fe243f05c9ff30e951a9b63e715b7f1b

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2018-Oct-13 20:40:13
Detected languages English - United States
Debug artifacts e:\PlayspaceMover\x64\Release\PlayspaceMover.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
Safe VirusTotal score: 0/70 (Scanned on 2018-12-16 09:40:00) All the AVs think this file is safe.

Hashes

MD5 fe243f05c9ff30e951a9b63e715b7f1b
SHA1 4ae57d0e4e2b9180b484fa2fe698bafc9689591d
SHA256 89b6a313027df91fc55859de6064d07cb73952871508c27e7c1293a4a44884d5
SHA3 1c623232a1624b945b265123d6a31846a41965fc02568dde584062c2f86aea33
SSDeep 6144:gjVbtZLR2+EZ7SpSNdjAz4Op35COK4U3QNI:8LR2+cjROp3gOK4pNI
Imports Hash 300423ae93745363145c5409d089ec78

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2018-Oct-13 20:40:13
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2e000
SizeOfInitializedData 0x1b000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000002B688 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x4d000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 8cc778d796161cd15780456dd8340f10
SHA1 8d363caca7c9905709bd8365e24ed7481a52cb5b
SHA256 1265baafb2e325bebeeb23858025aa8999715156c123cc6f1981416e47dd6e63
SHA3 5c56cc84d76cc9eb69c821cacd91d06756f1e9dbefcf10928b8fcb54f6b30357
VirtualSize 0x2def0
VirtualAddress 0x1000
SizeOfRawData 0x2e000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.29605

.rdata

MD5 dcd037016d09856831f5bf05640a6217
SHA1 233f531a4ebc1ea6e79619393b960436c3f3eacd
SHA256 8351f320a0b89be1cf7d643cde54f8e083d5882a38fa217575427a623636e9de
SHA3 7e74f98d876928a3045938d5ac169a5c4821a28957a8e4124135ca2315e4bebd
VirtualSize 0x13488
VirtualAddress 0x2f000
SizeOfRawData 0x13600
PointerToRawData 0x2e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.50672

.data

MD5 12c95dff7a5ad467325f44a62d78eb2b
SHA1 b9b9c4520ee3098a38ca91b5024e6968e4b8ec58
SHA256 89f40aac9fd080c39aa2c82eb3baf37d52afe013d5bf6d606e6d816c04385dfe
SHA3 60522e0378555e70774fca7fa83572c1b7996fe299599acd9dd0f6e471741d09
VirtualSize 0x4848
VirtualAddress 0x43000
SizeOfRawData 0x2000
PointerToRawData 0x41a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.47459

.pdata

MD5 90028cbd19ac4b4435d715305202c958
SHA1 0e883eab3210868e14e6460fdbb9980073cc98d1
SHA256 1d653229bc64ad4a184c77d4025e875c59621ce1c29f20c0e5b1c74caff05a79
SHA3 28d33a9e1cb9d8b21be5176194fefa4c54375a3e241e818f37619cb69485cc9a
VirtualSize 0x26ac
VirtualAddress 0x48000
SizeOfRawData 0x2800
PointerToRawData 0x43a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.36676

.rsrc

MD5 6a3b0c086bc2f5ade0c75f4ec6f67f3e
SHA1 ba4974446baf31fd1a01e5ec71e49c643759f427
SHA256 8f4e5b5e97ea92bfd87d91076b6ed449c7bc42b24e6f81c3cca882c854bccfb3
SHA3 a2befdcf7078c955ae591e33434c9224b9f501056da6831f89d8868972440180
VirtualSize 0x1e0
VirtualAddress 0x4b000
SizeOfRawData 0x200
PointerToRawData 0x46200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71377

.reloc

MD5 6a28da2503e3bbf11f03d202aa523848
SHA1 9f5efd1fec60e5172f4b2dd584c8874657169c89
SHA256 13777af452bf1d831079ddb4389e0a0ad15f5ba0a2c099e950646107c0bbc0f6
SHA3 977ded23a34458658bac4183af739578b15c010cca39f83abaaf228768d004f3
VirtualSize 0x4d0
VirtualAddress 0x4c000
SizeOfRawData 0x600
PointerToRawData 0x46400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.83831

