27a1c596c4b1de1e6672cb7e7fba2ba3d3124999493ff82a504beb6f6145e88f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Mar-21 14:10:19
Detected languages Russian - Russia
CompanyName Online-Fix.Me
FileDescription Online-Fix Steamclient
FileVersion 1.3.4.2
LegalCopyright Copyright (C) 2021-2026, 0xdeadc0de
ProductVersion 1.3.4.2

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .ofme0
Unusual section name found: .ofme1
Unusual section name found: .ofme2
The PE only has 6 import(s).
Suspicious The PE contains functions most legitimate programs don't use. Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 40/70 (Scanned on 2026-10-28 21:56:28) AVG: Win64:UnwantedX-gen [PUP]
AhnLab-V3: Trojan/Win.Generic.R776133
Antiy-AVL: Trojan/Win32.Phonzy
Arcabit: Trojan.Generic.WD0001
Avast: Win64:UnwantedX-gen [PUP]
Avira: TR/W64.Malware
Bkav: W32.Malware.6F0BFCA4
CAT-QuickHeal: Trojan.PupHacktool
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/HackTool.Crack.AA potentially unsafe application
Elastic: malicious (high confidence)
F-Secure: Trojan.TR/W64.Malware
GData: Win64.Trojan.Agent.IARNRC
Gridinsoft: Trojan.Win64.OnlineFix.an
Ikarus: PUA.GameHack
K7AntiVirus: Unwanted-Program ( 005d025d1 )
K7GW: Unwanted-Program ( 005d025d1 )
Kingsoft: Win64.Troj.tedy.v
Lionic: Trojan.Win32.Crack.4!c
Malwarebytes: RiskWare.GameHack
MaxSecure: Trojan.Malware.625284858.susgen
Microsoft: Trojan:Win64/Tedy!MTB
Paloalto: generic.ml
Panda: PUP/Hacktool
Rising: Trojan.Tedy!8.16570 (CLOUD)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win64.Dropper.tc
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!00813D08C8A0
TrendMicro: Trojan.Win32.ZYX.USBLE726
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLE726
Varist: W64/ABApplication.AFUB-7543
Webroot: Win.Hack.Tool
Xcitium: ApplicUnwnt@#38mvsu88nrn42
alibabacloud: HackTool:Win/Crack.AM

Hashes

MD5 00813d08c8a0cdf3420bd38fd72c80e8 🔍
SHA1 992119b11b5067959776b18f609c594c6c888bb9 🔍
SHA256 27a1c596c4b1de1e6672cb7e7fba2ba3d3124999493ff82a504beb6f6145e88f 🔍
SHA3 a24a1a8069047a61f1a37abe87b1bf9cfca6abe94a94b80687c05283f804c878 🔍
SSDeep 196608:OrATka029FenZW3Q8YrVNnZv9/F91mWsz0kg4kAHh3Zkghk0XV4YPNOLOOKj:KeLIJ5d9/FjxsGTiJ1hk+HPNTj 🔍
Imports Hash 10c1b70987e42d05f256c6e82924ec7e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-Mar-21 14:10:19
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1bb800
SizeOfInitializedData 0xffa00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000FABEBA (Section: .ofme2)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x172d000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1bb700
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x948b8
VirtualAddress 0x1bd000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x4e940
VirtualAddress 0x252000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x13f38
VirtualAddress 0x2a1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x100
VirtualAddress 0x2b5000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ofme0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x7451ed
VirtualAddress 0x2b6000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ofme1

MD5 034851e81f467f15b57a1cc2f8f5e75c 🔍
SHA1 b956470725179af72821b69c9321b1ad449167c8 🔍
SHA256 300ac44dcc057031fd4aa7c9540c51795359f4efaf72452e400b0267d7180927 🔍
SHA3 785642f452df15ea07a4bc96f225c81760706c64057253291fdbbab6007b3bc3 🔍
VirtualSize 0x98
VirtualAddress 0x9fc000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.356937

.ofme2

MD5 753d728a14a3d4cc2f7a7192660995d6 🔍
SHA1 ea2d502d42c135b6598fcc9e349dc6260dc503a5 🔍
SHA256 58a6c826891cb62256e742de856a81ac7e49f29c9ec57bbc36789dbdef9e2169 🔍
SHA3 da8521084968080154746c8f4329145c9f10e0277a5d5635e9bf748e52352911 🔍
VirtualSize 0xd2d65c
VirtualAddress 0x9fd000
SizeOfRawData 0xd2d800
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.67807

.rsrc

MD5 a586dd2595d1b1d1711078ef39232ca9 🔍
SHA1 e18fe5245a212f91fc2fe2260b7cfdba1533cac1 🔍
SHA256 69c75b8e819d9b6d00c3f897aac24fdc147e32888c4142864c1e26fc40da6204 🔍
SHA3 242a1ff00b9eda7089fbd6bcacc2b239d8c81098980bb1b290edc04ec2e816c9 🔍
VirtualSize 0x298
VirtualAddress 0x172b000
SizeOfRawData 0x400
PointerToRawData 0xd2de00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.3255

