2eda2104c900a77fbb0568ade67becda3c087ffcbb7a267f3f8e512c18270432

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Detected languages English - United States
Comments A simple standalone program to install, repair, and uninstall BetterDiscord.
CompanyName BetterDiscord
FileDescription BetterDiscord Installer
LegalCopyright © BetterDiscord
ProductName BetterDiscord Installer
ProductVersion 2.0.0

Plugin Output

Suspicious PEiD Signature: XWD graphics format
HQR data file
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to internet browsers:
  • chrome.exe
  • firefox.exe
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • -github.com
  • .eq.github.com
  • .eq.golang.org
  • .github.com
  • .hash.github.com
  • .hash.golang.org
  • .hash.net
  • .xz.7z.pl.py.au
  • 0github.com
  • 1github.com
  • 3github.com
  • 4github.com
  • 6github.com
  • 7z.pl.py.au
  • 9github.com
  • Cgithub.com
  • Dgithub.com
  • Ggithub.com
  • adobe.com
  • api.github.com
  • cases.info
  • collada.org
  • earth.google.com
  • eq.github.com
  • eq.golang.org
  • example.com
  • garmin.com
  • github.com
  • go.microsoft.com
  • golang.org
  • google.com
  • hash.github.com
  • hash.golang.org
  • http://earth.google.com
  • http://earth.google.com/kml/2.0
  • http://earth.google.com/kml/2.1
  • http://earth.google.com/kml/2.2
  • http://ns.adobe.com
  • http://ns.adobe.com/xfdf/
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/3dmanufacturing/core/2015/02
  • http://wails.localhost
  • http://www.collada.org
  • http://www.collada.org/2005/11/COLLADASchema
  • http://www.garmin.com
  • http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2
  • http://www.ibm.com
  • http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtdapplication/x-vnd.oasis.opendocument.presentation-templatexml
  • http://www.opengis.net
  • http://www.opengis.net/gml
  • http://www.opengis.net/gml/3.2
  • http://www.opengis.net/gml/3.3/exr
  • http://www.opengis.net/kml/2.2
  • http://www.topografix.com
  • http://www.topografix.com/GPX/1/1
  • http://www.w3.org
  • http://www.w3.org/1999/xhtml
  • http://www.w3.org/2000/svg
  • http://www.w3.org/2001/XMLSchema-instance
  • http://www.w3.org/2002/07/owl#
  • http://www.w3.org/2005/Atom
  • https://api.github.com
  • https://api.github.com/repos/BetterDiscord/BetterDiscord/releases/latestcrypto/fips140
  • https://api.github.com/repos/BetterDiscord/BetterDiscord/releases/tags/canaryinvalid
  • https://api.github.com/repos/BetterDiscord/Installer/releases/latestreflect
  • https://betterdiscord.app
  • https://example.com
  • https://github.com
  • https://go.dev
  • https://go.microsoft.com
  • https://go.microsoft.com/fwlink/p/?LinkId
  • https://rsms.me
  • https://svelte.dev
  • https://wails.io
  • microsoft.com
  • ns.adobe.com
  • opengis.net
  • pl.py.au
  • schemas.microsoft.com
  • topografix.com
  • www.collada.org
  • www.garmin.com
  • www.ibm.com
  • www.opengis.net
  • www.topografix.com
  • www.w3.org
  • xz.7z.pl.py.au
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Suspicious VirusTotal score: 1/69 (Scanned on 2026-10-13 09:54:56) Trapmine: suspicious.low.ml.score

Hashes

MD5 3ad58d96a7d2dfc03929f9ec6adc7db4 🔍
SHA1 520e9ce375916ca8f8ed5b16f6e0e84f2772d254 🔍
SHA256 2eda2104c900a77fbb0568ade67becda3c087ffcbb7a267f3f8e512c18270432 🔍
SHA3 6cb0c2f11b8809749345d91c5d472e45b948097d7b4686f2ef4ac60457ab7a68 🔍
SSDeep 49152:pnrV1cXltntalZRwwBv01YgAnjNKfgzWp0un1e7jyHiZBCT4iotJpwe4uoYfBDG:pnr/KP9wAaZkySY8jMbhGrpyqRCMDE 🔍
Imports Hash ed8b780a3ce7ca4aba78a21f6bc3d4e0 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0xa7d600
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x453400
SizeOfInitializedData 0xc8c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000008C980 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x2af8000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 19f94a906da75ec9cb6e5d3c5cf4d59f 🔍
SHA1 d2f74d81fb14f290fc8f8b1dc5df8cf04bd134e7 🔍
SHA256 ff098031258a1c2dac406a82257d22d3a7c58a5854710d9a7b6a6e1db95354dc 🔍
SHA3 c443fb385fce0312fdeb2478e702432518f323b57482bbb706fe74fa9a1bfa69 🔍
VirtualSize 0x453391
VirtualAddress 0x1000
SizeOfRawData 0x453400
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.19615

