheat.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Apr-29 09:04:40
Version 0.0
SizeofData 20
AddressOfRawData 0x3b5f8
PointerToRawData 0x3a5f8

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Apr-29 09:04:40
Version 0.0
SizeofData 952
AddressOfRawData 0x3b60c
PointerToRawData 0x3a60c

TLS Callbacks

StartAddressOfRawData 0x18003ba10
EndAddressOfRawData 0x18003f4d0
AddressOfIndex 0x18005cf40
AddressOfCallbacks 0x18002f3f8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180044600

RICH Header

XOR Key 0xf16b2969
Unmarked objects 0
C++ objects (33145) 139
C objects (33145) 29
ASM objects (33145) 20
ASM objects (35403) 9
C objects (35403) 14
Imports (33145) 9
Total imports 121
C++ objects (35403) 38
C objects (LTCG) (35729) 4
C++ objects (35729) 7
Resource objects (35729) 1
Linker (35729) 1

Errors

Leave a comment

No comments yet.