979e784b287e8db65eadced7d7e6b209ef1ceb7eb45aa329409c3101dfdd9915

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2023-Aug-29 10:58:26
Detected languages English - United States
Debug artifacts C:\jenkins\sharedspace\ra_2022.3\artifacts\WindowsPlayer\Win64_VS2019_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb
FileVersion 2022.3.7.299957
LegalCopyright (c) 2005-2023 Unity Technologies. All rights reserved.
ProductVersion 2022.3.7f1c1 (0493b5551c5b)

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 84.7421% of the executable.
Suspicious VirusTotal score: 1/71 (Scanned on 2026-09-27 12:42:59) Trapmine: suspicious.low.ml.score

Hashes

MD5 6fd35ec86f7c34efecb863069865dbc4 🔍
SHA1 0e1f37decd2660174ea7e130febd0de99b38230b 🔍
SHA256 979e784b287e8db65eadced7d7e6b209ef1ceb7eb45aa329409c3101dfdd9915 🔍
SHA3 7d7dd3e0b1a9d0e9e644e33a55bb2ff1f0d3b961ce65fe2370fd96a56e6e5262 🔍
SSDeep 12288:/H744aOD8alj6O504ezdftX0AQxDHMQ7iDma9FQIC:z9aOZjP04eBtX4FHZ7a9FQIC 🔍
Imports Hash ce1183cc150987a99aef5749f22af81e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2023-Aug-29 10:58:26
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xca00
SizeOfInitializedData 0x97000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001260 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa8000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 374c3a48e1ae8f15369f1244917929c1 🔍
SHA1 64222bd41ca93519bdb6947064b537707b4da726 🔍
SHA256 e630b3f13021d479bd26275f75f383f7dfbb0e896241643b4cbbe1525e849584 🔍
SHA3 926e1c9ca9d9e4dbee7e25d591d5d57dd014def07346ce0169f81e20e28e8115 🔍
VirtualSize 0xc8b0
VirtualAddress 0x1000
SizeOfRawData 0xca00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.41073

.rdata

MD5 bc7b3233c9c5a34057f51c6143a7788f 🔍
SHA1 0f3dcfa5b46f7231c3179a8d8d6a2165773e58f3 🔍
SHA256 7428e5b4490a8b8ec0c525493366f8721253d45368a7aa8f54883b0115023a66 🔍
SHA3 53ce9e3acdf5b7f9ae31b9bb17c6668e73284ad1aed3de17c9e003201619daf0 🔍
VirtualSize 0x948a
VirtualAddress 0xe000
SizeOfRawData 0x9600
PointerToRawData 0xce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.65424

.data

MD5 90815aa5dc65a7dd3f93bad1bd78a77e 🔍
SHA1 608f3e69047b216dda6b0df73c30912e2fef5544 🔍
SHA256 435cb9af1df25f501f68a9700182c4d25de99c3f8e8c1ba6b16c0ca98911ff87 🔍
SHA3 e5ea90d4dd767bfa3d88e3fa2e107c2e40cac10f43498d5abd74f15888477d18 🔍
VirtualSize 0x1d38
VirtualAddress 0x18000
SizeOfRawData 0xc00
PointerToRawData 0x16400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.87032

.pdata

MD5 bc823d468c5508124d16ca78bb1846cf 🔍
SHA1 74b6f26ebb0fc49fe065255b8f23a6976ba287a5 🔍
SHA256 dd7e9990aef7c23375f6609f4643c1198a824b8fd799ccf9880064178c9323a0 🔍
SHA3 58eb60147995950c95dd59a68ea6725a5c1f148eaf886f99e76c5fc1da1fd8f3 🔍
VirtualSize 0xef4
VirtualAddress 0x1a000
SizeOfRawData 0x1000
PointerToRawData 0x17000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.6293

_RDATA

MD5 f87f407c2a1cab208757ad1d23a2de6f 🔍
SHA1 cd739c36958f9ba7505883ae868f1a6ca71e880f 🔍
SHA256 6e4ba525d12ef66132e0738191d3a928ba74c0091a6f82bc48f892a41e2fc242 🔍
SHA3 0611ad194d9c623281cb358dbc2f2d28bb01b6eab682677ec8d16136d74414ab 🔍
VirtualSize 0x94
VirtualAddress 0x1b000
SizeOfRawData 0x200
PointerToRawData 0x18000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.11888

