f36e75b3cc42980348a51f68b2adf00114767bd1c91a9b2bbceb90138862bb3a

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2019-Aug-24 09:11:59
Detected languages English - United States
LegalCopyright (c) 2005-2025 Unity Technologies. All rights reserved.
FileVersion 2022.3.62.1451004
ProductVersion 2022.3.62f3c1 (1623fc0bbb97)
OriginalFilename d3dcompiler.dll

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .pkzd1vw
The PE only has 1 import(s).
Malicious VirusTotal score: 15/68 (Scanned on 2026-11-04 08:49:45) Arcabit: Trojan.Loregun.16
BitDefender: Gen:Heur.Loregun.16
Bkav: W32.Malware.77E2655C
CTX: dll.unknown.loregun
CrowdStrike: win/malicious_confidence_90% (D)
Cylance: Unsafe
Elastic: malicious (high confidence)
Emsisoft: Gen:Heur.Loregun.16 (B)
GData: Gen:Heur.Loregun.16
Gridinsoft: Trojan.Heur!.022120A2
MicroWorld-eScan: Gen:Heur.Loregun.16
Microsoft: Trojan:Win32/Wacatac.B!ml
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win64.Dropper.nc
VIPRE: Gen:Heur.Loregun.16

Hashes

MD5 a524730e6bce0bf4201fc90192d18da2 🔍
SHA1 48ee126a971b0c4fa5a38ebf8d8a62d047dd6007 🔍
SHA256 f36e75b3cc42980348a51f68b2adf00114767bd1c91a9b2bbceb90138862bb3a 🔍
SHA3 1889fce0b813eee2af83b848d529c27b7b26bde21c12aa2e645759913a00ddcd 🔍
SSDeep 384:yZISHVAOv0UZH+xPahQkY1HwtRgoo49R4VEKqzt95i4mHNMLlQAHcxi:yZISiOMAH+dYQBQfgS9ReEfiFnicxi 🔍
Imports Hash 8e5b0635c5eb4b0cde6c35a3a62d9e0f 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 2019-Aug-24 09:11:59
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x3000
SizeOfInitializedData 0x4600
SizeOfUninitializedData 0x16200
AddressOfEntryPoint 0x00000000000017F0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x208d40000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x24000
SizeOfHeaders 0x400
Checksum 0x15d13
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 144cc7a7555332b33ff240818833b8b9 🔍
SHA1 5688a389b9f43f9451cb0adb3f998993b69b71a0 🔍
SHA256 e78ea89bd44a355b73823b5fcb5c4fd3e4a820c37ada6972ffbef11603ce4351 🔍
SHA3 55f0aeb51206a0cc407dade823e13fd47d7b5de9716caba7b0a38b45e811e963 🔍
VirtualSize 0xf00
VirtualAddress 0x1000
SizeOfRawData 0x1000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.98614

.pkzd1vw

MD5 c5e6a2e67691b4c48f15ff1e63755530 🔍
SHA1 9c5dc8c50adb894eb5bb921555bcf924d1468b9e 🔍
SHA256 57f5ca8bf3f9b9c3cf64ad45b90322aedbe1c12241c1993c20ed51dc27b4f1b4 🔍
SHA3 0fce637206fbf74e805075fd24535f10ac3bbab6400d4b8e77d3d827b180fc1e 🔍
VirtualSize 0x1e80
VirtualAddress 0x2000
SizeOfRawData 0x2000
PointerToRawData 0x1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.85719

.data

MD5 25705e41cc45b0a57cd131091fe17acb 🔍
SHA1 c596f9f53686ec7d125a1b9b9b146ff1e45bed73 🔍
SHA256 998a43672b8f1ce93071c02dde4aa5d7fca1fee799eb9002dd2fe36e1337cffa 🔍
SHA3 db5994535b4aff374618bffb8eeb75080480638470f6bce613276179a1dac3dc 🔍
VirtualSize 0x3a00
VirtualAddress 0x4000
SizeOfRawData 0x3a00
PointerToRawData 0x3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.97879

.rdata

MD5 e092b685dfb1123ef4566ba4e5c00e80 🔍
SHA1 31210d50bedbe8d472d3915c5a993193cf766b8a 🔍
SHA256 0fc3d9cab74a4868b18d78b7d203ccddfddc044d4c9cf9458cea89714531e164 🔍
SHA3 144ead1d5af425d14e3fa8cf7a749c2b372420e5d9385a3c74dac666e991b868 🔍
VirtualSize 0x170
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.74903

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x16140
VirtualAddress 0x9000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata

MD5 c91d5d7f3125e962bc1cbe892fe09644 🔍
SHA1 48dbf5d08fb33865e50dc3a5790f25ae7707b3e3 🔍
SHA256 bdc9b08bce82ff01b0a20255173abc18d2ed9db2ef84f2e66dbdff506cae9ee2 🔍
SHA3 26da84b599d4333e8c982d2d5b48121be808098be864fb1c03a08d92914edf42 🔍
VirtualSize 0x52
VirtualAddress 0x20000
SizeOfRawData 0x200
PointerToRawData 0x7000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.827142

.idata

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x18
VirtualAddress 0x21000
SizeOfRawData 0x200
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.didat

MD5 7ce62cc48efe9fe84f8974b048676aea 🔍
SHA1 b543e8e52e7047162c87b97e40cd39be5246010b 🔍
SHA256 0af075d4cd0c381d58d1db4ca6d31ecf4347e51fe18ec7085ab2a06a881c32d3 🔍
SHA3 4e62108c23dc7dcb848bfb26ac97116bb374328d734939dd8167efc702a838d4 🔍
VirtualSize 0x6e
VirtualAddress 0x22000
SizeOfRawData 0x200
PointerToRawData 0x7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.878755

.rsrc

MD5 c3a30ce8d542646d88fbd2a77cebedc4 🔍
SHA1 e4ec3889679d7d54a220b3377ebc03bf8a4d9c38 🔍
SHA256 f9e8187f4744ac47596610e8dc12a1659c21d5bf5b6803b81f3222a2362ac8d1 🔍
SHA3 3fa87e84be4822826055765e767e9762a8bb107e0a6f536eecce6f02cddde445 🔍
VirtualSize 0x2b4
VirtualAddress 0x23000
SizeOfRawData 0x400
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.07802

Imports

shell32.dll CommandLineToArgvW

Delayed Imports

LoadUnityData

Ordinal 1
Address 0x3d60

1

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x25c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.59656
MD5 5d1ae3cc1565953b4283f3e76cbd3493 🔍
SHA1 1d236c17591621a424626e2fd548d34c4d46e8b6 🔍
SHA256 086217b50e173531b2abfa1689df940bdfc18fff7982fffefeb00663ccfd08c4 🔍
SHA3 2375abc2ab3690d25d04d1aff30f08537b469e8b0f0e0f9a4f0fdd63b1564557 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2022.3.62.9212
ProductVersion 2022.3.62.9212
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
LegalCopyright (c) 2005-2025 Unity Technologies. All rights reserved.
FileVersion (#2) 2022.3.62.1451004
ProductVersion (#2) 2022.3.62f3c1 (1623fc0bbb97)
OriginalFilename d3dcompiler.dll
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.