Imports

openvr_api.dll VR_GetInitToken
VR_ShutdownInternal
VR_GetGenericInterface
VR_GetVRInitErrorAsSymbol
VR_IsInterfaceVersionValid
VR_InitInternal2
KERNEL32.dll GetFileSizeEx
FindFirstFileA
SetLastError
GetCurrentProcess
ReleaseSemaphore
WriteFile
FindNextFileA
SetEndOfFile
FindClose
CreateMutexA
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
DuplicateHandle
GetModuleHandleA
GetLastError
GetSystemInfo
CloseHandle
SwitchToThread
GetProcAddress
SetFilePointerEx
CreateFileMappingA
LocalFree
RemoveDirectoryA
GetCurrentProcessId
CreateDirectoryA
FormatMessageA
CreateSemaphoreA
GetTickCount
MapViewOfFileEx
GetProcessTimes
Sleep
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetConsoleCtrlHandler
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateFileA
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
GetModuleHandleW
InitializeSListHead
RtlCaptureContext
GetCurrentThreadId
ADVAPI32.dll ReadEventLogA
RegQueryValueExA
CloseEventLog
OpenEventLogA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
MSVCP140.dll ?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Cnd_signal
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
_Mtx_init_in_situ
_Cnd_register_at_thread_exit
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Cnd_wait
_Mtx_init
_Thrd_start
_Thrd_id
_Mtx_destroy
_Cnd_init
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@O@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
_Strxfrm
?id@?$ctype@D@std@@2V0locale@2@A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
VCRUNTIME140.dll __CxxFrameHandler3
memcmp
__std_exception_destroy
__std_exception_copy
_purecall
__std_terminate
memmove
memset
_CxxThrowException
strchr
__std_type_info_name
__C_specific_handler
__RTDynamicCast
memcpy
api-ms-win-crt-runtime-l1-1-0.dll _c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_seh_filter_exe
_cexit
_set_app_type
_crt_atexit
_register_onexit_function
__p___argv
_get_initial_narrow_environment
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_initterm
_invalid_parameter_noinfo_noreturn
signal
_exit
_initterm_e
exit
api-ms-win-crt-heap-l1-1-0.dll free
_set_new_mode
malloc
_callnewh
realloc
api-ms-win-crt-string-l1-1-0.dll strncpy_s
strcmp
api-ms-win-crt-time-l1-1-0.dll _gmtime64
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_set_fmode
__stdio_common_vsprintf
api-ms-win-crt-math-l1-1-0.dll sqrtf
__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2018-Oct-13 20:40:13
Version 0.0
SizeofData 73
AddressOfRawData 0x38744
PointerToRawData 0x37b44
Referenced File e:\PlayspaceMover\x64\Release\PlayspaceMover.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2018-Oct-13 20:40:13
Version 0.0
SizeofData 20
AddressOfRawData 0x38790
PointerToRawData 0x37b90

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2018-Oct-13 20:40:13
Version 0.0
SizeofData 888
AddressOfRawData 0x387a4
PointerToRawData 0x37ba4

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2018-Oct-13 20:40:13
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x140038b40
EndAddressOfRawData 0x140038b48
AddressOfIndex 0x140045490
AddressOfCallbacks 0x14002f790
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140043010

RICH Header

XOR Key 0xb0f1d3a2
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 14
ASM objects (VS 2015/2017 runtime 26706) 3
C objects (VS 2015/2017 runtime 26706) 10
C++ objects (VS 2015/2017 runtime 26706) 31
Imports (VS 2015/2017 runtime 26706) 4
Imports (VS2017 v15.?.? build 25203) 4
Imports (VS2017 v15.6 compiler 26128) 3
Total imports 247
265 (VS2017 v15.8.5-8 compiler 26730) 2
Resource objects (VS2017 v15.8.5-8 compiler 26730) 1
Linker (VS2017 v15.8.5-8 compiler 26730) 1

Errors