ffbcd8dca782cd6fc24372aa2fd606f6a4a700c7b3612b93a292d1919ff9288c

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2056-Jul-29 15:38:51
Comments WeMod Setup
CompanyName WeMod LLC
FileDescription WeMod Setup
FileVersion 11.0.0.0
InternalName WeMod-Setup.exe
LegalCopyright Copyright © WeMod LLC 2025
LegalTrademarks
OriginalFilename WeMod-Setup.exe
ProductName WeMod
ProductVersion 11.0.0.0
Assembly Version 11.0.0.0

Plugin Output

Info Matching compiler(s): .NET executable -> Microsoft
Info Interesting strings found in the binary: Contains domain names:
  • api.wemod.com
  • https://api.wemod
  • https://api.wemod.com
  • https://api.wemod.com/client/download
  • wemod.com
Info The PE is digitally signed. Signer: WeMod LLC
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 6206baccacce5e63cebea4dc1744c250 🔍
SHA1 735511f82c8104a541d20b714561ef37bd7897f2 🔍
SHA256 ffbcd8dca782cd6fc24372aa2fd606f6a4a700c7b3612b93a292d1919ff9288c 🔍
SHA3 b9bef08f5aad415aa17115146926d340dc6250e2953d666bd80f17752b065624 🔍
SSDeep 3072:VUdk8lx45QyUyhaEtHZ8+vN3sTm4ILlCI+40OHHx:VUdk8r45rUwaEtHmHk4 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2056-Jul-29 15:38:51
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x1dc00
SizeOfInitializedData 0x6e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001FBDE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2a000
SizeOfHeaders 0x200
Checksum 0x32460
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 2314d29e7905f8f9cd973733da517e61 🔍
SHA1 7e1985763f5aa17feaddf9c0f4930c4b61308fe1 🔍
SHA256 a1cf2d6cd18322da37430bf3e18f1fdda588be913619cd502196bc177c2eeced 🔍
SHA3 ca903dfdf7808e75907734503b32b9e4abd1649e275505713a80d49d7cfd2fe8 🔍
VirtualSize 0x1dbe4
VirtualAddress 0x2000
SizeOfRawData 0x1dc00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.52673

.rsrc

MD5 a73d2ec3c7e476612d95f732607db4ff 🔍
SHA1 719a4845889768850bedf1f3e58dbd78fa0bf533 🔍
SHA256 7581524b3d75e5f9ee07b86fc20b7c42d6a051084f8625e8e40a13dca801ab02 🔍
SHA3 6b575d4f1f85c1cb9cb4be941b974620f3fdaa13deec7900a1306370168c73b0 🔍
VirtualSize 0x6b9c
VirtualAddress 0x20000
SizeOfRawData 0x6c00
PointerToRawData 0x1de00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.61632

.reloc

MD5 aa570ab0aa395fc237e9e04a34cfc787 🔍
SHA1 778206b3826687a77c42a0a9e5bef3e460e97713 🔍
SHA256 e8677cb7666bfd1546e826613cbdb5f27bbd347a4ad4ed42d5e442e264dffd08 🔍
SHA3 ed6c100e5c776fb9949787a8e1838a54fcf483ac1dd0de2b32ca65f012017918 🔍
VirtualSize 0xc
VirtualAddress 0x28000
SizeOfRawData 0x200
PointerToRawData 0x24a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.86364
MD5 1912aa54a811d09476f4ac386704e560 🔍
SHA1 af76ee2c410c002b5223904d226baccee2c40502 🔍
SHA256 4bc771965027f3ffc501039391c2721a39e752033d705081e605fc403292f3e0 🔍
SHA3 e6bf5391ee76e099707fa30370e913e046eecd54cda7df3ac82c6759a7a55b3c 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.90218
MD5 7842b7384f0f64a65b23377a5d05443a 🔍
SHA1 f2caa074efaff406b91c2b93f60307ed5b96969f 🔍
SHA256 d320c9dc3e074959737e06010cff864dc067a47920448f5a92dedadc497c01a4 🔍
SHA3 1d41b597b3ccc242ce6243175e9908a1692eecd86bafe6e733b9363a95e7f598 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.95148
MD5 6a7aba80e0c8edde98b8d06fcece216c 🔍
SHA1 4249e7dfe60d443d679fc346179943b7eabbdc8d 🔍
SHA256 71f70d84b8eb9738605ea73931a3f8acb02d1174984bb4f5c9bcc79def3c8243 🔍
SHA3 ae8e4b8109ea4c50e60e692e8835144e6f0538adeb1a81d89e999463bfecab2d 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2713
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.81727
Detected Filetype PNG graphic file
MD5 a0bfa63c2bd1853c3ea8b0ec0be1e91d 🔍
SHA1 ba5f6d7a1a2c41c2dda3053e43feb967aa975463 🔍
SHA256 4777207b1fdcaa2d8b723bf1e0e7e2a29ddb037369f9095fc875201fe1b7e009 🔍
SHA3 c13a8b064ddcfcab1d03b04d32e6ae4c625e7bc0a8dddb2d646826e216ca069b 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.44608
Detected Filetype Icon file
MD5 326f51fc87a804cf9b949e29a6e3cd06 🔍
SHA1 a16c4d3150ce46cf1ab23a1c445a820ba07da8b6 🔍
SHA256 5350162db90e706b46231c9b27363b5345d3f2349dbbdd54bd53f7336c021aaf 🔍
SHA3 e9d8456746368a36c8ae159627b813e322ff780f43365905d8c42e36fd9b3e91 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x362
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36606
MD5 15a63a4efafab8984dee1384be8b4836 🔍
SHA1 f2163f097915c71663860db3c6ef40bdacdca591 🔍
SHA256 848e2a99f6a995b839e70693157d95e9378007cc461d690d90d06cc2e20be4fb 🔍
SHA3 fd3ef920c0631fea495a98014fc9cf950aff7371c01ba519a1d3cbaf5555ff99 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x467
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.24425
MD5 8be70e8c6fe988627a18db9c986fd96b 🔍
SHA1 a4192f613a0d26d8d660473cf74b4ec608a7f0f5 🔍
SHA256 bafc591955142b511cbd877a3d7d709be62eda648992b9e7e52e439556ee97f4 🔍
SHA3 18a7e083b66093e951ad0b84c95be543da29d983862fd981996ce122a1b519ca 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 11.0.0.0
ProductVersion 11.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments WeMod Setup
CompanyName WeMod LLC
FileDescription WeMod Setup
FileVersion (#2) 11.0.0.0
InternalName WeMod-Setup.exe
LegalCopyright Copyright © WeMod LLC 2025
LegalTrademarks
OriginalFilename WeMod-Setup.exe
ProductName WeMod
ProductVersion (#2) 11.0.0.0
Assembly Version 11.0.0.0
Resource LangID UNKNOWN

UNKNOWN

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0x1dd84

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.