Manalyze report for 20972d948d4ac7df06a24e5eaaf50531b1b1a65c4dd2f5e676efbc577de2295c

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Aug-11 12:06:14

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: cmd.exe` `Contains domain names: a.pvp.net auth.riotgames.com riotgames.com s.a.pvp.net valorant-api.com`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Possibly launches other programs: CreateProcessW` `Has Internet access capabilities: InternetCloseHandle InternetSetOptionA InternetQueryOptionA InternetReadFile InternetConnectA InternetOpenA WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle`
Malicious	VirusTotal score: 11/67 (Scanned on 2026-08-13 13:16:24)	`Bkav: W32.Malware.5843D036` `CrowdStrike: win/malicious_confidence_60% (W)` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `Elastic: malicious (moderate confidence)` `Malwarebytes: Malware.AI.3109912389` `Microsoft: Trojan:Win32/Wacatac.B!ml` `Sangfor: Trojan.Win32.Save.a` `SentinelOne: Static AI - Suspicious PE` `Symantec: ML.Attribute.HighConfidence` `TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101HC26ZX`

Hashes

MD5	`682eea2078414f7fe5b714a4e59b4e92` 🔍
SHA1	`a14e58d82c78e8baa061b68eb8071f421b495534` 🔍
SHA256	`20972d948d4ac7df06a24e5eaaf50531b1b1a65c4dd2f5e676efbc577de2295c` 🔍
SHA3	`e518f28c8560f48d565a1913822449e48988d0ebd382e52e09418e555504aaf4` 🔍
SSDeep	`6144:czIrLZi/VGVW2FXoQFQSXYgTUp4/FCpEk/mzV4A1Jyxer:cMrLHW2BeSzTUpm8eWMQ4r` 🔍
Imports Hash	`2e5b1dd5f57bfc2f7745a3cc9138e3ac` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x100`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Aug-11 12:06:14
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x6d800`
SizeOfInitializedData	`0x23e00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000040FE0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x95000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`3bbeed4c379052b0b9e0ca57abf45ab4 🔍`
SHA1	`8f7d7025937bbd4ae6cbabbfdbaccb5031085ea2 🔍`
SHA256	`4096df80c26b6d577113025c1f94c38176482ee1b3e24ac09613d62cee86d362 🔍`
SHA3	`1bb9ab54e165c5f8ceb7024b2a75a7d3f1a337a792a8d30be0df96b1852fdd40 🔍`
VirtualSize	`0x6d62c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x6d800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.98834`

.rdata

MD5	`fa638b29bfc4e0a414e5cd55d08b398f 🔍`
SHA1	`fe3730deea00357866a587f043d67b42cec8a294 🔍`
SHA256	`9581de6b5e76129c3ecea2c9dae7dfd4d0be646a98e162def6ecaaf8017a9158 🔍`
SHA3	`3db7f1c0ed9dc244e4c8811edffcb4bbb72227f41d9b5e52e4d3b3de8e13703a 🔍`
VirtualSize	`0x19122`
VirtualAddress	`0x6f000`
SizeOfRawData	`0x19200`
PointerToRawData	`0x6dc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.1596`

.data

MD5	`bb0e57af8b443faa5d55868306818802 🔍`
SHA1	`3ba3075e75c508890e786f747f22f22c22197fd2 🔍`
SHA256	`51d2be2473c81c4b5255372ed4c419a01c56f898d19d48558bec75905ec59e41 🔍`
SHA3	`22cf0a4d75cd3b34a36626fc20af0102179952ecf3aae8463b3ba2fe38d87d49 🔍`
VirtualSize	`0x2c5c`
VirtualAddress	`0x89000`
SizeOfRawData	`0x1a00`
PointerToRawData	`0x86e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.21278`

