| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-Jun-10 09:58:17 |
| Detected languages |
English - United States
|
| Debug artifacts |
EasyAntiCheat_x64.pdb
|
| CompanyName | Epic Games, Inc |
| FileDescription | EasyAntiCheat Client |
| FileVersion | 2, 0, 0, 0 |
| InternalName | EasyAntiCheat.dll |
| LegalCopyright | Copyright © Epic Games, Inc 2019 |
| OriginalFilename | EasyAntiCheat.dll |
| ProductName | EasyAntiCheat |
| ProductVersion | 2, 0, 0, 0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: EasyAntiCheat Oy
Issuer: GlobalSign Extended Validation CodeSigning CA - SHA256 - G3 |
| Safe | VirusTotal score: 0/72 (Scanned on 2025-07-28 05:43:37) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2020-Jun-10 09:58:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x87000 |
| SizeOfInitializedData | 0x3de00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000005C000 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xc8000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xd065c |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
SystemTimeToFileTime
GetModuleHandleW GetSystemTime GetFileTime GetLocaleInfoW VirtualProtect VirtualFree VirtualAlloc lstrlenA lstrcmpA DebugBreak CreateEventW SetEvent ResetEvent TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId Sleep GetLastError CreateThread SwitchToThread MultiByteToWideChar LocalFree WideCharToMultiByte FormatMessageA ExitProcess GetSystemTimeAsFileTime FileTimeToSystemTime LocalAlloc GetSystemDirectoryW LoadLibraryW GetCurrentProcessId QueryDosDeviceW GetLogicalDriveStringsW WriteFile GetCommandLineW GetBinaryTypeW GetCurrentProcess DuplicateHandle CreateDirectoryW GetModuleFileNameW GetTempPathW GetEnvironmentVariableA OpenProcess CreateProcessW SetDllDirectoryW DeleteFileW GetFileInformationByHandle GetFileAttributesW FindClose FindNextFileW GetFileSizeEx FindFirstFileW ReadFile SetLastError SleepEx InitializeCriticalSectionEx ExpandEnvironmentStringsA GetModuleHandleA VerifyVersionInfoA GetSystemDirectoryA VerSetConditionMask WaitForSingleObjectEx CreateFileA QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList LoadLibraryExW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameA GetConsoleMode ReadConsoleW GetConsoleCP HeapFree HeapAlloc GetACP GetStdHandle GetTimeZoneInformation FlushFileBuffers HeapReAlloc GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx GetCurrentDirectoryW GetFullPathNameW SetStdHandle FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap GetFileAttributesExW HeapSize WriteConsoleW SetEndOfFile CreateFileW CreateSemaphoreW CloseHandle WaitForSingleObject ReleaseSemaphore FreeLibrary GetProcAddress GlobalFree GetTickCount64 LoadLibraryA RtlUnwind |
|---|---|
| ADVAPI32.dll |
CryptReleaseContext
CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptGetHashParam CryptGenRandom CryptAcquireContextA |
| USER32.dll |
wvsprintfA
AllowSetForegroundWindow |
| WS2_32.dll |
closesocket
WSAIoctl bind select __WSAFDIsSet ioctlsocket freeaddrinfo getaddrinfo getpeername connect getsockopt htons setsockopt send recv WSAGetLastError WSACleanup WSAStartup WSASetLastError socket getsockname ntohs |
| CRYPT32.dll |
CertAddCertificateContextToStore
CertFreeCertificateChainEngine CertFreeCertificateChain CertGetNameStringA CertCreateCertificateChainEngine CryptQueryObject CertGetCertificateChain CertOpenStore CertFindCertificateInStore CertCloseStore CryptStringToBinaryA CertFreeCertificateContext |
| Ordinal | 1 |
|---|---|
| Address | 0x25f30 |
| Ordinal | 2 |
|---|---|
| Address | 0x25f40 |
| Ordinal | 3 |
|---|---|
| Address | 0x25f60 |
| Ordinal | 4 |
|---|---|
| Address | 0x25f50 |
| Ordinal | 5 |
|---|---|
| Address | 0x25f80 |
| Ordinal | 6 |
|---|---|
| Address | 0x26220 |
| Ordinal | 7 |
|---|---|
| Address | 0x25fa0 |
| Ordinal | 8 |
|---|---|
| Address | 0x25f70 |
| Ordinal | 9 |
|---|---|
| Address | 0x260e0 |
| Ordinal | 10 |
|---|---|
| Address | 0x25fb0 |