.reloc

MD5 a44acdce35b8e04b9ecca24d8f27b8e7 🔍
SHA1 27a3b43af26fc0538d98a78fb136be78cebebd86 🔍
SHA256 881700a60ea2655e670baa24b05060385167b3ffe7f662ba70b29b377ba1b43a 🔍
SHA3 e3975ff6bcbfd911036b27b721a2f6d19a6bf8da462bc535793306bc6903429a 🔍
VirtualSize 0xb0
VirtualAddress 0x172c000
SizeOfRawData 0x200
PointerToRawData 0xd2e200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.87402

Imports

KERNEL32.dll GetModuleHandleA
USER32.dll GetUserObjectInformationW
SHELL32.dll SHGetSpecialFolderPathA
WS2_32.dll ioctlsocket
WLDAP32.dll #27
ADVAPI32.dll RegisterEventSourceW

Delayed Imports

Breakpad_SteamMiniDumpInit

Ordinal 1
Address 0x607d0

Breakpad_SteamSendMiniDump

Ordinal 2
Address 0x607e0

Breakpad_SteamSetAppID

Ordinal 3
Address 0x607f0

Breakpad_SteamSetSteamID

Ordinal 4
Address 0x60800

Breakpad_SteamWriteMiniDumpSetComment

Ordinal 5
Address 0x60810

Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId

Ordinal 6
Address 0x60820

CreateInterface

Ordinal 7
Address 0x60410

OnlineFix

Ordinal 8
Address 0x601a0

ShellExecuteA

Ordinal 9
Address 0x601b0

ShellExecuteW

Ordinal 10
Address 0x60210

Steam_BConnected

Ordinal 11
Address 0x60830

Steam_BGetCallback

Ordinal 12
Address 0x60270

Steam_BLoggedOn

Ordinal 13
Address 0x60840

Steam_BReleaseSteamPipe

Ordinal 14
Address 0x60850

Steam_ConnectToGlobalUser

Ordinal 15
Address 0x60860

Steam_CreateGlobalUser

Ordinal 16
Address 0x60870

Steam_CreateLocalUser

Ordinal 17
Address 0x60880

Steam_CreateSteamPipe

Ordinal 18
Address 0x60890

Steam_FreeLastCallback

Ordinal 19
Address 0x603c0

Steam_GSBLoggedOn

Ordinal 20
Address 0x608b0

Steam_GSBSecure

Ordinal 21
Address 0x608c0

Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient

Ordinal 22
Address 0x608d0

Steam_GSGetSteamID

Ordinal 23
Address 0x608e0

Steam_GSLogOff

Ordinal 24
Address 0x608f0

Steam_GSLogOn

Ordinal 25
Address 0x60900

Steam_GSRemoveUserConnect

Ordinal 26
Address 0x60910

Steam_GSSendSteam2UserConnect

Ordinal 27
Address 0x60920

Steam_GSSendSteam3UserConnect

Ordinal 28
Address 0x60930

Steam_GSSendUserDisconnect

Ordinal 29
Address 0x60940

Steam_GSSendUserStatusResponse

Ordinal 30
Address 0x60950

Steam_GSSetServerType

Ordinal 31
Address 0x60960

Steam_GSSetSpawnCount

Ordinal 32
Address 0x60970

Steam_GSUpdateStatus

Ordinal 33
Address 0x60980

Steam_GetAPICallResult

Ordinal 34
Address 0x60370

Steam_GetGSHandle

Ordinal 35
Address 0x608a0

Steam_InitiateGameConnection

Ordinal 36
Address 0x60990

Steam_IsKnownInterface

Ordinal 37
Address 0x609a0

Steam_LogOff

Ordinal 38
Address 0x609b0

Steam_LogOn

Ordinal 39
Address 0x609c0

Steam_NotifyMissingInterface

Ordinal 40
Address 0x609d0

Steam_ReleaseThreadLocalMemory

Ordinal 41
Address 0x609e0

Steam_ReleaseUser

Ordinal 42
Address 0x609f0

Steam_SetLocalIPBinding

Ordinal 43
Address 0x60a00

Steam_TerminateGameConnection

Ordinal 44
Address 0x60a10

1

Type RT_VERSION
Language Russian - Russia
Codepage UNKNOWN
Size 0x240
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4265
MD5 b7dd7ecc7ce20ed4cea2e6f3b02a5952 🔍
SHA1 b296882fd520b54aa577ba847686d11ac8e724eb 🔍
SHA256 6c96443ec41880d9bdd49bb2b2ae35e014be35058056f57fd034ebb91b7192d1 🔍
SHA3 ecd3fafe525fd52431a77bf17461bd639559651eae92cb6cb731abe94af03088 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.3.4.2
ProductVersion 1.3.4.2
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language UNKNOWN
CompanyName Online-Fix.Me
FileDescription Online-Fix Steamclient
FileVersion (#2) 1.3.4.2
LegalCopyright Copyright (C) 2021-2026, 0xdeadc0de
ProductVersion (#2) 1.3.4.2
Resource LangID Russian - Russia

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180299280

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .fptable has a size of 0! [*] Warning: Section .ofme0 has a size of 0!
Leave a comment

No comments yet.