.pdata

MD5	`19d8b103e5c18d2e631dede598cac1fd 🔍`
SHA1	`7ed1b6b6a72a3dce2c80b97ae5477900fcb16537 🔍`
SHA256	`124860b744f99d6c953924f0836d62fde084d43ea881bb7f76c84187969e7da7 🔍`
SHA3	`2b019b3abeae68447516a6854d0bc114509239b2c1a14b109ce7a559c1581e51 🔍`
VirtualSize	`0x6fa8`
VirtualAddress	`0x8c000`
SizeOfRawData	`0x7000`
PointerToRawData	`0x88800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.67623`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x93000`
SizeOfRawData	`0x200`
PointerToRawData	`0x8f800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`e6599bee4d38cfcd0fe402dcddba70bc 🔍`
SHA1	`d6fd9dad8ac48d581f4621490fbb0b1bf5c30360 🔍`
SHA256	`e24cd092ff16e3d290c6b826e4e26faf745fc933f154cec61443993c115f21a7 🔍`
SHA3	`926e4a382c619e0ce1e1c8dba33dc710541ed35dd4966a779a694a54ecec0341 🔍`
VirtualSize	`0xa8c`
VirtualAddress	`0x94000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x8fa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.12858`

Imports

WININET.dll	`InternetCloseHandle` `HttpQueryInfoA` `HttpSendRequestA` `HttpAddRequestHeadersA` `HttpOpenRequestA` `InternetSetOptionA` `InternetQueryOptionA` `InternetReadFile` `InternetConnectA` `InternetOpenA`
WINHTTP.dll	`WinHttpOpen` `WinHttpQueryHeaders` `WinHttpReceiveResponse` `WinHttpSendRequest` `WinHttpOpenRequest` `WinHttpSetTimeouts` `WinHttpSetOption` `WinHttpQueryDataAvailable` `WinHttpReadData` `WinHttpConnect` `WinHttpCloseHandle`
KERNEL32.dll	`CreateFileW` `HeapSize` `SetStdHandle` `GetProcessHeap` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetOEMCP` `GetACP` `IsValidCodePage` `FindNextFileW` `FindFirstFileExW` `FindClose` `OutputDebugStringW` `HeapReAlloc` `GetConsoleMode` `GetConsoleOutputCP` `FlushFileBuffers` `GetStdHandle` `Sleep` `SetConsoleTextAttribute` `GetEnvironmentVariableA` `CreateFileA` `GetFileSizeEx` `ReadFile` `SetFilePointerEx` `CloseHandle` `GetLastError` `GetTickCount` `MultiByteToWideChar` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `WakeAllConditionVariable` `SleepConditionVariableSRW` `SetUnhandledExceptionFilter` `GetStartupInfoW` `GetModuleHandleW` `QueryPerformanceCounter` `GetCurrentProcessId` `GetCurrentThreadId` `GetSystemTimeAsFileTime` `InitializeSListHead` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `EncodePointer` `DecodePointer` `CompareStringEx` `GetCPInfo` `WideCharToMultiByte` `LCMapStringEx` `GetStringTypeW` `EnumSystemLocalesW` `RtlPcToFileHeader` `RaiseException` `RtlLookupFunctionEntry` `RtlUnwindEx` `SetLastError` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `CreateThread` `ExitThread` `FreeLibrary` `FreeLibraryAndExitThread` `GetModuleHandleExW` `GetFileType` `GetModuleFileNameW` `WriteConsoleW` `GetCurrentProcess` `ExitProcess` `TerminateProcess` `GetProcAddress` `WriteFile` `GetCommandLineA` `GetCommandLineW` `IsProcessorFeaturePresent` `RtlCaptureContext` `RtlVirtualUnwind` `IsDebuggerPresent` `UnhandledExceptionFilter` `HeapFree` `WaitForSingleObject` `GetExitCodeProcess` `CreateProcessW` `GetFileAttributesExW` `HeapAlloc` `VirtualProtect` `LoadLibraryExW` `CompareStringW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `GetUserDefaultLCID`

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Aug-11 12:06:14
Version	`0.0`
SizeofData	`1012`
AddressOfRawData	`0x81f40`
PointerToRawData	`0x80b40`

TLS Callbacks

StartAddressOfRawData	`0x140082380`
EndAddressOfRawData	`0x140082388`
AddressOfIndex	`0x14008a998`
AddressOfCallbacks	`0x14006f490`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1400890c0`

RICH Header

XOR Key	`0xc155735b`
Unmarked objects	`0`
C++ objects (33145)	`173`
C objects (33145)	`17`
ASM objects (33145)	`7`
Imports (33145)	`7`
Total imports	`140`
ASM objects (35721)	`10`
C objects (35721)	`17`
C++ objects (35721)	`91`
C++ objects (36252)	`2`
Linker (36252)	`1`

Errors

Leave a comment

No comments yet.