98559c6c4d02cdc484af34397aad14e4c1decf6c2c8ea97380235649d3fbe0db

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2020-May-15 00:14:28
Detected languages English - United States
Debug artifacts C:\buildslave\unity\build\build\WindowsStandaloneSupport\Variations\win64_nondevelopment_mono\WindowsPlayer_x64_Master.pdb
FileVersion 2017.4.40.7214086
ProductVersion 2017.4.40.7214086
Unity Version 2017.4.40f1_6e14067f8a9a

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 86.7871% of the executable.
Safe VirusTotal score: 0/70 (Scanned on 2025-11-23 20:03:03) All the AVs think this file is safe.

Hashes

MD5 d6c30a316d496b90af3f7042739796b4 🔍
SHA1 becb8e8e148ff146670c151af8a9567b9baa2549 🔍
SHA256 98559c6c4d02cdc484af34397aad14e4c1decf6c2c8ea97380235649d3fbe0db 🔍
SHA3 88f2d3154fd0a8a8747c8f69567ba20bdecb2a76f1c45db0ec0d9fdbec5d8c30 🔍
SSDeep 6144:f9fYunoPZF8nIFJEL9A2YrVUpRQFwV4fftS4ZH3JIbky1rfni3:W+oj8IcJA9rVESGSfY4Z5i7i3 🔍
Imports Hash 30fc819c693eeaf8941de56adbfe3dab 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2020-May-15 00:14:28
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x9e00
SizeOfInitializedData 0x96000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000144C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0xa4000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e42ea766c72e9814cb1b476355a674bb 🔍
SHA1 f210db0de53eee47aa22923d64ad653032603e92 🔍
SHA256 ed1cca393ae79cc96111b64dae00c9e1d04c8726841444b2d63385092d280fa6 🔍
SHA3 8c09727dcb6294d4e2224bbb734eeac0867fc87cee90c32ab307b08fed86123a 🔍
VirtualSize 0x9d10
VirtualAddress 0x1000
SizeOfRawData 0x9e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.36624

.rdata

MD5 c39994b8cdae57045f370e7aeee8e792 🔍
SHA1 680ea5891f66bdbb6156561b630d120793314018 🔍
SHA256 951f6382c8726dbb1568f09d8d65c5568711ed7a216cae9561bf2d9d39e39f6f 🔍
SHA3 c9098b50e05a9258e2461d3e1e4f9b3a7e79dae0a3a67d8dc4134a06e5630bdb 🔍
VirtualSize 0x8950
VirtualAddress 0xb000
SizeOfRawData 0x8a00
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.77141

.data

MD5 7d07ed58830102f49c5c8e0f9244b566 🔍
SHA1 0c250f5de8473608ed8da77ed5fd238d47d71092 🔍
SHA256 8533712ce82c3107e4f6f7e61d75b2ea3872f4e0d44d0a2e1752b023a4ab6894 🔍
SHA3 64840d1c7ad601f7bf22eddb147aefff61e344f31127820a88e3444b314be044 🔍
VirtualSize 0x1c10
VirtualAddress 0x14000
SizeOfRawData 0xa00
PointerToRawData 0x12c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.90695

.pdata

MD5 44721c87bf41ec6b3917aff40d9c9048 🔍
SHA1 478e5234b3a21352924df19347dfda2e7550e828 🔍
SHA256 b4e2ea656e9ce58daaef6c02cde34546e413185fa85f884bb8080a2834e86eea 🔍
SHA3 4d21d03b3d6ad75858074598251fb94a21b6361d34eac6c38688f53d4ef5e727 🔍
VirtualSize 0xbe8
VirtualAddress 0x16000
SizeOfRawData 0xc00
PointerToRawData 0x13600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.77915

.gfids

MD5 f9e7e2abcde3ce74bfa109852579dd97 🔍
SHA1 81aea4a3b26693662a4cd75537e63f660ec7b245 🔍
SHA256 922d5df582d31ad29dab3b35fa30615ba23e9c0eab091fe11b7cf858b3002658 🔍
SHA3 b4d34fc5919de51b2dba584d4c9be9462637348f95b841a51fd31483b56f12db 🔍
VirtualSize 0xa8
VirtualAddress 0x17000
SizeOfRawData 0x200
PointerToRawData 0x14200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.34741

