6f0f63bee95d6715e0656f8b0bcbcce0cc3b27f03f012c8b8c4c34557a2e1cb7

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Feb-02 10:58:07
Detected languages English - United States
Korean - Korea
Comments PotPlayer
CompanyName Kakao
FileDescription PotPlayer
FileVersion 0, 0, 0, 0
InternalName Daum 팟플레이어
LegalCopyright ⓒ Kakao Corp. All rights reserved.
OriginalFilename PotPlayer
ProductName PotPlayer
ProductVersion 0, 0, 0, 0
SpecialBuild Kakao

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
The PE only has 6 import(s).
Info The PE contains common functions which appear in legitimate applications. Uses Microsoft's cryptographic API:
  • CryptVerifyMessageSignature
Info The PE is digitally signed. Signer: Kakao Corp.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/71 (Scanned on 2026-10-17 07:08:16) All the AVs think this file is safe.

Hashes

MD5 b4c01d7a84c61c2c49492d881d56ef7e 🔍
SHA1 11c1e981973a5cc7436136c88e2e345b40da3e8d 🔍
SHA256 6f0f63bee95d6715e0656f8b0bcbcce0cc3b27f03f012c8b8c4c34557a2e1cb7 🔍
SHA3 5ad5dbc8d3623d093e8b186b96f10d7d05dfdf530bfce59249984f12c0b11055 🔍
SSDeep 49152:NleDr/z0GejC7qIjhCi5wOKqUHu373PBJE2x:W//gGejWqIjEFxg75JEW 🔍
Imports Hash 62ae1ac6f4a914345cca1ad596eb3213 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 11
TimeDateStamp 2026-Feb-02 10:58:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xd000
SizeOfInitializedData 0x33800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000003BD058 (Section: .boot)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x5e7000
SizeOfHeaders 0x400
Checksum 0x267736
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 2152e6cce62f8384fc0b2e154f545697 🔍
SHA1 709b28b928b1f20171c839543bb78ecfe6317dd3 🔍
SHA256 dd2fceafa36886c24ccb3fff4a6a5cef715af5e345d9c24c1711502e253515db 🔍
SHA3 35cadbbb08f1fb964d0c896bb3c36a8a7656e212f0b52c8374c629e0b59fe4ac 🔍
VirtualSize 0xce6c
VirtualAddress 0x1000
SizeOfRawData 0x8800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.94519

(#2)

MD5 c972f1248dd5caeeea6d7b142f7531c0 🔍
SHA1 76394f52f0a437ea1fd93cd302e0166599b66426 🔍
SHA256 df5ea702ca6b4dc7aa8ff1b044420b48fce07e056f410f8d17aedb9681bf99d1 🔍
SHA3 6f85a1c04e59e42fbdd1fd3a6ec48f4b8b15024f7a7c764885c8dabd4ea19312 🔍
VirtualSize 0xa2ae
VirtualAddress 0xe000
SizeOfRawData 0x4400
PointerToRawData 0x8c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.8987

(#3)

MD5 b1b6bd8884727542627076dd2e46a468 🔍
SHA1 30f05d1d7ce69e2fe9845677351ffef1aeee0ba4 🔍
SHA256 c97d3b859378a98f8ce39e4e94491cc9660fbb44739737a1be8c542de98e5208 🔍
SHA3 9582a5aa5e7c455d4fed806a1ec37d0534c47677dd3dcdd51c2ceab9cbcc4e93 🔍
VirtualSize 0x1e08
VirtualAddress 0x19000
SizeOfRawData 0x400
PointerToRawData 0xd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.96251

(#4)

MD5 bca0ccdbd03c0fd12c868636364e2ea0 🔍
SHA1 d1f58b58b1612a633aa1163a18413648909f1e15 🔍
SHA256 331876b4e1388a8d1f910c845f9cde275eff1ab8f5f6dba91a6d0c4969ad9367 🔍
SHA3 64e825afc6f1e45fbdec8973469a8c565eb55272bc7d360be806d16201338fc4 🔍
VirtualSize 0xf78
VirtualAddress 0x1b000
SizeOfRawData 0xa00
PointerToRawData 0xd400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.13965

(#5)

MD5 7a58537fa9e194267e6c3959abaa0542 🔍
SHA1 aea7747c5771780cb0d2eeef4b1a36a995e488e7 🔍
SHA256 a8d6ea76300eb950bce188a29cad9876ee3d1e8b493c76ffaed3bbcd4b379161 🔍
SHA3 c7231615002dab27770ac52482b73bd1f3744c42c6ee3cf83d08e0385561fee6 🔍
VirtualSize 0x100
VirtualAddress 0x1c000
SizeOfRawData 0x200
PointerToRawData 0xde00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.10191

(#6)

