Manalyze report for 46f327039ecdadd87afda3548f63df8d6060376f6aced6ac25ff5b528de9339d

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Sep-07 19:53:49
Detected languages	English - United States

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig1(h)`
Info	Interesting strings found in the binary:	`Contains domain names: www.lua.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to RC5 or RC6`
Malicious	VirusTotal score: 4/70 (Scanned on 2026-09-08 10:05:16)	`Cylance: Unsafe` `ESET-NOD32: Win64/GameHack_AGen.CAR potentially unsafe application` `Sophos: Generic Reputation PUA (PUA)` `TrellixENS: Artemis!2A34299BCCC0`

Hashes

MD5	`2a34299bccc0a62019c0676a8093c33e` 🔍
SHA1	`922be012f6e4f34273daaac521197b3931bf1880` 🔍
SHA256	`46f327039ecdadd87afda3548f63df8d6060376f6aced6ac25ff5b528de9339d` 🔍
SHA3	`18c3f5dadf18f35e0c16bc97bdce27dd852494a0aab21fd08358579ae8037e96` 🔍
SSDeep	`24576:ZOTnyznizANo90zCU4zcBH6E3Mw/SXdTLPmSi503Pqrs:Kyznijd7zcBH6jVdTL+x50Ws` 🔍
Imports Hash	`d582fe99d005da10a502e6a4d1705576` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Sep-07 19:53:49
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x117000`
SizeOfInitializedData	`0x38800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000001130E0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x153000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`84c71d77b00608b1ac012153f599db0d 🔍`
SHA1	`35f382bae98a6902873dac028f9dad451a7acebd 🔍`
SHA256	`9df69f687db76efa9b9869266a76245d942253d85e70a069b5f4d77a119b1880 🔍`
SHA3	`9856fbf0e8a3f289cd62ec9d78860ed0ece4742fe0c29e51c03cda3c0efe45c0 🔍`
VirtualSize	`0x116fb0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x117000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.45676`

.rdata

MD5	`270802018f938612845f4229ec5ec415 🔍`
SHA1	`120b18d454629e7678d77b00ed05990ddcee662b 🔍`
SHA256	`524e7a88fa632a37a8ef5fdb23f54be81cd9c9545aef08ed6bb5a21ed47b3f3e 🔍`
SHA3	`646fafc42f70be8768ebea2e9487a00ff19773e5226da2cfca0588deb1d486a8 🔍`
VirtualSize	`0x28bce`
VirtualAddress	`0x118000`
SizeOfRawData	`0x28c00`
PointerToRawData	`0x117400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.37282`

.data

MD5	`15e27096e651bd79bbcc68d74ab42683 🔍`
SHA1	`9365d0ef92e4aa91b28825e88f5b8f5b182afef8 🔍`
SHA256	`13567c8073f1392634167ad55b1fddb2a33aceeb09ebaa1d3592aab2cdb17c16 🔍`
SHA3	`ebb577791ec7631561daa60d5144a2cf04a408a1c19c0d1dbfb8a632a0830c31 🔍`
VirtualSize	`0x3ff0`
VirtualAddress	`0x141000`
SizeOfRawData	`0x3800`
PointerToRawData	`0x140000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.93544`

.pdata

MD5	`c3a8b8393b808ddb061c33e570b16bd3 🔍`
SHA1	`ba4796e789f36222531b33ae6ecef2e2f496e7b7 🔍`
SHA256	`1b0f285cd299e89fc3e120f7181c92008a3fae06beebc4331a016030879cc821 🔍`
SHA3	`0bce1042c240d4acb3a8597cec2329d666d65e262c1656eeac79fae394154589 🔍`
VirtualSize	`0xa05c`
VirtualAddress	`0x145000`
SizeOfRawData	`0xa200`
PointerToRawData	`0x143800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.97009`

.rsrc

MD5	`150f3c03b2002425569eacfa2741241a 🔍`
SHA1	`9203b415b7a97b847be128a21e5ed50e4d486e44 🔍`
SHA256	`3f4a4c193d3d525a401f1c3758e76fcc468ee7caedaefca62b5fd9b46c974432 🔍`
SHA3	`3eec295b021d41b4e129404672f3c6b8a06db7391d9e9cc50f07409614a57223 🔍`
VirtualSize	`0x1e0`
VirtualAddress	`0x150000`
SizeOfRawData	`0x200`
PointerToRawData	`0x14da00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.7015`

