a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Jul-15 07:15:12
Debug artifacts D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
CompanyName RisxnInstaller
FileDescription RisxnInstaller
FileVersion 1.0.0.0
InternalName RisxnInstaller.dll
LegalCopyright
OriginalFilename RisxnInstaller.dll
ProductName RisxnInstaller
ProductVersion 1.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • go.microsoft.com
  • https://aka.ms
  • https://go.microsoft.com
  • https://go.microsoft.com/fwlink/?linkid
  • microsoft.com
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryA
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegOpenKeyExW
  • RegGetValueW
  • RegCloseKey
 Possibly launches other programs:
  • ShellExecuteW
Safe VirusTotal score: 0/71 (Scanned on 2026-08-13 00:16:55) All the AVs think this file is safe.

Hashes

MD5 352756af8e69b5233c8b8a1148030748 🔍
SHA1 3f5b1078f01672e93b910061d0c6b06d250e86b4 🔍
SHA256 a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272 🔍
SHA3 349902ff947a88f99ea5f7e80d40601676516c7892b2597d119d3dbe25f6128b 🔍
SSDeep 3072:L4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZU10qY:Llm4sqMaFFBniJfBaWKq 🔍
Imports Hash 6a91eb82bfd19d2706c7d43c46f7064e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Jul-15 07:15:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x16000
SizeOfInitializedData 0x10200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000011810 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x180000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 49e9f5633a6244b24bd3b46caf9d2fdb 🔍
SHA1 dfe88140deee1182d66070776139193653246403 🔍
SHA256 e76ce991f13c7c7e7ca375811d73d9cb201b26e4a60b13afe5ae823a2833ada1 🔍
SHA3 6d432acbb432dc4a4f34697e6698ea44871d35ae44ef9939c9063a0bfed756d6 🔍
VirtualSize 0x15efc
VirtualAddress 0x1000
SizeOfRawData 0x16000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.33023

.rdata

MD5 52f7e56450fef6f443d67bed7efbbec1 🔍
SHA1 3e00b8b707d02d3c9e99a051048a4f807f1713cd 🔍
SHA256 4ec34a9d916b85661d3b49efb521127c9a7baf3e6f07f12a074abf095b8aa7ba 🔍
SHA3 4d06368dc88169f11f80ae8142cf3ec00f31b9798acc923ffa3d9d56acca58ad 🔍
VirtualSize 0xbcb6
VirtualAddress 0x17000
SizeOfRawData 0xbe00
PointerToRawData 0x16400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.82801

.data

MD5 240d8ae6c7b5ac2b54e55804112903b6 🔍
SHA1 cc404933ba120dffab19e2d47ccde27e4ce9327b 🔍
SHA256 e9a368d93b67a172fc91be1d49395ffc9460ff9c5c3fbe194a50d254094aa8a1 🔍
SHA3 5a4f07b3804bff8628036a1869b38237d514b1b016c4324cc8a9bb303809ba14 🔍
VirtualSize 0x18a0
VirtualAddress 0x23000
SizeOfRawData 0xa00
PointerToRawData 0x22200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.39102

.pdata

MD5 0b8f489dcd91a9f252bf6af0c48beb36 🔍
SHA1 f14c849067791617039a99e3628b196c9d5ab4ef 🔍
SHA256 05c0dd6e449b523df8ab71069d67140ec6efce4cd51883c620714373e8cdbe4c 🔍
SHA3 ae3fed4d90d9a4a8450dca00f7b17c0ddf1d9866023dbe4a2fd66c18a1e23b50 🔍
VirtualSize 0x13ec
VirtualAddress 0x25000
SizeOfRawData 0x1400
PointerToRawData 0x22c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.09909

.reloc

MD5 50228d4425809e80768545aabad4e58e 🔍
SHA1 96dfd6030e2fc675708d71d4ab7504a08edd063a 🔍
SHA256 d73a2403bcb293c903df806cdd12f01a23c94cb520aad323cbac1618ed031afb 🔍
SHA3 3303d20668de9e988a8def62c403493617aea42d7f1f8e49b9d40d2b0e74b868 🔍
VirtualSize 0x330
VirtualAddress 0x27000
SizeOfRawData 0x400
PointerToRawData 0x24000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.78417

.rsrc

MD5 e7c5bd3953f81f28bf597e7d2f2fa6d8 🔍
SHA1 c585ddece2f8b3e1c199825867c510304caa6734 🔍
SHA256 9ef66f3a66cfc782d3fa401045068168dc1043f9d10e9543a1291f7fbed09d7f 🔍
SHA3 19e70f79ed2984249db2a0080c459384b245b0d8075d307e892fbc3855ec8fa5 🔍
VirtualSize 0x10f0
VirtualAddress 0x28000
SizeOfRawData 0x1200
PointerToRawData 0x24400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.94132

Imports

KERNEL32.dll FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
USER32.dll MessageBoxW
SHELL32.dll ShellExecuteW
ADVAPI32.dll RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0.dll _invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0.dll calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0.dll toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0.dll wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0.dll _gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0.dll setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0.dll __setusermatherr

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19144
MD5 f15f7f3dc8b5b04562df945c1a116906 🔍
SHA1 e9f253bc73335b700b41289f24e74310d27a906d 🔍
SHA256 3e18dccd0245260efdb0924987e8d7e624525c479ce69e7d3bd33d74ecf4b974 🔍
SHA3 3a07a3bf7b29e7829fc4487754c2d005e74520b4740462fb7b19dd8b90086167 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xd53
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.01752
MD5 a99c09dbd4a65da324e2d732f5351786 🔍
SHA1 164d3ec47c9487bd42d9ec580fb730a61dc156d7 🔍
SHA256 59c778ad5af1032a264960d8cf35e7b4226e9ab5d1d9cbe91d4f93b347768b88 🔍
SHA3 5e12a029662dd5cc2e838e5e40d2e0715685e718c429233ccb2e35881abdd4e6 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName RisxnInstaller
FileDescription RisxnInstaller
FileVersion (#2) 1.0.0.0
InternalName RisxnInstaller.dll
LegalCopyright
OriginalFilename RisxnInstaller.dll
ProductName RisxnInstaller
ProductVersion (#2) 1.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Jul-15 17:56:48
Version 0.0
SizeofData 109
AddressOfRawData 0x1f79c
PointerToRawData 0x1eb9c
Referenced File D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2025-Jul-15 17:56:48
Version 0.0
SizeofData 20
AddressOfRawData 0x1f80c
PointerToRawData 0x1ec0c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Jul-15 17:56:48
Version 0.0
SizeofData 988
AddressOfRawData 0x1f820
PointerToRawData 0x1ec20

TLS Callbacks

StartAddressOfRawData 0x14001fc48
EndAddressOfRawData 0x14001fc58
AddressOfIndex 0x140024888
AddressOfCallbacks 0x1400174e0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140023080
GuardCFCheckFunctionPointer 5368804368
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x8c79eb85
Unmarked objects 0
ASM objects (34321) 10
C objects (34321) 12
C++ objects (34321) 87
Imports (VS2008 SP1 build 30729) 16
Imports (33140) 9
Total imports 201
C++ objects (LTCG) (34810) 10
Linker (34810) 1

Errors

Leave a comment

No comments yet.