MD5 aed4219956740ad952e986cf00522cd9 🔍
SHA1 fe48a57b98305cdd7b17ec7ddde080cda70460ed 🔍
SHA256 7196d32b0634408307077b8267b519deb13e52c7efd15095df1f846be5996f8a 🔍
SHA3 a881cd63c388037dd467d82a54ac55b5bd23833a3b7150f3ec5b4af0c01f6cd5 🔍
VirtualSize 0x258e8
VirtualAddress 0x1d000
SizeOfRawData 0x5c00
PointerToRawData 0xe000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.93792

(#7)

MD5 fe71b93f293b77c759d6dd6ed78981be 🔍
SHA1 3039e877a333e7bafa56148ac77f93cb26d80fc9 🔍
SHA256 d568c4578bbdb4aa6dad51fe1f509ca3d4a45cfa8a3316c2228efe9dcf061993 🔍
SHA3 ae44d3423f8714751f01091d7c8d352615ffd653c67c8b41e3f9465d2c1a7de4 🔍
VirtualSize 0x678
VirtualAddress 0x43000
SizeOfRawData 0x600
PointerToRawData 0x13c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.89032

.idata

MD5 b8b681a99e562e93d54c6c25cd69e1da 🔍
SHA1 5c87913dd38e681c62c189f1b1a5d04913c8a289 🔍
SHA256 859f869be5c8bc5fe379c35b3a96d4b6df54b1be8d0d54fbf30d4e2acf9426c3 🔍
SHA3 e06b3e79b8bbda72d53261be64f3e1ca78b902b4b51a5ff6385132c2886391fb 🔍
VirtualSize 0x1000
VirtualAddress 0x44000
SizeOfRawData 0x200
PointerToRawData 0x14200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.25763

.rsrc

MD5 3b5e19160ba26d84a24336aaa0a56921 🔍
SHA1 f73b2c11163606df3d2e7f8678f775b1bcd13d39 🔍
SHA256 0b3cc0dc95710e261b6aa61b67369d72c3370456620e89ae7fdd79a3be584c30 🔍
SHA3 c90da396b5249de2b243ade94ebafc97d00bf5518c279f5f072a923491be10f3 🔍
VirtualSize 0x25a00
VirtualAddress 0x45000
SizeOfRawData 0x25a00
PointerToRawData 0x14400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.85732

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x352000
VirtualAddress 0x6b000
SizeOfRawData 0
PointerToRawData 0x39e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 12f7f644b9e714525de959b29d988c24 🔍
SHA1 db50532fd099e8de4e6ec06be65c0c67999da9ad 🔍
SHA256 4e8a7d30252a0a06ae9d89c2615e69c15d75ba5d875c7b96f8c2d6739103904c 🔍
SHA3 753319e9286e88b90a6282104353b892aa23e9b6cad65b7e6b7442b262a43cc1 🔍
VirtualSize 0x229e00
VirtualAddress 0x3bd000
SizeOfRawData 0x229e00
PointerToRawData 0x39e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.95146

Imports

kernel32.dll GetModuleHandleA
USER32.dll MessageBoxW
ole32.dll CoInitialize
imagehlp.dll ImageEnumerateCertificates
CRYPT32.dll CryptVerifyMessageSignature
WINTRUST.dll WinVerifyTrust

Delayed Imports

1

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01105
MD5 63f388c74330039d8dd56ebe61f0bca2 🔍
SHA1 a18725fcfdda0e9e919976f434d2ca1c26c03557 🔍
SHA256 e2a972f525bed1871b52d84beaa3b0e6b96f2c72131be0c1709d864f6dc59727 🔍
SHA3 164d9b654d0749ff946fec9f482cc48ebf3eab039d6fb0982dc47548066bf4d5 🔍

2

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.25256
MD5 294fd8941db36386cca2aec931b08f04 🔍
SHA1 034e8b0aef26a40ed019631e3bbadbe1377d1e82 🔍
SHA256 df9ff6394d7cd2edf96554349b3ec4a47ca5f1e2ce34648be15c173b2d205f0d 🔍
SHA3 bbbfcda0bdf1b714daae7f1bd512245d8fe2d2e86d05e91cd8f947858915bdc8 🔍

3

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.8792
MD5 752fdc45dae63d985275be9dd480bd09 🔍
SHA1 817f649fffd4fe3fbaee5aff183a204c8cdd5e46 🔍
SHA256 e84796aebba61bea54fae08c05ac8a9a1b8915f2c90429a47b534fed483d8f6a 🔍
SHA3 8b2cc4c052a793307e60377c40120cb14fb964e634bc9fed76e3e1d0d9e8bdd9 🔍

4

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x248f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.89526
Detected Filetype PNG graphic file
MD5 f031444c5a8eb02efd67036abc391004 🔍
SHA1 d32379b6e5728110a3161b05e23972e468202d71 🔍
SHA256 a8894c2f80e13a9b120ed4de53fdedca29c1976f125dd3d74abe13cf3f636ba1 🔍
SHA3 05c75ef8e559b204c87e52e1e9e9288bbb0f95a1234541ae8bf61737763f37cb 🔍

