| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Sep-04 12:13:32 |
| Detected languages |
English - United States
German - Germany |
| CompanyName | Online-Fix.Me |
| FileDescription | Steam Overlay Loader |
| FileVersion | 1.0.0.1 |
| LegalCopyright | Copyright (C) 2019-2023, 0xdeadc0de |
| ProductVersion | 1.0.0.1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 4/72 (Scanned on 2026-04-03 20:16:48) |
APEX:
Malicious
Gridinsoft: Risk.Win64.GameHack.bot Malwarebytes: RiskWare.GameHack Webroot: W32.Malware.Gen |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2023-Sep-04 12:13:32 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xfa00 |
| SizeOfInitializedData | 0xde00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000002DF8 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x22000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
CreateFileW
LoadLibraryExW ExitProcess CloseHandle WriteConsoleW GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx |
|---|---|
| USER32.dll |
MessageBoxW
|
| ADVAPI32.dll |
RegOpenKeyExW
RegQueryValueExW RegCloseKey |
| Ordinal | 1 |
|---|---|
| Address | 0x1650 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.1 |
| ProductVersion | 1.0.0.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | German - Germany |
| CompanyName | Online-Fix.Me |
| FileDescription | Steam Overlay Loader |
| FileVersion (#2) | 1.0.0.1 |
| LegalCopyright | Copyright (C) 2019-2023, 0xdeadc0de |
| ProductVersion (#2) | 1.0.0.1 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Sep-04 12:13:32 |
| Version | 0.0 |
| SizeofData | 752 |
| AddressOfRawData | 0x18fec |
| PointerToRawData | 0x17dec |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Sep-04 12:13:32 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x18001b008 |
| XOR Key | 0xc02eccb1 |
|---|---|
| Unmarked objects | 0 |
| C objects (27412) | 11 |
| ASM objects (27412) | 5 |
| C++ objects (27412) | 133 |
| C objects (VS 2015-2022 runtime 32533) | 15 |
| ASM objects (VS 2015-2022 runtime 32533) | 9 |
| C++ objects (VS 2015-2022 runtime 32533) | 34 |
| Imports (27412) | 7 |
| Total imports | 88 |
| C++ objects (LTCG) (VS2022 Update 7 (17.7.0-3) compiler 32822) | 1 |
| Exports (VS2022 Update 7 (17.7.0-3) compiler 32822) | 1 |
| Resource objects (VS2022 Update 7 (17.7.0-3) compiler 32822) | 1 |
| Linker (VS2022 Update 7 (17.7.0-3) compiler 32822) | 1 |
No comments yet.