34f57e6d595462204721569d5188b445919940bbe6e21d59d6fd5e0a2f2872e9

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jan-10 16:59:52
Detected languages English - United States
Debug artifacts C:\Users\ezema\Downloads\Chocola\Chocola Main\bin\UniversalNoRecoil.pdb

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • dearimgui.org
  • http://www.dearimgui.org
  • http://www.dearimgui.org/faq/
  • https://discord.gg
  • www.dearimgui.org
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Possibly launches other programs:
  • ShellExecuteA
Uses functions commonly found in keyloggers:
  • MapVirtualKeyW
  • GetForegroundWindow
  • GetAsyncKeyState
Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 6/70 (Scanned on 2026-09-05 20:04:38) APEX: Malicious
CrowdStrike: win/grayware_confidence_70% (D)
Google: Detected
Gridinsoft: Trojan.Win64.Agent.cl
Symantec: ML.Attribute.HighConfidence
TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101DH26ZB

Hashes

MD5 76923d5a09b3d96507ed966f74c93546 🔍
SHA1 84a6f3abee8c2e6210b810475b8d624c978661a1 🔍
SHA256 34f57e6d595462204721569d5188b445919940bbe6e21d59d6fd5e0a2f2872e9 🔍
SHA3 6fd5a95cfebad77d451beaaf03bc3625ab7e8b92191ae3c80e511c872e39f217 🔍
SSDeep 24576:MHofNrX4wY01QVJ3I6EHiShrUHp6nvAWBUTRl5jHA1Cucf9b3le7nY97r25XRGh:MoGAnvbD8f9b3SnY9m5XXip 🔍
Imports Hash 142b62330e6ff1539957c734820d9dbf 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jan-10 16:59:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xb0800
SizeOfInitializedData 0x9ac00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000AFF38 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x14f000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 2eaf0e077f3c273cd969667c1d088d3b 🔍
SHA1 81104423e007794f3523da0d2569fe37bea46b03 🔍
SHA256 bfd758fd1f562ff768db1f9115cd116b9f91dcb69f821db1dea264bf4c51f993 🔍
SHA3 022e2777b041433e9209cccb6a55863f62a60bf61b7212e9f7f3821c33254172 🔍
VirtualSize 0xb061e
VirtualAddress 0x1000
SizeOfRawData 0xb0800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.4619

.rdata

MD5 8ac019aece985a2cf0da603a349ce54a 🔍
SHA1 5f9b0f5a67b204a8ad7af6aac9327be99ef80d9b 🔍
SHA256 99d45a81dbf53e411b68200b59c520d2c634836d4c55dfb5641fd276e04d6124 🔍
SHA3 f224076572515b23b8ec4ef215da3332012237dae1c1e684d0da69ac481efc2f 🔍
VirtualSize 0x248c2
VirtualAddress 0xb2000
SizeOfRawData 0x24a00
PointerToRawData 0xb0c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.93477

.data

MD5 40156b2f0c4ecf3383057ff1e8987865 🔍
SHA1 acd9930c0d13f79d23bc4d247abd06ce19877296 🔍
SHA256 4d98006a353f69e37ffd17704459690f5106b9df9fb36eea6a2d4030fd895350 🔍
SHA3 1b80719b5152933315b3ec64c4190d40f48de07154cc13ddbdcb18800736fcae 🔍
VirtualSize 0x62b0
VirtualAddress 0xd7000
SizeOfRawData 0x4800
PointerToRawData 0xd5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.693949

.pdata

MD5 ce2bc46e697beb2765ef08cf316cfe3b 🔍
SHA1 89f799b5db12b719f9bd2f8d0ba95510ceb1cfc1 🔍
SHA256 4011e97580707ec701cc2dbb2f39f34690f5dd1c163183609ff4da8ad8847a4d 🔍
SHA3 1f52fb276d57a8152c99e22c8b33c1ade91879f08a8f30bb18f87079528e2f6d 🔍
VirtualSize 0x5ab4
VirtualAddress 0xde000
SizeOfRawData 0x5c00
PointerToRawData 0xd9e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.97986

.rsrc

MD5 c9b222239c9fd3af9f2bf8b6fc8f878e 🔍
SHA1 e116628aa3eff69228990bd8d6a321b22a2a46f2 🔍
SHA256 f302e9fc84f66da170f0429bf8dadd322251cf3f07f4e2dc977000e25bb7561c 🔍
SHA3 7f0a79c5efff46eccaf4f57e299fdf5c621299679c519ae01a41da1db7fa6a93 🔍
VirtualSize 0x69c60
VirtualAddress 0xe4000
SizeOfRawData 0x69e00
PointerToRawData 0xdfa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.07896