.rsrc

MD5 7851549406438c9dab63572df987d37e 🔍
SHA1 7d696a4912776129aad535b74372af8e41cf1a04 🔍
SHA256 e7bd435569fdf85589cbb91aafa2d98216784ae74859dc10da1f1566062f823b 🔍
SHA3 d1247446d0a0909e077d386f2364b0a83673b8212b413d6f72ab1ddc1e658d5c 🔍
VirtualSize 0x8a168
VirtualAddress 0x1c000
SizeOfRawData 0x8a200
PointerToRawData 0x18200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.48374

.reloc

MD5 ef1e558d46106d87320dd822be1ddc48 🔍
SHA1 10f7b05d107451bd01cf446da512c619fc35bf50 🔍
SHA256 34d7b771018e478ba05cd24ec377fd34919d65ec63c43f49e1ab319785368929 🔍
SHA3 cc295f58e62efe5c59cad1febf1ce620404450135f442c20ba55235b492ddac9 🔍
VirtualSize 0x654
VirtualAddress 0xa7000
SizeOfRawData 0x800
PointerToRawData 0xa2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.84209

Imports

UnityPlayer.dll UnityMain
KERNEL32.dll HeapAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x18004

NvOptimusEnablement

Ordinal 2
Address 0x18000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.48365
MD5 e736a260bd1b34d23be3037dde3fface 🔍
SHA1 1cf807f914f3d5083f8019cf19954fea23f6f0fe 🔍
SHA256 1ea8328f4d68fa3c1be0847ab0c936563749f30b8d7322262df61ebaf66e19ff 🔍
SHA3 a12ae83a8a074da5b9d9ce1216301ccd2b6773be97ac3f39acd1600d944712dc 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.47006
MD5 e025f1074435eda8725c65aeaea506b6 🔍
SHA1 5a3a4562708433919b620406a127aba54e84be7f 🔍
SHA256 246ae73e0e88606d202c745939371b10e81181be9fd312df8f869dbe1df396c7 🔍
SHA3 a7b02f327a466458ebfe6607253a543a056759cd96cc4cde83da0fc49d124623 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.45003
MD5 7fe38ca6a2666862e69924fcae51c954 🔍
SHA1 9a8d33af4458df4eef9535424944d31b305c592c 🔍
SHA256 2ae38c8e9b7344af334ca1b81c28a86e5e77332631edb6f2f5841b3d098edf30 🔍
SHA3 afc9ce49c0cd3f917ea6d3ddf26418af679bb1dcfe8709264f61287d2822d4a7 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.43343
MD5 b8ded36906a282b6c86ccb2ccc10260b 🔍
SHA1 d9077e61a2e00eb103cd4602e4aa0efeea1f274d 🔍
SHA256 6a2fc0cd635f4a6e23068011f0ecec61af676cc8260e4e285ae69d07eae56cf0 🔍
SHA3 e69660cc16f1d1c150ba45cb1917f7a1be075072fc42995683294fec6f89add3 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.41693
MD5 752931b55ece88ae60d58f166adb8e37 🔍
SHA1 acb4a503e972c4d4905868738f82cafea90920ed 🔍
SHA256 d0620ecbed7b644fdc78ed1f5009cccd0f9dfabeabe3f6d2489cf30b7580a9d8 🔍
SHA3 2e9fca9c58cfb57be01406e4bf4b6d411341aaa5588237643d245c1afeaf48d0 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.35903
MD5 1738875c6fd2eebcfca8a9260f789135 🔍
SHA1 dc3a12f31cd4281acada881b2d36e0a119cef612 🔍
SHA256 1c26a9882cc19c2ff3cc3e150c6fbc7f56efa4b6a752d48be4aa936a47b285e3 🔍
SHA3 c9388dcdaf5c52ae92ba38a02ef173a802185b6ce0be440f0f2a17466cc6b7be 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.37092
MD5 4a550d5ca5d2c8c38980b04a3b2b3020 🔍
SHA1 c894be14d2163e7fdb3512290cc79c863ebb3d57 🔍
SHA256 f81958c3de9a59f742f8739c7639624bfef9664eb7417129ce04ddf02e98c80f 🔍
SHA3 79052fae4aa80200c5a6456261771b16b5e3b46dd3f6cf402e5c6002166e6667 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.27795
