4c8f04b428e47ecd401c2b21dc5b5f6ac3d2f7151fe66df621f789a33d4c2a5a

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2080-Sep-19 13:00:02
FileDescription
FileVersion 0.0.0.0
InternalName Daou.dll
LegalCopyright
OriginalFilename Daou.dll
ProductVersion 0.0.0.0
Assembly Version 0.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET DLL -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • %temp%
 Contains domain names:
  • com.rlabrecque.steamworks.net
  • discord.com
  • https://discord.com
  • https://steamcommunity.com
  • https://wtfismyip.com
  • rlabrecque.steamworks.net
  • steamcommunity.com
  • steamworks.net
  • wtfismyip.com
  • youtube.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Suspicious The PE is possibly packed. The PE only has 1 import(s).
Suspicious VirusTotal score: 1/71 (Scanned on 2026-08-02 17:58:24) APEX: Malicious

Hashes

MD5 71c129a3a8717633720529a5ecf3d500
SHA1 be7401f2d9723e9f3395aee558c6cf2f0bda0b54
SHA256 4c8f04b428e47ecd401c2b21dc5b5f6ac3d2f7151fe66df621f789a33d4c2a5a
SHA3 b635f0b98303e9e0465ec7076f9a5f4c468774d15373d6127c3cae316c83950c
SSDeep 6144:voQm5fa3k8UNVeA/ul8CHdxogl7rW10In:AQQNoA/eThVu08
Imports Hash dae02f32a21e03ce65412f6e56942daa

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2080-Sep-19 13:00:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x4f000
SizeOfInitializedData 0x600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00050E5E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x52000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x56000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d03414078212acb3f0a3b708c5545da5
SHA1 971db033320614e196b5236f5d13ce7afee04b63
SHA256 4063d7bfbff11653117024e9b9ddb9c6955d8778b9fa6973330f9fa0fba146a6
SHA3 d2b174fa2de4c579193f0eec88479caa0823c521b051a1e12405206ad986efdd
VirtualSize 0x4ee64
VirtualAddress 0x2000
SizeOfRawData 0x4f000
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.25097

.rsrc

MD5 e91bbcf6edab4095113e98a50a2925e9
SHA1 c01543039ad8594ab7d71b6bd69358cc47996e29
SHA256 a5a5049be1d38e2487fe575ebc1dccd80f93ee89640f83a6de7143da06cd1314
SHA3 ed3f6158956aba6819e14dc641354a825c1ac20497156098d67f0657a5938975
VirtualSize 0x294
VirtualAddress 0x52000
SizeOfRawData 0x400
PointerToRawData 0x4f200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.12271

.reloc

MD5 05f9fe83459a914e001baf46c5a05d19
SHA1 32ea898170568530d59e4d73313a6f7cd6dafffb
SHA256 4d80ca0a8df702b1913ba5dcd04c010e44ee20c7865fdbdda132fa9a9a97ebb1
SHA3 ae2a5b16be844b669a7112e36d8bbeee253f21a549483ec77f7d63883ee42302
VirtualSize 0xc
VirtualAddress 0x54000
SizeOfRawData 0x200
PointerToRawData 0x4f600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorDllMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x23c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.15181
MD5 8459c1ea336924362e106e62a034200b
SHA1 b57423d312571334b2c1085fcdbd07f23d0937f7
SHA256 fe490128b1c192b634e6e5149e5b6658e4f91170c58d82531fc893c6953ac254
SHA3 31040f48bce6bc9c2b158f4bdfb8d4706b35d91978a281ea2da89699156be0d4

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_DLL
Language UNKNOWN
FileDescription
FileVersion (#2) 0.0.0.0
InternalName Daou.dll
LegalCopyright
OriginalFilename Daou.dll
ProductVersion (#2) 0.0.0.0
Assembly Version 0.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.