38b8b5163b60cf4ed5290d1ac3a087f5c28a7985976ba2968747bc620954ef91

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jul-15 01:12:05
Detected languages English - United States
Debug artifacts D:\injector\chanchito\x64\Release\ChanchitoInjector_x64.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • LoadLibraryW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • OpenProcess
  • VirtualAllocEx
  • CreateRemoteThread
  • WriteProcessMemory
 Possibly launches other programs:
  • system
 Functions related to the privilege level:
  • OpenProcessToken
 Manipulates other processes:
  • OpenProcess
  • Process32NextW
  • ReadProcessMemory
  • Process32FirstW
  • WriteProcessMemory
Malicious VirusTotal score: 26/64 (Scanned on 2026-08-16 11:39:29) ALYac: Adware.GenericKD.61154928
Arcabit: Adware.Generic.D3A52670
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
ESET-NOD32: Win64/GameHack.PL potentially unsafe application
Elastic: malicious (high confidence)
Emsisoft: Adware.GenericKD.61154928 (B)
Fortinet: Adware/GameHack
GData: Adware.GenericKD.61154928
Google: Detected
K7AntiVirus: Unwanted-Program ( 005d1ac41 )
K7GW: Unwanted-Program ( 005d1ac41 )
Lionic: Adware.Win32.GameHack.2!c
Malwarebytes: Generic.Malware/Suspicious
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!38B8B5163B60
MicroWorld-eScan: Adware.GenericKD.61154928
Microsoft: Trojan:Win32/Wacatac.B!ml
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!5B253F55A622
VIPRE: Adware.GenericKD.61154928
Varist: W64/ABApplication.WVMI-2387
Zillya: Adware.GameHack.Win64.98
alibabacloud: Trojan:Win/GameHack.PE

Hashes

MD5 5b253f55a62287c738c54d2fd5d1eff7 🔍
SHA1 fe47dc3334dbf9702d9c2689d6b8f06e5fb29d8f 🔍
SHA256 38b8b5163b60cf4ed5290d1ac3a087f5c28a7985976ba2968747bc620954ef91 🔍
SHA3 0b3518deda7be01aaa1f130e77d1bd1f344a4e3f9c8ce9c6aabf4bc9d93672c4 🔍
SSDeep 1536:Z5mKK6gx7ITJqm/GJuDNhVefBGsejIU6SSZC2vdLQj/1/NOtbRn:ZsKKXhUJqm2uDNhVe5xe0x9dQjPORF 🔍
Imports Hash adc8555ac45106ad2db280e16a4f1875 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jul-15 01:12:05
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xc000
SizeOfInitializedData 0x9a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000BC70 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x19000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 2e7c30d0d423ed7fee684e7c42ca04e7 🔍
SHA1 6d0323fd3705460c295f5b512cb9a76d43d99c19 🔍
SHA256 6698f10bd42866e6924e00459b6bf49ec6d14c7410ae8ed1ad2a2b76ca4ef7a8 🔍
SHA3 b76e15e66c08fb8ed537e270904aae4f4e5fc18d5bd8359dfaaa4a83bb7a855d 🔍
VirtualSize 0xbf31
VirtualAddress 0x1000
SizeOfRawData 0xc000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.12362

.rdata

MD5 0f3d196cd631bd77d9e798b5ac45b0ad 🔍
SHA1 1b2fba443474f082488c0b3cf1f1b986163c6602 🔍
SHA256 e316ea91a80f32458a0a11895c7308314ba58dc94649af264c3388bff05731ee 🔍
SHA3 1a40b6a1f3e34944380b5463f6aa9e010dceb6359a7c74b971c57f2a65f64d3e 🔍
VirtualSize 0x7c54
VirtualAddress 0xd000
SizeOfRawData 0x7e00
PointerToRawData 0xc400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.25206

.data

MD5 56023a72ac5753bf972972d711656693 🔍
SHA1 8ed2d099c4db757eaacc476b69a7094ee329c3b1 🔍
SHA256 d67512ff85f62731c0f7a4f5e793ace756f347d73c1bf65c7644fb1573a6a085 🔍
SHA3 2bd3fc4a79c71096d3c112222e0a6e49e5c9d3ee0d150c67243e25fbe04f50b7 🔍
VirtualSize 0x6f8
VirtualAddress 0x15000
SizeOfRawData 0x600
PointerToRawData 0x14200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.34941

.pdata

MD5 bbb3375c98442ca91cd09db5f7030358 🔍
SHA1 e7b4c07f1b8b096de362e369cada30aa25bf5aa5 🔍
SHA256 c4764ba255ec39774803fc61e4506f7ab92f597df59364b90f45b6335bd1dd59 🔍
SHA3 929e6f386fe7751f009c1dd77a6b22abdeeb53b14e3b1efa722672396faba87e 🔍
VirtualSize 0xac8
VirtualAddress 0x16000
SizeOfRawData 0xc00
PointerToRawData 0x14800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.5174

