| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jul-28 07:43:45 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\Users\cathy\Documents\imgui\New folder\1h32pzt\x64\Release\PopstarRoblox.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Jul-28 07:43:45 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xb0c00 |
| SizeOfInitializedData | 0x131400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000AE5A4 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1e6000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetTickCount
SetUnhandledExceptionFilter CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle Module32FirstW Module32NextW OpenProcess WaitForSingleObject CreateThread GetTickCount64 GetModuleHandleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SwitchToThread GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency SetConsoleTitleA FreeLibrary QueryPerformanceCounter AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetProcessDEPPolicy GetCurrentThread Sleep SetThreadPriority TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetPriorityClass VirtualAllocEx ReleaseSRWLockExclusive GetCurrentProcess ReadProcessMemory GetProcAddress WriteProcessMemory |
|---|---|
| USER32.dll |
GetWindowThreadProcessId
GetWindowLongW SetClipboardData GetClipboardData CloseClipboard GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard DefWindowProcW GetWindowRect DestroyWindow GetAsyncKeyState TranslateMessage PeekMessageW DispatchMessageW mouse_event SendInput GetCursorPos ReleaseDC GetDC GetWindowTextW PostQuitMessage GetClientRect IsWindowVisible SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow IsWindow EnumWindows SetLayeredWindowAttributes FindWindowW SetWindowLongW EmptyClipboard |
| GDI32.dll |
GetDeviceCaps
|
| SHELL32.dll |
ShellExecuteA
|
| MSVCP140.dll |
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_function_call@std@@YAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??Bios_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock _Cnd_signal _Cnd_broadcast ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ |
| D3DCOMPILER_47.dll |
D3DCompile
|
| WINHTTP.dll |
WinHttpAddRequestHeaders
WinHttpQueryHeaders WinHttpReadData WinHttpOpen WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpenRequest |
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
| dwmapi.dll |
DwmExtendFrameIntoClientArea
|
| IMM32.dll |
ImmSetCompositionWindow
ImmReleaseContext ImmGetContext ImmSetCandidateWindow |
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
__std_exception_destroy
__std_exception_copy __std_terminate __C_specific_handler wcsstr strstr memchr memcmp memcpy memset __current_exception __current_exception_context _CxxThrowException memmove |
| api-ms-win-crt-runtime-l1-1-0.dll |
_cexit
terminate _seh_filter_exe _set_app_type _crt_atexit _get_initial_narrow_environment _initterm _initterm_e exit _exit _errno __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _configure_narrow_argv _invoke_watson _initialize_narrow_environment |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
_callnewh free malloc |
| api-ms-win-crt-stdio-l1-1-0.dll |
fread
fseek _wfopen __stdio_common_vfprintf fclose __p__commode _set_fmode fflush __stdio_common_vsprintf __stdio_common_vsprintf_s ftell __stdio_common_vsscanf setvbuf fwrite __acrt_iob_func |
| api-ms-win-crt-string-l1-1-0.dll |
_wcsicmp
isdigit strncmp tolower isspace _stricmp strncpy strncpy_s strcmp |
| api-ms-win-crt-convert-l1-1-0.dll |
strtoul
strtol strtoull atof strtof |
| api-ms-win-crt-math-l1-1-0.dll |
atan2f
acosf _fdclass cosf expf floorf fmodf powf nearbyint ceilf sqrtf sinf logf round __setusermatherr |
| api-ms-win-crt-time-l1-1-0.dll |
_localtime64_s
strftime _time64 |
| api-ms-win-crt-utility-l1-1-0.dll |
qsort
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-28 07:43:45 |
| Version | 0.0 |
| SizeofData | 104 |
| AddressOfRawData | 0x1c5220 |
| PointerToRawData | 0x1c4220 |
| Referenced File | C:\Users\cathy\Documents\imgui\New folder\1h32pzt\x64\Release\PopstarRoblox.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-28 07:43:45 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x1c5288 |
| PointerToRawData | 0x1c4288 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-28 07:43:45 |
| Version | 0.0 |
| SizeofData | 892 |
| AddressOfRawData | 0x1c529c |
| PointerToRawData | 0x1c429c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-28 07:43:45 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x1401c5638 |
|---|---|
| EndAddressOfRawData | 0x1401c5640 |
| AddressOfIndex | 0x1401d6f1c |
| AddressOfCallbacks | 0x1400b29d0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1401d6040 |
| XOR Key | 0x8ef8bedf |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 18 |
| ASM objects (35207) | 4 |
| C objects (35207) | 10 |
| C++ objects (35207) | 39 |
| Imports (35207) | 6 |
| Imports (33145) | 19 |
| Total imports | 277 |
| C++ objects (LTCG) (35228) | 45 |
| Resource objects (35228) | 1 |
| Linker (35228) | 1 |
No comments yet.