ea7260de16e3261ecfcdc73165e5497382abb3f76d7ac9ae3ad694d8ff225738

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-03 01:51:07
TLS Callbacks 2 callback(s) detected.
CompanyName Pub's Lounge
FileDescription FC27 Showcase Launcher
FileVersion 1.0.0.0
InternalName FC27_Showcase_Launcher.exe
LegalCopyright Pub's Lounge
OriginalFilename FC27_Showcase_Launcher.exe
ProductName FC27 Showcase Launcher
ProductVersion 1.0.0
Assembly Version 1.0.0.0

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .pub670
Unusual section name found: .pub671
Unusual section name found: .pub672
Suspicious The PE contains functions most legitimate programs don't use. Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Info The PE is digitally signed. Signer: Pub's Lounge
Issuer: Pub's Lounge
Malicious VirusTotal score: 19/70 (Scanned on 2026-10-24 04:59:41) AVG: Win64:MalwareX-gen [Misc]
Alibaba: Packed:Win64/VMProtect.a8b61238
Antiy-AVL: Trojan[Packed]/Win64.VMProtect
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
Bkav: W32.Malware.30EA8210
ESET-NOD32: Win64/Packed.VMProtect.AN suspicious application
Elastic: malicious (high confidence)
F-Secure: Trojan.TR/W64.Agent
GData: Win64.Trojan.Agent.F5Z2VZ
Google: Detected
Malwarebytes: Malware.Heuristic.2108
Microsoft: Trojan:Win32/Wacatac.B!ml
Sangfor: Trojan.Win64.Agent.Vvxy
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!8C6C1E2B5E63
TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101J726ZE
Varist: W64/ABTrojan.UYSP-7316
alibabacloud: VirTool:Win/Packed.VMProtect.AT

Hashes

MD5 8c6c1e2b5e6303631808f8d524eb70e5 🔍
SHA1 9599ee86cde78c02dfa31b114c6328b2b5a49e80 🔍
SHA256 ea7260de16e3261ecfcdc73165e5497382abb3f76d7ac9ae3ad694d8ff225738 🔍
SHA3 edab706fe3f9b6cf58013c02e4262afa56d6eec86616a7f517c28ebb404b029e 🔍
SSDeep 196608:9SqmoR1wkhQ+uYACVHLh4swoSahiIqEN89zj+ea6iBaj4jy:9SqNR1wfHCVVxJk9zaeb8jy 🔍
Imports Hash 210fcf454e5398d132e08e28f01bdeed 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 2026-Oct-03 01:51:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2fc000
SizeOfInitializedData 0x2bda00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000B7E4E4 (Section: .pub672)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1187000
SizeOfHeaders 0x400
Checksum 0x830263
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x180000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2fbe98
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1f17ce
VirtualAddress 0x2fd000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x691a8
VirtualAddress 0x4ef000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x3129c
VirtualAddress 0x559000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pub670

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x3cfae2
VirtualAddress 0x58b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pub671

MD5 6c2e07b036a5ce6a19c49011e62b7041 🔍
SHA1 155d875aa4d4fc1fc9e54d2f148d8fd223fc099c 🔍
SHA256 cbfd72bf6cff633a947685e5d14b2f0e5830a6e2f79a4c3c72db40588e2d8ed7 🔍
SHA3 a305ad6bcf52da174fb07ad2ad9d3f8b5ac4ed93f8cfb53098fa4fda228cbfa0 🔍
VirtualSize 0x250
VirtualAddress 0x95b000
SizeOfRawData 0x400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.51827

.pub672

MD5 de2a3d821a7cbb9ceb7d398181b1dd28 🔍
SHA1 dcf95e6ccb8cbaf7dc03b01b74a772b39a976493 🔍
SHA256 86cfe5ffd6b20bb39fa093b8051e0d10ae1f26374d273779fd2249dab51e5a65 🔍
SHA3 f7612a5f33073a23302e92501937a1af4c8a8b9527628fe1019c3cf41595810f 🔍
VirtualSize 0x80fee4
VirtualAddress 0x95c000
SizeOfRawData 0x810000
PointerToRawData 0x800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.8781

.rsrc

MD5 bec2894b251812f86796e3905b5bfaed 🔍
SHA1 e92809ba6762b4c6200899bb234136a26c9ddb49 🔍
SHA256 fd3a595fea924864292557cd6d5d04a38374e55870cd1dca2ba2811184a2be61 🔍
SHA3 694b15af1c6219b45f22be7aed269277ee87476af812786f87d6a10b8551b9a7 🔍
VirtualSize 0x1917a
VirtualAddress 0x116c000
SizeOfRawData 0x19200
PointerToRawData 0x810800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.96622

.reloc

MD5 407174315aad27252b88558203009b1d 🔍
SHA1 394e1d7c013b124dbe513ff32085f2ef25a01f3a 🔍
SHA256 a0f80192b15bcc5eed9284b625a06a5fa191dcedd0a9fc310f19e30186ae0c66 🔍
SHA3 97a75df4ffa76a61b38209491141643e9732b8f03f1d55ffa123afcda7a3a9ba 🔍
VirtualSize 0x48
VirtualAddress 0x1186000
SizeOfRawData 0x200
PointerToRawData 0x829a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.90522