.rsrc

MD5 0283cfffcc7e30da89fa5d8d781bd66b 🔍
SHA1 e82e6b43226eb0eb34140893373af4696277276e 🔍
SHA256 9b860ad0758d02f57bdccc9ba16733ad460941fcd9ac792fb8b5749197104bd9 🔍
SHA3 4dd4325e59e53e8244632924db04bf0f11e4218e750751566cb1a80a69a1462f 🔍
VirtualSize 0x570
VirtualAddress 0x17000
SizeOfRawData 0x600
PointerToRawData 0x15400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.37629

.reloc

MD5 b75fa36b9ac4b16b339086907bfa910c 🔍
SHA1 10f111e27082cb452e25eaa99687af5f74548998 🔍
SHA256 1a400cd2f4067b9cf0287f0cfb81b2f13cf9e708f3c09c3019af5b7b0e42d9c3 🔍
SHA3 9fba23d34e7386e1ad4ff34b9270218b788576eb2a8ecaa2e32003db2445409e 🔍
VirtualSize 0xf4
VirtualAddress 0x18000
SizeOfRawData 0x200
PointerToRawData 0x15a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.07455

Imports

KERNEL32.dll GetCurrentProcess
GetStdHandle
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
GetLastError
Process32NextW
LoadLibraryA
SetConsoleTitleA
CloseHandle
LoadLibraryW
GetProcAddress
VirtualAllocEx
ReadProcessMemory
GetModuleHandleW
CreateRemoteThread
VirtualFreeEx
FormatMessageA
SetConsoleTextAttribute
Process32FirstW
WriteProcessMemory
GetLocaleInfoEx
FindClose
FindFirstFileW
GetFileAttributesExW
GetFullPathNameW
CreateFile2
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetCurrentThreadId
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
ADVAPI32.dll GetTokenInformation
OpenProcessToken
MSVCP140.dll ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Query_perf_counter
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Winerror_map@std@@YAHH@Z
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll _CxxThrowException
__current_exception_context
__current_exception
memset
memmove
memcpy
memcmp
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0.dll ungetc
setvbuf
fgetpos
__p__commode
fread
fwrite
_fseeki64
_get_stream_buffer_pointers
_set_fmode
fgetc
fclose
fflush
fputc
fsetpos
api-ms-win-crt-heap-l1-1-0.dll _callnewh
malloc
_set_new_mode
free
api-ms-win-crt-string-l1-1-0.dll wcslen
isdigit
strlen
_wcsicmp
api-ms-win-crt-runtime-l1-1-0.dll _initterm
_get_initial_narrow_environment
exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_exit
system
_initterm_e
abort
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
_errno
__p___argc
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0.dll strtol
api-ms-win-crt-locale-l1-1-0.dll ___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll __setusermatherr

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.9492
MD5 864b0d6ccfcec2a043b6acdfaf83b40d 🔍
SHA1 e68e44839976ea448d4476ae19032d2cb4bf976b 🔍
SHA256 27124bd2f74dfe699cbb13cf50ddaa79652f3bf3df2397738a5185619d578ec2 🔍
SHA3 1fe8b5263e8300c0d456fa3ed4aed922247b72e5b19e9b4163ac4e32f97efff8 🔍

101

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.39546
Detected Filetype Icon file
MD5 f7aa427618874b664d4bc22c6eec5ec4 🔍
SHA1 a31cd81e8b4ba0250c6fc1c1bca637caad4fd856 🔍
SHA256 7b48d3f2850579cd228af3d59341d09acb2ac3a1988f19360c9993a71c734532 🔍
SHA3 43a97351e22deb183d9445c3e7aac0fd4f2569c6fce4d04f7eba05fedeebc7e9 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jul-15 01:12:05
Version 0.0
SizeofData 84
AddressOfRawData 0x11900
PointerToRawData 0x10d00
Referenced File D:\injector\chanchito\x64\Release\ChanchitoInjector_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jul-15 01:12:05
Version 0.0
SizeofData 20
AddressOfRawData 0x11954
PointerToRawData 0x10d54

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jul-15 01:12:05
Version 0.0
SizeofData 800
AddressOfRawData 0x11968
PointerToRawData 0x10d68

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Jul-15 01:12:05
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140015040

RICH Header

XOR Key 0x83812379
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 16
ASM objects (35721) 3
C objects (35721) 10
C++ objects (35721) 32
Imports (35721) 6
Imports (33145) 5
Total imports 223
C++ objects (LTCG) (36248) 1
Resource objects (36248) 1
151 1
Linker (36248) 1

Errors

Leave a comment
🤑 New Message from Coinbase. READ ➡️ graph.org/YOU-HAVE-A-NEW-BI 9 hours ago
🤑 New Message from Coinbase. READ ➡️ graph.org/YOU-HAVE-A-NEW-BITCOIN-TRANSFER-FROM-COINBASE-08-27?hs=d3b9d1646b2ac6b468e469a9b3eab976& №CY7058 🤑