.reloc

MD5 7f1c8421ebbe8853bece41302af4a077 🔍
SHA1 bf232867af5e6a16856f084ec6903a3775d14bba 🔍
SHA256 ec39f986eb35a3c2b6ff55aecd08bbdb9a6f1aa808e10e049a1ebca1d85b6bff 🔍
SHA3 e49e3cb78ee7f667f96859fe2bf8091658433f78f14d49a6d16bae16c2edfd9c 🔍
VirtualSize 0x2cc
VirtualAddress 0x14e000
SizeOfRawData 0x400
PointerToRawData 0x149800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.18995

Imports

KERNEL32.dll LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
GetTickCount
GlobalUnlock
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WakeAllConditionVariable
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetPrivateProfileStringA
GetModuleHandleA
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
UnhandledExceptionFilter
GetPrivateProfileIntA
WritePrivateProfileStringA
GetModuleHandleW
MultiByteToWideChar
Sleep
SetUnhandledExceptionFilter
USER32.dll BringWindowToTop
SetCursor
SetWindowLongW
SetFocus
SetCapture
LoadCursorW
PeekMessageW
GetWindowLongW
AdjustWindowRectEx
GetKeyState
GetDC
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
GetCapture
GetMonitorInfoW
ClientToScreen
IsChild
TrackMouseEvent
SetLayeredWindowAttributes
OpenClipboard
CloseClipboard
GetClientRect
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
EmptyClipboard
GetClipboardData
SetClipboardData
MapVirtualKeyW
GetActiveWindow
TranslateMessage
LoadIconW
PostQuitMessage
UpdateWindow
DestroyWindow
ShowWindow
SendInput
GetForegroundWindow
RegisterClassExW
UnregisterClassW
CreateWindowExW
GetAsyncKeyState
DefWindowProcW
SetWindowPos
DispatchMessageW
GDI32.dll GetDeviceCaps
COMDLG32.dll GetSaveFileNameA
GetOpenFileNameA
SHELL32.dll ShellExecuteA
MSVCP140.dll _Thrd_join
_Query_perf_counter
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
_Thrd_yield
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
d3d11.dll D3D11CreateDeviceAndSwapChain
IMM32.dll ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
D3DCOMPILER_47.dll D3DCompile
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memmove
memcpy
memset
memcmp
memchr
__current_exception_context
_CxxThrowException
__C_specific_handler
strchr
strstr
__std_exception_copy
__std_exception_destroy
__std_terminate
__current_exception
api-ms-win-crt-heap-l1-1-0.dll malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-stdio-l1-1-0.dll fread
_wfopen
fwrite
fclose
__stdio_common_vfprintf
fseek
fflush
__acrt_iob_func
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
__p__commode
__stdio_common_vsprintf_s
_set_fmode
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-convert-l1-1-0.dll atof
strtof
api-ms-win-crt-runtime-l1-1-0.dll _c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_invoke_watson
_initterm_e
_errno
_initterm
_get_narrow_winmain_command_line
terminate
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
api-ms-win-crt-string-l1-1-0.dll strncmp
strcmp
strncpy
toupper
api-ms-win-crt-math-l1-1-0.dll pow
powf
sinf
sqrtf
acosf
atan2f
cosf
__setusermatherr
log
floorf
ceilf
logf
fmodf
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.85707
MD5 606489c72246b2066d0c96d1c84fa983 🔍
SHA1 38553eddc7bb805b14347e89293660ae24f0d75a 🔍
SHA256 d11918a57c510d7625b50a10ac65553ede3b67f44b11cf65c0b25e649d4dc2df 🔍
SHA3 ed7875d1b9ee877bc48fb8b81d5da3bed9aa08ac42ddf3b08e46ae54023e5e8f 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.02422
MD5 45e740233aa45097308b698e6813d68e 🔍
SHA1 14b68fe9b7cfad13026d010e4c771cd4d1b7c7ee 🔍
SHA256 c92fe749a2071f36248ec49fec0dfbab7426ae32f46dd75dbd8435a62c3bf830 🔍
SHA3 09cf839a9b73050d1198520e89ea135216c086f0a4638ef8b73c6c8cd1d166c0 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.06126
MD5 cb48cd321b6958a9e079e96d60c4726e 🔍
SHA1 9ae6e2a5c67cdf06d0f568d67f5c29925721d9d2 🔍
SHA256 9a22fd690651d35efedd7e794b98196ab4e075966a696e0b3d0c190222621454 🔍
SHA3 722797ba0df1f72a425c7397d4c5f1b918b515b5e6f9f8104af212abc6fc61f5 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.06502
MD5 cb27a80df24e7e00cdcea536ffa049fc 🔍
SHA1 d5db1639b042e1e72a4cb6ba7e38487a1c7904a9 🔍
SHA256 e5321c91053b4255b89e89ba82e221878a3d4d75ef0bd56f6013437fde416521 🔍
SHA3 6370a47fc477af5c4bffec90bfa4b1b5f7cb2b8f962c3acb2b0234812c207e2a 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.08975
MD5 33a957b8eac80263b23655acec0cfa91 🔍
SHA1 39ace0097a58e93e269a9168b7f346181992f0c4 🔍
SHA256 103b3d44d58078a4d6cc815e3912be599c5c8a1d2527f909bbb77917fc70fd78 🔍
SHA3 0d5850559814c52ae04467e43140f06e83d20e1e557ec870b873742da73510bc 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.07
MD5 20fdc071de39663a6e6ffd30a3f27f30 🔍
SHA1 48e93fca54381a74871c411852a280e0f406f5cd 🔍
SHA256 9dd4be96a28751738bbe6f91a652f1efd6a31104f2680c288bff69b24218bf76 🔍
SHA3 d7b9830d1a0cd4b2e09483dbb4c108a31784c34cfa703194bf12076900449b1b 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.07881
MD5 9c8f9391d72b3e94b1afd9eae03d5ec0 🔍
SHA1 782bd8d9b0d503e59b97cc1b6fdb1d0ac0ccf4f9 🔍
SHA256 85ccb2ac7e0abd998fe35396827254357210a7a527b39e6d564b30d82b5f5824 🔍
SHA3 dd6bd44a6dd14f9ae216925fa8925da9b4cede5f1326a8685953e78e0477eb0e 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.07556
MD5 7e2159b2138a8c499479d8a789846236 🔍
SHA1 887bc97b49525ab027902c7b86076f004ad98b22 🔍
SHA256 47b772845aca03324bd611bce963c0d501a8ed5d1710af873497c7085c05a19d 🔍
SHA3 fa726a53dae4a0a7484c73f640c284b942ddf20f30c6db5530dcf3ac93325d1a 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.06647
MD5 51f31c557c2799ea4d693cd2cbdd73d0 🔍
SHA1 6f08c804664819fd68613bac21d4faf1571b928d 🔍
SHA256 a1b3fa570867382397118e6b323f55203e34070cdeb43b0597bb9fd5e8c17514 🔍
SHA3 d792ec40487e826b45fa592877275643f97ea11c02e6e2d6291f8a92db210b11 🔍

