c59ca4b87dfeeed79e10e922a3d9cd20345a9f44700aa3984239982c72fcd76d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-01 02:32:39
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.
Debug artifacts CsCheatCheck.pdb
CompanyName CS Cheat Check
FileDescription CS Cheat Check Application
FileVersion 2.8.3.0
InternalName CsCheatCheck
LegalCopyright Copyright (C) 2024-2026 CS Cheat Check
OriginalFilename CsCheatCheck.exe
ProductName CS Cheat Check
ProductVersion 2.8.3.0

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • QemU
 May have dropper capabilities:
  • CurrentControlSet\Services
 Miscellaneous malware strings:
  • Backdoor
  • Exploit
  • Virus
 References the BITS service
Contains domain names:
  • microsoft.net
Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Uses known Mersenne Twister constants
Suspicious The PE is possibly packed. Unusual section name found: .SCY
Section .SCY is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • DbgPrint
  • DbgBreakPoint
  • NtQuerySystemInformation
  • NtQueryInformationProcess
 Uses Windows's Native API:
  • NtProtectVirtualMemory
  • NtWriteVirtualMemory
  • NtQueryObject
  • NtOpenProcessToken
  • NtFreeVirtualMemory
  • NtOpenThread
  • NtQuerySystemInformation
  • NtWriteFile
  • NtQueryInformationProcess
  • NtOpenProcess
  • NtAllocateVirtualMemory
  • NtReadVirtualMemory
  • NtClose
  • NtCreateDebugObject
  • NtPrivilegeCheck
  • NtSetInformationProcess
  • NtQueryInformationThread
  • NtCreateFile
  • NtTerminateProcess
 Manipulates other processes:
  • NtOpenProcess
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 cf0b7f5d62a8805a0f782ac0b37f0450 🔍
SHA1 6db3d9f45014ab2c0b3901e8715c8b0081811112 🔍
SHA256 c59ca4b87dfeeed79e10e922a3d9cd20345a9f44700aa3984239982c72fcd76d 🔍
SHA3 91b992f829ccb1938dcd346e850349dc7122d12c5adb4ec5025d42dd31e3bf84 🔍
SSDeep 49152:pSuofC3PBO1IbGwUPWw1owaSwuS8Zmx3A+pjE6Of2BYtGTfUPANk0id9Q+X1K+/:z68wdcOxTXyKyAxCvL30j4TQ1m 🔍
Imports Hash 67f0757254eaf5badb811bd16cd7b424 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Oct-01 02:32:39
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x8b2c00
SizeOfInitializedData 0x5dc800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000015AA1604 (Section: ?)
BaseOfCode 0x1000
ImageBase 0x7ff6b9650000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xe9b000
SizeOfHeaders 0x400
Checksum 0xe9c4ac
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6a79bfac2d365a9dc796fea289c83865 🔍
SHA1 a5aa25d976c8d4eb44e4b1855f4cc734267a513e 🔍
SHA256 1a066eed16eee9779206cb0aeef491956c61e031041ace32c77ce2fe72008347 🔍
SHA3 f453433b639643f88f4726c614022276c00e92402487c501cb0f6dbefddc056c 🔍
VirtualSize 0x8b3000
VirtualAddress 0x1000
SizeOfRawData 0x8b2c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.55681

.rdata

MD5 c46c5d09bc2871c5acc82e66e2c84a3f 🔍
SHA1 29a730e81102ed1aa692609577dcedaf683cc931 🔍
SHA256 f1cb494866e7b10e8be1966cc5f1928313aa35a4ac3ce4a82e8e789b67f9b47f 🔍
SHA3 51dd03982a93017f22942c655548f2edd80cad2639ad8ec937ad4712a01bb174 🔍
VirtualSize 0x597000
VirtualAddress 0x8b4000
SizeOfRawData 0x596400
PointerToRawData 0x8b3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.34147

.data

MD5 7e49febfddf69547907a9b9c4c017b05 🔍
SHA1 6957964b45b5e27759c93390b4b0d38c1ad9c6b3 🔍
SHA256 a12fcadfad4c345b0ae16d7be9f97ee362bc391db8066948937974fe5a6b0574 🔍
SHA3 7ccca6f8f9131d63aa28589d8f74dbc40a5ffc11823882b38b78d058374d0139 🔍
VirtualSize 0xe000
VirtualAddress 0xe4b000
SizeOfRawData 0x8000
PointerToRawData 0xe49400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.0807

.pdata

MD5 f868690bc84475bcc7619d8c69033824 🔍
SHA1 8935ec65f11497b1a76ae023504e6d4f44ec43f1 🔍
SHA256 a27de83702c96b45d6160d1acb2fe18313de6617db0772af1a5ebb9b3c3e5164 🔍
SHA3 f8751c509a42bcb8e956bdbacfe87a7afde24b59f5d6ebfd6decba3e47b42ca1 🔍
VirtualSize 0x3c000
VirtualAddress 0xe59000
SizeOfRawData 0x3b600
PointerToRawData 0xe51400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.08457