.rsrc

MD5 1b72caed4f4b7efa23905865f885f2e9 🔍
SHA1 d72ab424462ad6beb2481dd4a440148193cf472a 🔍
SHA256 4c18c6ee249796c8347f8f2ebded9407986fa501c64d658c5f894400093a80c1 🔍
SHA3 11a0a73cb13aea8c74a4b48bb8d0ead6db99ff2fb955d5a841fc7068be2da554 🔍
VirtualSize 0x8a0d8
VirtualAddress 0x18000
SizeOfRawData 0x8a200
PointerToRawData 0x14400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.71159

.reloc

MD5 7bf8c761218fc347c43683f8f57b6ad2 🔍
SHA1 ec1c03f562f6ae173770d3194fd934c08dfb8386 🔍
SHA256 6a078833feb268f4bc79651d5c5e517d0c886dc9f595acd945986aab6b1dd26f 🔍
SHA3 87fad22ecfa30cc64642510bf41ec85ae0f1f95552263c6135fc36cbaa794f28 🔍
VirtualSize 0x614
VirtualAddress 0xa3000
SizeOfRawData 0x800
PointerToRawData 0x9e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.71974

Imports

UnityPlayer.dll UnityMain
KERNEL32.dll QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetLastError
GetModuleFileNameW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
CloseHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
RaiseException
ADVAPI32.dll SystemFunction036