.reloc

MD5	`21a4748d179d941d0da01be7a6953c33 🔍`
SHA1	`cf7d5aed2f5110457875d3993e99157b9677dc02 🔍`
SHA256	`7387773dd4b1af964d1f5478b5ba45aaea3086fe83ac9ea74dbc49b7dadef9f1 🔍`
SHA3	`473f9c56dad2416aa3c579c4e9c4e1cee4d6dc4b8c6082c54d2f8b33b900a4fd 🔍`
VirtualSize	`0x1720`
VirtualAddress	`0x151000`
SizeOfRawData	`0x1800`
PointerToRawData	`0x14dc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.40256`

Imports

KERNEL32.dll	`QueryPerformanceCounter` `QueryPerformanceFrequency` `FindClose` `FindFirstFileW` `FindNextFileW` `GetFileAttributesW` `MultiByteToWideChar` `WideCharToMultiByte` `SetUnhandledExceptionFilter` `InitializeSListHead` `GetSystemTimeAsFileTime` `GetCurrentThreadId` `GetCurrentProcessId` `SleepConditionVariableSRW` `WakeAllConditionVariable` `AcquireSRWLockExclusive` `ReleaseSRWLockExclusive` `GetModuleHandleW`
MSVCP140.dll	`?_Xbad_function_call@std@@YAXXZ` `?_Xout_of_range@std@@YAXPEBD@Z` `?_Xlength_error@std@@YAXPEBD@Z`
VCRUNTIME140.dll	`_purecall` `__C_specific_handler` `__current_exception` `memcmp` `__std_terminate` `strchr` `_CxxThrowException` `memchr` `memset` `memmove` `memcpy` `__std_exception_copy` `__current_exception_context` `__std_exception_destroy`
VCRUNTIME140_1.dll	`__CxxFrameHandler4`
api-ms-win-crt-stdio-l1-1-0.dll	`_fileno` `fclose` `fseek` `fread` `__acrt_iob_func` `_wfopen` `fopen` `fwrite` `__stdio_common_vfprintf` `_set_fmode` `_setmode` `__stdio_common_vsprintf` `__p__commode` `ftell`
api-ms-win-crt-convert-l1-1-0.dll	`strtoull` `strtoul` `strtoll` `atoi` `strtod`
api-ms-win-crt-string-l1-1-0.dll	`wcslen` `strcspn` `strncpy` `tolower` `toupper` `iscntrl` `isgraph` `isalnum` `ispunct` `isdigit` `strspn` `islower` `strncat` `isupper` `isalpha` `isspace` `strpbrk` `strcmp` `strncmp` `strlen` `isxdigit`
api-ms-win-crt-math-l1-1-0.dll	`cosh` `exp` `fmod` `log` `log10` `log2` `sin` `cos` `sqrt` `atan2` `tanh` `atan` `asin` `__setusermatherr` `acos` `sinh` `pow` `floorf` `floor` `ceilf` `_fdsign` `sqrtf` `round` `modf` `ceil` `frexp` `tan` `_dsign` `ldexp`
api-ms-win-crt-heap-l1-1-0.dll	`_callnewh` `malloc` `realloc` `free` `_set_new_mode`
api-ms-win-crt-time-l1-1-0.dll	`_gmtime64_s` `_difftime64` `clock` `_localtime64_s` `strftime` `_time64`
api-ms-win-crt-runtime-l1-1-0.dll	`_crt_atexit` `_register_onexit_function` `_initialize_onexit_table` `terminate` `_cexit` `__p___argv` `__p___argc` `_exit` `exit` `_initterm_e` `_initterm` `_errno` `_get_initial_narrow_environment` `_initialize_narrow_environment` `_configure_narrow_argv` `_set_app_type` `_seh_filter_exe` `_c_exit` `_register_thread_local_exe_atexit_callback`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Sep-07 19:53:49
Version	`0.0`
SizeofData	`892`
AddressOfRawData	`0x131570`
PointerToRawData	`0x130970`

TLS Callbacks

StartAddressOfRawData	`0x140131910`
EndAddressOfRawData	`0x140131918`
AddressOfIndex	`0x140144f60`
AddressOfCallbacks	`0x140118b70`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140142e40`

RICH Header

XOR Key	`0x703ffdc6`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`16`
ASM objects (35721)	`4`
C objects (35721)	`10`
C++ objects (35721)	`32`
Imports (35721)	`6`
Imports (33145)	`3`
Total imports	`156`
C++ objects (36256)	`91`
Resource objects (36256)	`1`
Linker (36256)	`1`

Errors

Leave a comment

No comments yet.