5

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x1588
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.89388
MD5 b008f09e0d7b4646a96a5672400ebfcc 🔍
SHA1 3ffdec7503a007311ac01be88648637730b75c58 🔍
SHA256 dc09b70b205988dd49ff9a658ec548d1418706f20c81ffc8e34cfef66de53590 🔍
SHA3 a4c833ec067bebb997c1914a9f188bda37afc7b5dfa8e60f043eb812df0c9dec 🔍

6

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.53744
MD5 93b813171f86bbb5667ec29e1693dfea 🔍
SHA1 21389493ee2ed5a133b2620507a3ec4ed9bad934 🔍
SHA256 0d716f9e5d722d6bff9ab76301cbd1967d978b671092f40ca344abea263b43ca 🔍
SHA3 606dee1bfed3c00b13f11cee15623d1c190c88e5982a57993c202a605be5da63 🔍

7

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.46898
MD5 70b63130629072dbe143aea086770ec4 🔍
SHA1 9dad4b427c856c513f4e33b710e4f259bb5dd27a 🔍
SHA256 99c6c689f921a666f125a1fb9b3596122d35b81edc8070ec63e310f1c2db626c 🔍
SHA3 53f3160ce1651be61d215515dc061ced8a0cd7c85ec55d70c81c8510ec244351 🔍

8

Type RT_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16413
MD5 f79b8dfbc197eb1394004efc791bd73b 🔍
SHA1 0acd44fdf045eccf0bd69ef2eddabaf211d00b80 🔍
SHA256 d4170c42cb7671a876454cc640637a7328e0c6f43d2d2656bc5ed6fcf7add6d6 🔍
SHA3 2cb0cc5d9c6e4473a846f580439ea200ffe916c307f9d50903c55c51b732afb9 🔍

7 (#2)

Type RT_STRING
Language Korean - Korea
Codepage UNKNOWN
Size 0x32
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.34631
MD5 c127a636a4fd051c8cad728d9612a42a 🔍
SHA1 1c1fcfc0743aef3eda00ea5640a085583105f15c 🔍
SHA256 e9d2bfe3b9f89a63e4020f10a5e9efb755bb9b1f6be584d6dd173efb6dda31f3 🔍
SHA3 a35ac3de87621d8854665aa170e72496078694bbd081512c459899ce6b2df4d7 🔍

100

Type RT_GROUP_ICON
Language Korean - Korea
Codepage UNKNOWN
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04079
Detected Filetype Icon file
MD5 6a9dcc5bceadd3d9cecaaaa91ad4042e 🔍
SHA1 2f785a685a95841706312739335bb2fcfb3d2500 🔍
SHA256 50e588ab2c82d25b1d57e975dec0f67d2e4541bf0c49b34a854ab176ed7cd10f 🔍
SHA3 2b2992b5e1a090a9704783aafc76976e4bfce805284341172146a90faafe3785 🔍

1 (#2)

Type RT_VERSION
Language Korean - Korea
Codepage UNKNOWN
Size 0x324
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40428
MD5 80bd3b5aa3e73f461d1b32d753b14122 🔍
SHA1 cac78f526ec7bdec4c3b7db48b43237ca4d1c5d8 🔍
SHA256 713b545478654d3a43208573236a02ce35fd14ef1e9c6341cb54b31393713c61 🔍
SHA3 f7096f064215950e5718555c9aaea1c4199521a837f8f5045aea0fe7f12bb559 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x593
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31576
MD5 c7da43a89e0db198cfa1eab969d12156 🔍
SHA1 13b8dcbd8d00cc25418a6d6e636f9c1372028583 🔍
SHA256 5e6c5ef49afa1770e364496c4702da9f7da03fe8a4afe7acd9a28bd0627984b5 🔍
SHA3 4eab87d1aac0f62c5c3ec004f86b24f9a44659a2b9d0c2be593fe47074bc5543 🔍

String Table contents

PotPlayer

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags VS_FF_SPECIALBUILD
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language Korean - Korea
Comments PotPlayer
CompanyName Kakao
FileDescription PotPlayer
FileVersion (#2) 0, 0, 0, 0
InternalName Daum 팟플레이어
LegalCopyright ⓒ Kakao Corp. All rights reserved.
OriginalFilename PotPlayer
ProductName PotPlayer
ProductVersion (#2) 0, 0, 0, 0
SpecialBuild Kakao
Resource LangID Korean - Korea

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x6cfc2d12
Unmarked objects 0
C++ objects (33145) 142
C objects (33145) 12
ASM objects (33145) 8
Imports (33145) 13
Total imports 119
ASM objects (35207) 9
C objects (35207) 16
C++ objects (35207) 46
C++ objects (35222) 4
Resource objects (35222) 1
151 1
Linker (35222) 1

Errors

[*] Warning: Section .themida has a size of 0!
Leave a comment

No comments yet.