MD5 176b893c8a2f8bebe17b763fbd78d4b4 🔍
SHA1 b8f9c10a07da17cf90a544b1641225fd59324909 🔍
SHA256 435a4a56d6f35973de4c130e8ddab0125fde26b00ab2c797f7f01d7bd039a0c2 🔍
SHA3 f51d3be7c39090170751849c8752566ea14761e3df3c85633e8793c540503160 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.08202
MD5 1aad6d8d9095d95d4485c173380db139 🔍
SHA1 d3bae677fe7058ec203434512ee9164a503b0717 🔍
SHA256 b5bf71664250218ff5e81b15e5ada50c92705cfd0a50211ad196ee66874d345c 🔍
SHA3 735171bece5a3484ecfe9414e04e4461f15edad62083cd66782aea1654e3e094 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 f7731730720cfe035cf030b40d0e2eb6 🔍
SHA1 d046e23f2ee2b93ad96be8e1dc9120ecf3915091 🔍
SHA256 5c92a41adaf3265071482fd1a182ae8702c168636a7d9ff51798ee3a1dfc8500 🔍
SHA3 6f2d12e4c63c131a3f7f48293996e2be05da351536d013affe5d2265965ce657 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x20c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.57224
MD5 6c02d3936935b055dc179121f5cdd1b9 🔍
SHA1 42d05b8116cfc8b9c306571eed7d3d59cd3e0879 🔍
SHA256 b8bc244982e740d0482d5f1a6d33b27b157b6cf4bffab67534eadcb1bfb2ac6d 🔍
SHA3 b760f0c45e97abfaa7d1d047b0e67d78f5daf0dc8d29c9d5755bffb2c034c4a5 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x697
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.34195
MD5 99242718a43fede787d5eeeab0dc1f59 🔍
SHA1 e65bc416841f17167bbbaddd4025e3317e56974e 🔍
SHA256 1c718faa15956b412c0eaece21a1cc5aeae9fe1bf0ab07beb70268f582995113 🔍
SHA3 6211f117f7005dbb55bcd4398026b3212cb730374de7d52028b03b5a6668156b 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2022.3.7.37813
ProductVersion 2022.3.7.37813
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 2022.3.7.299957
LegalCopyright (c) 2005-2023 Unity Technologies. All rights reserved.
ProductVersion (#2) 2022.3.7f1c1 (0493b5551c5b)
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2023-Aug-29 10:58:26
Version 0.0
SizeofData 148
AddressOfRawData 0x15aec
PointerToRawData 0x148ec
Referenced File C:\jenkins\sharedspace\ra_2022.3\artifacts\WindowsPlayer\Win64_VS2019_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2023-Aug-29 10:58:26
Version 0.0
SizeofData 20
AddressOfRawData 0x15b80
PointerToRawData 0x14980

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2023-Aug-29 10:58:26
Version 0.0
SizeofData 768
AddressOfRawData 0x15b94
PointerToRawData 0x14994

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140018030

RICH Header

XOR Key 0xe5e06b0d
Unmarked objects 0
ASM objects (28900) 5
C++ objects (28900) 138
C objects (28900) 10
Imports (28900) 2
C++ objects (VS 2015/2017/2019 runtime 29118) 39
C objects (VS 2015/2017/2019 runtime 29118) 16
ASM objects (VS 2015/2017/2019 runtime 29118) 9
Imports (VS2019 Update 8 (16.8.0-1) compiler 29333) 3
Total imports 89
C++ objects (VS2019 Update 8 (16.8.0-1) compiler 29333) 3
Exports (VS2019 Update 8 (16.8.0-1) compiler 29333) 1
Resource objects (VS2019 Update 8 (16.8.0-1) compiler 29333) 1
Linker (VS2019 Update 8 (16.8.0-1) compiler 29333) 1

Errors

Leave a comment

No comments yet.