.rdata

MD5 1d31d2c7c5b6b0fd6b59ce0dcee5a04a 🔍
SHA1 cea3899b5ecc515f974cd39fe919d0e44879c274 🔍
SHA256 ccd049322315a13965f7ba3ab974660dd05775b15bf77351b47b42b98d686d04 🔍
SHA3 4eedbcb1870a9309dfe5fdb51c05d1125eba2cb04f362cd6347917276167ee4f 🔍
VirtualSize 0x529660
VirtualAddress 0x455000
SizeOfRawData 0x529800
PointerToRawData 0x453a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.74549

.data

MD5 6609cdb9c31302bdc5e0efa90f5034b1 🔍
SHA1 9e13f60f7996d9ea3a33656cd44eb1efdec6ce33 🔍
SHA256 1d7438aec4587dfa53b67c85b7768100a1dd99a34ae81fe387a6fec4565bd5b3 🔍
SHA3 18e1dda76f9a5f177c874f31ab5657da4632a6a669f47f5f0b4b6f7c83dd9901 🔍
VirtualSize 0x21217e0
VirtualAddress 0x97f000
SizeOfRawData 0xc8c00
PointerToRawData 0x97d200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.09473

.pdata

MD5 8405e7f74e5f553efe81935f33ced546 🔍
SHA1 923174a70b39681aa8a1406f024356de3e9813f2 🔍
SHA256 5dead0b36c6165383385fdfc5d50fa31e898a04bcd2e1660d6338f1ba5c85d10 🔍
SHA3 c3c5e881f687bc9117fdd62da8bb362f360c7736eb711bfb6ba126735bf1a797 🔍
VirtualSize 0x1d370
VirtualAddress 0x2aa1000
SizeOfRawData 0x1d400
PointerToRawData 0xa45e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.81163

.xdata

MD5 60687c82cba45b439815bacc1f3cfe9e 🔍
SHA1 adb4af8f727975c2cb79d034789be94ed45bf1e5 🔍
SHA256 374ddbdb59c5faa27e20eeb5450e1f6909a0667989da9e935ee26cb613df3344 🔍
SHA3 51ed3bfa7fb23d403ad3b4555279154d8417fcde69e53c058f27272cc1a00066 🔍
VirtualSize 0xb4
VirtualAddress 0x2abf000
SizeOfRawData 0x200
PointerToRawData 0xa63200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78711

.idata

MD5 dbfef4a0ea06d6beec2bea85d8d78257 🔍
SHA1 c3fbcaafc79ffc518a717f19c4aa0845c1c01f59 🔍
SHA256 1e69d7f2338de7d178b2f424bca589a67adf34e0923e0d330b2991db1e1b3704 🔍
SHA3 ce334359c067d53fdf330e3af8eae8476db0905a6688ad9b50576d8b852bcf8a 🔍
VirtualSize 0x57c
VirtualAddress 0x2ac0000
SizeOfRawData 0x600
PointerToRawData 0xa63400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.22131

.reloc

MD5 ef7c7b5bf621644f78fbbd04989e52ff 🔍
SHA1 2fba8ea8848cd5fc3206057fc0c69d40ac9cbf3d 🔍
SHA256 ee41dc8f4fdeabf51e8f716800a96604a525ce64d4c5dcbffd7ad27890012635 🔍
SHA3 2ac0c4af07239b07156decabe052f167dd6085d0a07c4f7d342d04de4092a2bf 🔍
VirtualSize 0x19a7c
VirtualAddress 0x2ac1000
SizeOfRawData 0x19c00
PointerToRawData 0xa63a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43248

.symtab

MD5 07b5472d347d42780469fb2654b7fc54 🔍
SHA1 943ae54f4818e52409fbbaf60ffd71318d966b0d 🔍
SHA256 3e67f4a7d14b832ff2a2433e9cf0f6f5720821f67148a87c0ee2595a20c96c68 🔍
SHA3 a70a3e18515c06557b62676f2a8eb6d7d41962d8c9c7c49f4641c429cc65b977 🔍
VirtualSize 0x4
VirtualAddress 0x2adb000
SizeOfRawData 0x200
PointerToRawData 0xa7d600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0203931