| Ordinal | 11 |
|---|---|
| Address | 0x26040 |
| Ordinal | 12 |
|---|---|
| Address | 0x25e40 |
| Ordinal | 13 |
|---|---|
| Address | 0x25e20 |
| Ordinal | 14 |
|---|---|
| Address | 0x25e10 |
| Ordinal | 15 |
|---|---|
| Address | 0x25aa0 |
| Ordinal | 16 |
|---|---|
| Address | 0x258b0 |
| Ordinal | 17 |
|---|---|
| Address | 0x25b90 |
| Ordinal | 18 |
|---|---|
| Address | 0x25cf0 |
| Ordinal | 19 |
|---|---|
| Address | 0x25ec0 |
| Ordinal | 20 |
|---|---|
| Address | 0x25e80 |
| Ordinal | 21 |
|---|---|
| Address | 0x25e90 |
| Ordinal | 22 |
|---|---|
| Address | 0x25e50 |
| Ordinal | 23 |
|---|---|
| Address | 0x25ed0 |
| Ordinal | 24 |
|---|---|
| Address | 0x25f00 |
| Ordinal | 25 |
|---|---|
| Address | 0x25ef0 |
| Ordinal | 26 |
|---|---|
| Address | 0x25eb0 |
| Ordinal | 27 |
|---|---|
| Address | 0x25e30 |
| Ordinal | 28 |
|---|---|
| Address | 0x25f10 |
| Ordinal | 29 |
|---|---|
| Address | 0x25ee0 |
| Ordinal | 30 |
|---|---|
| Address | 0x25e60 |
| Ordinal | 31 |
|---|---|
| Address | 0x25f20 |
| Ordinal | 32 |
|---|---|
| Address | 0x25e30 |
| Ordinal | 33 |
|---|---|
| Address | 0x25e20 |
| Ordinal | 34 |
|---|---|
| Address | 0x25e10 |
| Ordinal | 35 |
|---|---|
| Address | 0x25ea0 |
| Ordinal | 36 |
|---|---|
| Address | 0x25e70 |
| Ordinal | 37 |
|---|---|
| Address | 0x25e40 |
| Ordinal | 38 |
|---|---|
| Address | 0x25e60 |
| Ordinal | 39 |
|---|---|
| Address | 0x25e50 |
| Ordinal | 40 |
|---|---|
| Address | 0x25e80 |
| Ordinal | 41 |
|---|---|
| Address | 0x25e90 |
| Ordinal | 42 |
|---|---|
| Address | 0x25e10 |
| Ordinal | 43 |
|---|---|
| Address | 0x25e40 |
| Ordinal | 44 |
|---|---|
| Address | 0x25e60 |
| Ordinal | 45 |
|---|---|
| Address | 0x26280 |
| Ordinal | 46 |
|---|---|
| Address | 0x26290 |
| Ordinal | 47 |
|---|---|
| Address | 0x26270 |
| Ordinal | 48 |
|---|---|
| Address | 0x26230 |
| Ordinal | 49 |
|---|---|
| Address | 0x26250 |
| Ordinal | 50 |
|---|---|
| Address | 0x262a0 |
| Ordinal | 51 |
|---|---|
| Address | 0x262b0 |
| Ordinal | 52 |
|---|---|
| Address | 0x25f30 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 2.0.0.0 |
| ProductVersion | 2.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Epic Games, Inc |
| FileDescription | EasyAntiCheat Client |
| FileVersion (#2) | 2, 0, 0, 0 |
| InternalName | EasyAntiCheat.dll |
| LegalCopyright | Copyright © Epic Games, Inc 2019 |
| OriginalFilename | EasyAntiCheat.dll |
| ProductName | EasyAntiCheat |
| ProductVersion (#2) | 2, 0, 0, 0 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2020-Jun-10 09:58:17 |
| Version | 0.0 |
| SizeofData | 46 |
| AddressOfRawData | 0xa93ec |
| PointerToRawData | 0xa87ec |
| Referenced File | EasyAntiCheat_x64.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2020-Jun-10 09:58:17 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0xa941c |
| PointerToRawData | 0xa881c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2020-Jun-10 09:58:17 |
| Version | 0.0 |
| SizeofData | 904 |
| AddressOfRawData | 0xa9430 |
| PointerToRawData | 0xa8830 |
| StartAddressOfRawData | 0x1800a97d8 |
|---|---|
| EndAddressOfRawData | 0x1800a97e0 |
| AddressOfIndex | 0x1800b7760 |
| AddressOfCallbacks | 0x1800886d0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x100 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1800b5090 |
| XOR Key | 0x38aefce3 |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2017 v15.?.? build 25203) | 18 |
| ASM objects (VS2017 v15.?.? build 25203) | 12 |
| C++ objects (VS2017 v15.?.? build 25203) | 185 |
| 199 (41118) | 4 |
| ASM objects (VS 2015/2017 runtime 26706) | 9 |
| C++ objects (VS 2015/2017 runtime 26706) | 58 |
| C objects (VS 2015/2017 runtime 26706) | 33 |
| Imports (VS2017 v15.?.? build 25203) | 11 |
| Total imports | 213 |
| C++ objects (27039) | 1 |
| C++ objects (LTCG) (27039) | 116 |
| Exports (27039) | 1 |
| Resource objects (27039) | 1 |
| Linker (27039) | 1 |
No comments yet.