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x14940

NvOptimusEnablement

Ordinal 2
Address 0x14944

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.80108
MD5 603ae1144ff0dd0a58e1eb69e26684b6 🔍
SHA1 297bdbf93d9d42f2fe78d6816e8128a2dc9c963a 🔍
SHA256 1a659b52c33af65f29581697b25da031c601f17a0ce6e4f871662a9f71f0375d 🔍
SHA3 664ca1ebf6defd115dcb3d1c57c067c5678b82916eb9c571e734c95a40db3f01 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.18744
MD5 5db3d362c6b7a87ad2bdd366039cfe94 🔍
SHA1 60d726acb7d0d8b5ac2f8f234212d80b4d779788 🔍
SHA256 8881d25bc86aa5181985282c49dd4c381f9835ac9188734301f2b53758a663bd 🔍
SHA3 a456917a4abcc8c01e3cc958ee169a28b929a513952e02b774c1f23c6facfe4e 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.13967
MD5 d82a9a0f026061f51a4380ea7097dcd9 🔍
SHA1 33073eac7b86aadfa0d1bf1aca58082a7976f74d 🔍
SHA256 02b4ac8364c8f5a74caee61da93ebf6d907cac07f9ad52a2aa84741a5bf54259 🔍
SHA3 e1f474ee278bf4560bdd4f70fff6f5c5fc7e4029693da0f076f164fc18974b1c 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.08199
MD5 e0f0575db77c75204d92c91bc36329db 🔍
SHA1 f59689bf35b6f5c20616251801c01931b761a432 🔍
SHA256 e492c571a8edd8f0ed5cce39c8bbd263f3f405be06de8268d8354ef207756060 🔍
SHA3 1a460ba62d030090e4d08a88c4e7cec3dd592d50645f245d6dcdc5b46fab451e 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.00685
MD5 9d4f473cc2f17c0fe4aafb87356a4abd 🔍
SHA1 91c586ac09e6d18a57cebeb98cf39fb13172042c 🔍
SHA256 e576bd3e5aab0fd06647cd7d8555834be64d521d0479d606a840fd433a3f3c18 🔍
SHA3 aa1c33685448aa7b651f7a8b3690d6a5c6d083a3bf6207e6a084af226123eef0 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.89543
MD5 63c08f78c095271282031b10626c234e 🔍
SHA1 c9bf7ec0d810f8fd0e0ae01ba88793373883ebe3 🔍
SHA256 6deb2df04afcb7b117ba35cef0ccbfb9db0e0a97fe0af87f0d1184e467d1dd8e 🔍
SHA3 93353bea1bfee3db23a867d047d906061de1b9aa8f1007b219bab069e4cda943 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.779
MD5 7d0b5b6a91dd8b2f5226cf135074a7bf 🔍
SHA1 9f5dab161eece59eb208a0f5459a5baec2da9f21 🔍
SHA256 dce120809a8e5480f75dc68cf9b1f99cb6221ba7dfbb913aa5f429d4b043682a 🔍
SHA3 ef0e7fd5abc49fc85041f8abc069c57980d8f7ff77f4622a38f6a400eb307fcb 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.67264
MD5 89a4d97d813f909a7ccc594985c59bab 🔍
SHA1 0b3ad608709217182500ff3a2d6cf4a5b477e6d6 🔍
SHA256 e07732a7eb5125a6dcc6931ae091863ae273efe5b95085f0d1f7ed8e9cdb74a4 🔍
SHA3 61b766644d250f51a55cd9ac4761130f5092cf4d694f730053c3b0885a41918b 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.54725
MD5 ed3e42c6fee43d5b555f25256fca747c 🔍
SHA1 e24d68dd60c1411f2ee9509467e5bfb26f5eacf5 🔍
SHA256 a9f2c5133dbbfd98052c555447ad93580e6f3c71abd13878d3574e1903e61763 🔍
SHA3 d13db6d4ab64b9faa5f950a26751b98bf8266b31439dbd25605ca595f6946f8d 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 3bf2dac037ce87794e66ff7f054e913f 🔍
SHA1 52ca961fd37ad960905a681d1db5157508ef1602 🔍
SHA256 2a87b1f32c5d0435090c72c392b75394f706e5750eff64fd85d25e1c622ee581 🔍
SHA3 8454d3273522657b5926068082b2cb88f6dbf352e7e9568008c0e33c792f349b 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1c0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.38401
MD5 6b7a4f45e7970eb5bda964d515bc26fe 🔍
SHA1 b2d5271c2cab8476f10ff1d6a3c883c31567c7d3 🔍
SHA256 153d529ebcc60b0908e1de9252ca379b2a06ed7cd561a8611092715a0efff631 🔍
SHA3 b3dffe9edecfc432b55533e4c34b6e7b748a117747a086a8f5b7bb05ce3029cf 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x655
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37545
MD5 e64f0e3051453730fcd59e3487fff82c 🔍
SHA1 881f9506d98c7244ee2e6cc48de59fb5fe9394a0 🔍
SHA256 cc5206d924557aebbb34ea990bff63d51f03f95c9618f11ba16f5bd0d969f3b2 🔍
SHA3 e68e9754b0692216d6b7991ec0b28f737203d4f0979404b4bfd5728ed3214e3d 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2017.4.40.5126
ProductVersion 2017.4.40.5126
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 2017.4.40.7214086
ProductVersion (#2) 2017.4.40.7214086
Unity Version 2017.4.40f1_6e14067f8a9a
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2020-May-15 00:14:28
Version 0.0
SizeofData 147
AddressOfRawData 0x1238c
PointerToRawData 0x1158c
Referenced File C:\buildslave\unity\build\build\WindowsStandaloneSupport\Variations\win64_nondevelopment_mono\WindowsPlayer_x64_Master.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2020-May-15 00:14:28
Version 0.0
SizeofData 20
AddressOfRawData 0x12420
PointerToRawData 0x11620

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2020-May-15 00:14:28
Version 0.0
SizeofData 848
AddressOfRawData 0x12434
PointerToRawData 0x11634

TLS Callbacks

Load Configuration

Size 0x94
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140014018

RICH Header

XOR Key 0x11c7e724
Unmarked objects 0
241 (40116) 4
243 (40116) 120
242 (40116) 13
ASM objects (23907) 7
C++ objects (23907) 29
C objects (23907) 18
Imports (VS2015 UPD2 build 23918) 3
Imports (VS2008 SP1 build 30729) 4
Total imports 87
C++ objects (LTCG) (VS2015 UPD2 build 23918) 2
Exports (VS2015 UPD2 build 23918) 1
Resource objects (VS2015 UPD2 build 23918) 1
Linker (VS2015 UPD2 build 23918) 1

Errors

Leave a comment

No comments yet.