.rsrc

MD5 a242df5ef006300e47ab5bbea98262da 🔍
SHA1 248d32653e72d322ba742d438370931f1b5974c4 🔍
SHA256 93213f1b0c325d5216f5d7a91dd4097016f2d350854ffac5ef1b31c186ed3afe 🔍
SHA3 3ac2a1d49dd0a0d4294a18766da5e07556a00e57639d30d6a9d7b52fd0f9da43 🔍
VirtualSize 0x1b780
VirtualAddress 0x2adc000
SizeOfRawData 0x1b800
PointerToRawData 0xa7d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.33711

Imports

kernel32.dll GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2754
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93788
Detected Filetype PNG graphic file
MD5 2b537e9e6eb65972b05d5365482738a2 🔍
SHA1 be1184d65ca266454970a3301a4d27d46b92d4bf 🔍
SHA256 7bac321225fae76e8014315dea7120c56a418c2a01adb3ee4ec9cf4dbb9846f0 🔍
SHA3 7abf248d32a1251b16f57d74f2322f55b355a5875ee1743a91d6cf9f96ac7498 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43654
MD5 c3dac7b75fe3f595a7498330b1de50f5 🔍
SHA1 58e15e2ed5329729de02c1cb6a8ba8e131e4d308 🔍
SHA256 f969afa16f5612d3f6826b37bb6e684f7c403c79c1534432068b1fe4b080a6fa 🔍
SHA3 3c0703f0ebb5bdf298c0898f4b8f5cfa27f69dffea4a2592b19d07efe76e2d24 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.65438
MD5 12c679aacf3e37e99321fc85319883f1 🔍
SHA1 d1718f81b7a4a387fa48d09660266b59f8fad556 🔍
SHA256 cd0306654599bdce83e80178da6da357f393aeefcf76ab2a1250f06b1a0fdb88 🔍
SHA3 1a87f05dd57b8c8530b02944c4ceaf9e27876b764df8ef94da80b522ba68b384 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.77957
MD5 0774997d6c07b67485abec197cb98340 🔍
SHA1 0a35dfc220308cc0daaf4dce2cb4c10b1c74b065 🔍
SHA256 9b56afa5ee040d3237ef1db5556a7247917e2503893c5810da5cecddecf10da5 🔍
SHA3 4307101a3721803bba00c5760805d6331ca139691d8b96283732fb240973c1a5 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.00797
MD5 47e44c193170ab9a87a5feca25135dcd 🔍
SHA1 8b559ec2fbf9da3a69c77892e03662167a507236 🔍
SHA256 589d48255206260fa7079abf5ad38c83a05ce7b05660655cef65585330639a93 🔍
SHA3 5dbdfae9409c8b704a55cf06ef7a47bc52ce75249d48d60227c1b9a13e6318ca 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.37112
MD5 d84e5c9719fea6739d9260204a29f199 🔍
SHA1 17be7d2fb263e8931fd11185843611db24aeeb37 🔍
SHA256 6710b5143baa068dcf984467b5a3907822e3bf7ee003d32413d69ee67d6722af 🔍
SHA3 c959e5e49d2e5c5f42b9db4dd7860183ae3841e5714f459cc6d4b027dd73389d 🔍

3 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 31eca29f938ec89689f14a0d74aeecb6 🔍
SHA1 80d5f9c9c825c8e39bdd1cacb12ca1d7cd4b298a 🔍
SHA256 80d19fe3fd048af25fdb20f6134d126c49905790373b830a256c0fe5bc50af2e 🔍
SHA3 05aeaf91ddc196580d369ae19fd4b398aa7b005db8a5154225f4fb2e995ddf57 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27057
MD5 0f5406b1d79c28fa0081183eb617b56e 🔍
SHA1 376a7bc4d08561d511d0ec1bc2a3d45d4bdbd299 🔍
SHA256 5915e0f112dbb9be992eabcc6805f1f5ceca94ed5d4424eea22e8724f767281c 🔍
SHA3 cc14c8cc99a1f0cb17c2839895b4761c2c51df686d3d59b1b481d508ebd2e6ba 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x5b6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.22904
MD5 2343ef27430d6dbedf59120235f3f206 🔍
SHA1 9a454e842c02a14ac2b847aae0946f962c0daa48 🔍
SHA256 53095e5a581901ddf714de32ac90b3f1fd07a6d7989b6dddf32a4d47301a9960 🔍
SHA3 e8042247d4b11a7517f32558a8d1d081bf921862b18150df63727788f766ae23 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments A simple standalone program to install, repair, and uninstall BetterDiscord.
CompanyName BetterDiscord
FileDescription BetterDiscord Installer
LegalCopyright © BetterDiscord
ProductName BetterDiscord Installer
ProductVersion (#2) 2.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.