Imports

ADVAPI32.dll DeregisterEventSource
bcrypt.dll BCryptCloseAlgorithmProvider
CRYPT32.dll CertFreeCertificateContext
IPHLPAPI.DLL ConvertInterfaceNameToLuidW
KERNEL32.dll UnhandledExceptionFilter
ncrypt.dll NCryptDeleteKey
ole32.dll CoCreateGuid
WS2_32.dll shutdown
api-ms-win-crt-heap-l1-1-0.dll malloc
api-ms-win-crt-math-l1-1-0.dll log
api-ms-win-crt-string-l1-1-0.dll strcpy_s
api-ms-win-crt-convert-l1-1-0.dll strtoull
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vsnprintf_s
api-ms-win-crt-runtime-l1-1-0.dll _register_onexit_function
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

DotNetRuntimeDebugHeader

Ordinal 1
Address 0x543000

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x33f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.73704
Detected Filetype PNG graphic file
MD5 9df0c030bebd3ea299149d2e59abbaf8 🔍
SHA1 46edf41acf5b7b0a1685fcc467526e1e7bad4e18 🔍
SHA256 03398540f430ea51d005001314cfe3f82025ded1ec8cd12d17340f2bc3a9ca8e 🔍
SHA3 b87b10262877d8298d176492bf3efca00e127c2544f15b87e48e0f9d6e557902 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x639
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.84944
Detected Filetype PNG graphic file
MD5 507248b7548aba53eb21fbafc1aaa7c6 🔍
SHA1 888461c6975c94ad4b0d1c0cd03ba63eff034f26 🔍
SHA256 49c916703b81db17f22b3c716a7658327e4b1b0b4adae10f97fff1edef8fcfdd 🔍
SHA3 97d8ab3af5173e90c3bacd0bfc2eb32310209d809fbe2fe1ff6bf224bf772438 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x9f7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.90373
Detected Filetype PNG graphic file
MD5 6e78ea64b7d6f350f87485796efe6d84 🔍
SHA1 230262d8e0591117f032921bce13170f04125acb 🔍
SHA256 4dba602e96265d3e6dc6d60d46a33751837387eb591f047a11fa6caf9852c682 🔍
SHA3 2f4f5f339fe75639d904cb5733835ec3813c5df45502c0cd8d8e6ea47bf758d4 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1329
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.94355
Detected Filetype PNG graphic file
MD5 b42d1c722da492da0f1033a019e62ea3 🔍
SHA1 848f2a6ec29f13464ae228db0f0a679566c72425 🔍
SHA256 04605f16b9c52ce4a9592bea9ec6b39368d3e424cf69c08442e0558b4957f025 🔍
SHA3 ebfae26327879c771cb15e9aaf65b1838929dadcb8b6ade96fa72a6ad902b640 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1e6e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96417
Detected Filetype PNG graphic file
MD5 3c9196c71d85a985422be2a5a091b586 🔍
SHA1 ac219eb8b312391d63d3fe2ab2489943ebef257a 🔍
SHA256 1273698b0e88a8ad4853b840b96cb0a5867699035151075e6da013223e99fd74 🔍
SHA3 d36dcc5e38e1b22bc54c62f66c0822584a8da8ce5d2e674ea53158a4ec1a4ffc 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x59c9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98678
Detected Filetype PNG graphic file
MD5 238038852faebea5a0826b48cca8d4a1 🔍
SHA1 9d1de0a229f10f539f8e05aeac6a73a2f14ea509 🔍
SHA256 85897c10ba6aed652b341b09eb363305dd715d5f24ad697dd0dd2486794261fa 🔍
SHA3 aa771df551b8f0f10606c714650df5dd6ea306c81b895577dff509ead4a0d436 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea9f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97359
Detected Filetype PNG graphic file
MD5 21c078da529ee8c80cae973f61c31798 🔍
SHA1 47c1d3574c45334f40e2444b12c46390a8638d6c 🔍
SHA256 407ee005d7a784470a76d5494442daf51764979b7f669261b8b43cbd69434b56 🔍
SHA3 fd9d766626578a4d6c9ccc4ae3fb2ec2ae042797c90d87a48adc642bd6a8f0ec 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.70343
Detected Filetype Icon file
MD5 7291ad6513811bda4549f4dc475a9965 🔍
SHA1 9947f4f225e95536bfb4614d1fd97fa2771d659b 🔍
SHA256 fe2dad2e983297f115e7b8c5fcc2593c2ce946cd84851068a069dc22c200000a 🔍
SHA3 9d4a76eecc207882782eb4c2c13e96460e6595e2325d98eb3752f717b02bf623 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x350
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33285
MD5 9e5d7dd3975ea38fc7db292142b31e47 🔍
SHA1 ea7892dca0483126b6e1b9e32da28e02f811d3e2 🔍
SHA256 5692df415056bd4c65aa3544d4d26e1b9e1c44ef2f4af5906eccd7eaddeb4803 🔍
SHA3 018336b8da58433cd5f897f9b02fb4d04720d55d4753b2be182101277aa78e76 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName Pub's Lounge
FileDescription FC27 Showcase Launcher
FileVersion (#2) 1.0.0.0
InternalName FC27_Showcase_Launcher.exe
LegalCopyright Pub's Lounge
OriginalFilename FC27_Showcase_Launcher.exe
ProductName FC27 Showcase Launcher
ProductVersion (#2) 1.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

UNKNOWN

Characteristics 0
TimeDateStamp 2026-Oct-03 01:51:07
Version 0.0
SizeofData 4
AddressOfRawData 0x1138110
PointerToRawData 0x7dc910

TLS Callbacks

StartAddressOfRawData 0x14095b0f8
EndAddressOfRawData 0x14095b219
AddressOfIndex 0x140557ab4
AddressOfCallbacks 0x140c51650
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks 0x00000001411340A7
0x00000001402F6180

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1405439c0

RICH Header

Errors

[*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .pub670 has a size of 0!
Leave a comment

No comments yet.