1a5f7bfff2ae9bcde19ae94c5da8f09e892e3f0d17fe6ba2b61c4a2c9ea3fa9f

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-24 03:00:19
Detected languages Chinese - PRC
English - United States
CompanyName Xi'An SKY Online Co., Ltd.
FileDescription SkyProtect Anti Cheat Module
FileVersion 0.2.2.9
InternalName SkyProtect
LegalCopyright Copyright (C) 2026
OriginalFilename SPL.exe
ProductName SP
ProductVersion 0.2.2.9

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .FYJ0
Unusual section name found: .FYJ1
Unusual section name found: .FYJ2
The PE only has 7 import(s).
Info The PE is digitally signed. Signer: XI'AN SKY ONLINE NETWORK TECHNOLOGY LIMITED LIABILITY COMPANY
Issuer: GlobalSign GCC R45 EV CodeSigning CA 2020
Malicious VirusTotal score: 5/69 (Scanned on 2026-07-12 06:11:28) CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
Elastic: malicious (moderate confidence)
Sophos: Generic ML PUA (PUA)
VBA32: Malware-Cryptor.Inject.gen

Hashes

MD5 47598bc60c72f4d26664fca03d9d5299 🔍
SHA1 a0d2e1f33614a3292b36b755d66bdf75a1325f2b 🔍
SHA256 1a5f7bfff2ae9bcde19ae94c5da8f09e892e3f0d17fe6ba2b61c4a2c9ea3fa9f 🔍
SHA3 d9e3fd13cbe9f9aea4d84e79e45cd9cf0aea9b76b29bb704551dbbd51a2eaf63 🔍
SSDeep 393216:bPZVoX/BI7X6/jAR8MHWXTTe4HdCth+MVGXbYY:j8vBj0R8MWXe4HdAhlGkY 🔍
Imports Hash d0f2ed026549ce986a71b8b4e5c88922 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2026-Apr-24 03:00:19
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x29200
SizeOfInitializedData 0x95800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00B5CF58 (Section: .FYJ2)
BaseOfCode 0x1000
BaseOfData 0x2b000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1744000
SizeOfHeaders 0x400
Checksum 0xe28b8a
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2908e
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xcada
VirtualAddress 0x2b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1e7c
VirtualAddress 0x38000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FYJ0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8eb710
VirtualAddress 0x3a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.FYJ1

MD5 accbe5bf3db60466c3e06bba496e2e88 🔍
SHA1 126cae824dc4a28c154e36610af742184fc1b8d2 🔍
SHA256 21c00ee92ba21f5c1eedf58b64a0543022eb7687823653d68846a8c00683952b 🔍
SHA3 7d9ff911d194a3f399da3eb19fa3effe8037d9ac0223ee46f74fba39e0dcf0aa 🔍
VirtualSize 0x5c
VirtualAddress 0x926000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.555694

.FYJ2

MD5 03351e0389ac44bacb81a87a23504879 🔍
SHA1 1bf66d54ab8173d568c0258404907b03aadf8ad6 🔍
SHA256 91f6bf57e8952bd2c62acf9484f24d83fd753851262cf38d8c28095d56acaba5 🔍
SHA3 a391fe3a27943e505a923e22d4a5d2e4b878e0d4302235688b26532726f82d6a 🔍
VirtualSize 0xe1b84c
VirtualAddress 0x927000
SizeOfRawData 0xe1ba00
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.93754

.rsrc

MD5 de9df662d376915c7784712ba2302ef8 🔍
SHA1 cff228010784f34d8931a52e951842a17d983618 🔍
SHA256 88cd53aa12eb980ec9efee93f8f31d085e71f166ea564207a7a8a739612fbbdf 🔍
SHA3 8e73e9dbde27b0c63bf29d5fec3353bd8befaff913d7cebd349df2f379f9c4bd 🔍
VirtualSize 0x508
VirtualAddress 0x1743000
SizeOfRawData 0x600
PointerToRawData 0xe1c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.74738

Imports

KERNEL32.dll OutputDebugStringW
USER32.dll SystemParametersInfoA
GDI32.dll CreateFontA
SHELL32.dll SHGetSpecialFolderPathW
dbghelp.dll MiniDumpWriteDump
WININET.dll HttpQueryInfoA
SHLWAPI.dll PathRemoveFileSpecA

Delayed Imports

1

Type RT_VERSION
Language Chinese - PRC
Codepage UNKNOWN
Size 0x2e0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.42981
MD5 58bec67709f3d0f34a2bc67af8ddcd66 🔍
SHA1 7101e50299badb2816d9775cfaaf6f4d566d4fb8 🔍
SHA256 2fa7cf343e15c20bc609dbbfe434c8dc831556603a1004803bf896636e2da1e6 🔍
SHA3 55a6349f9fa8c468ccb28b7fe6b858e9dfdf299b65f4efe2a53b7db49aea79f2 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.2.2.9
ProductVersion 0.2.2.9
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language Chinese - PRC
CompanyName Xi'An SKY Online Co., Ltd.
FileDescription SkyProtect Anti Cheat Module
FileVersion (#2) 0.2.2.9
InternalName SkyProtect
LegalCopyright Copyright (C) 2026
OriginalFilename SPL.exe
ProductName SP
ProductVersion (#2) 0.2.2.9
Resource LangID Chinese - PRC

TLS Callbacks

Load Configuration

Size 0xbc
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x43800c
SEHandlerTable 0
SEHandlerCount 0

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .FYJ0 has a size of 0!
Leave a comment

No comments yet.