101

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01226
Detected Filetype Icon file
MD5 8bd3cd6b83e995093febc060ec76aeb3 🔍
SHA1 b0338c581ad2beceda2bccbaa46d96383d3dc4a1 🔍
SHA256 4f16960f06a3608a7d49573795526ff6790c65d8015f0419d72a373e55ed8ac7 🔍
SHA3 dab5ecc0662f74eef0913882133480a1e4285be23cab87b03392d82bdce0c981 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jan-10 16:59:52
Version 0.0
SizeofData 96
AddressOfRawData 0xcb5a8
PointerToRawData 0xca1a8
Referenced File C:\Users\ezema\Downloads\Chocola\Chocola Main\bin\UniversalNoRecoil.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jan-10 16:59:52
Version 0.0
SizeofData 20
AddressOfRawData 0xcb608
PointerToRawData 0xca208

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jan-10 16:59:52
Version 0.0
SizeofData 892
AddressOfRawData 0xcb61c
PointerToRawData 0xca21c

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Jan-10 16:59:52
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400cb9b8
EndAddressOfRawData 0x1400cb9c0
AddressOfIndex 0x1400dbd6c
AddressOfCallbacks 0x1400b26e8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400d7040

RICH Header

XOR Key 0xc0e2de0f
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 16
ASM objects (35207) 4
C objects (35207) 10
C++ objects (35207) 31
Imports (35207) 6
Imports (33145) 19
Total imports 207
C++ objects (LTCG) (35220) 11
Resource objects (35220) 1
151 1
Linker (35220) 1

Errors

Leave a comment

No comments yet.