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1000
VirtualAddress 0xe95000
SizeOfRawData 0
PointerToRawData 0xe8ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 37da398c799fb306dac3915430c7f724 🔍
SHA1 8fbb33ed0b0cd4f4c5dd444e470dd89b149afb91 🔍
SHA256 2774df4dc4c74cc6ba1efee7f45dc0f13e1a519e74756addffd80c3a720f3f6f 🔍
SHA3 2ccdb7a4035b91690068a8418cb1b694565c35b41fd292457adf2b3c5e309dd0 🔍
VirtualSize 0x1000
VirtualAddress 0xe96000
SizeOfRawData 0xa00
PointerToRawData 0xe8ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.92152

.reloc

MD5 5fb59e98bfd3d82ed63453fe14d90aba 🔍
SHA1 62ad89f45bd51a156574d02d2a4942afa93350d5 🔍
SHA256 703342cfe1a6e21ca35cc25ab38daaf5338250aa4c691eb788bc93f01076f677 🔍
SHA3 f8b97218e06585dca37634815a9c199763fd07342d6cf66b7332f34713ea893a 🔍
VirtualSize 0x3000
VirtualAddress 0xe97000
SizeOfRawData 0x2200
PointerToRawData 0xe8d400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.41535

.SCY

MD5 a3ff1bc156ded6ad911de7dd6819e2b5 🔍
SHA1 770d7d0639e06087002b4a18442d08ce7c7c8ba0 🔍
SHA256 9687e3131ab1f661282498ecf50fcb78309d9b98a4d6dd4cc86ebd004df7d859 🔍
SHA3 63e72cdd848a4d94f565db7839f425811722058808f109a67397d0b7392230d0 🔍
VirtualSize 0x1000
VirtualAddress 0xe9a000
SizeOfRawData 0x600
PointerToRawData 0xe8f600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.18295

Imports

ntdll.dll LdrFindResource_U
NtProtectVirtualMemory
NtWriteVirtualMemory
DbgPrint
LdrAccessResource
LdrGetProcedureAddress
RtlEqualUnicodeString
LdrGetDllHandle
RtlInitUnicodeString
DbgBreakPoint
RtlImageNtHeader
RtlInitAnsiString
NtQueryObject
NtOpenProcessToken
NtFreeVirtualMemory
NtOpenThread
kernel32.dll HeapAlloc
ntdll.dll (#2) LdrFindResource_U
NtProtectVirtualMemory
NtWriteVirtualMemory
DbgPrint
LdrAccessResource
LdrGetProcedureAddress
RtlEqualUnicodeString
LdrGetDllHandle
RtlInitUnicodeString
DbgBreakPoint
RtlImageNtHeader
RtlInitAnsiString
NtQueryObject
NtOpenProcessToken
NtFreeVirtualMemory
NtOpenThread

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x31c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.39736
MD5 70a5065b5dfeee3bcb30b73e93b80a2e 🔍
SHA1 4b719c8dcd87433e635d5d9e7711430de52f6e20 🔍
SHA256 62163e33081f5f201696d947eb22e9610dfd64b71abe6b2412386fc35b05c706 🔍
SHA3 fd9d28b3d58eafb6a2f63954b044215db784b3d1ff674f15c969a111babed91a 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x5f3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.15876
MD5 d156619f56c9bd6ef772fa4f23341379 🔍
SHA1 b06865d9d3d0a12ce29d8041c46c1f8b906a61fa 🔍
SHA256 1b4e267c86c0ae47025906188241b43401634e0a15bba5a7d5c17e8aa6fc7fce 🔍
SHA3 9f4d9494c4cdd685e9f6f188ee70f78f18df5c5f408358226121fc208b449d64 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.8.3.0
ProductVersion 2.8.3.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName CS Cheat Check
FileDescription CS Cheat Check Application
FileVersion (#2) 2.8.3.0
InternalName CsCheatCheck
LegalCopyright Copyright (C) 2024-2026 CS Cheat Check
OriginalFilename CsCheatCheck.exe
ProductName CS Cheat Check
ProductVersion (#2) 2.8.3.0
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Oct-01 02:32:39
Version 0.0
SizeofData 41
AddressOfRawData 0xdd0074
PointerToRawData 0xdcf074
Referenced File CsCheatCheck.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Oct-01 02:32:39
Version 0.0
SizeofData 20
AddressOfRawData 0xdd00a0
PointerToRawData 0xdcf0a0

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-01 02:32:39
Version 0.0
SizeofData 1276
AddressOfRawData 0xdd00b4
PointerToRawData 0xdcf0b4

UNKNOWN

Characteristics 0
TimeDateStamp 2026-Oct-01 02:32:39
Version 0.0
SizeofData 4
AddressOfRawData 0xdd05d8
PointerToRawData 0xdcf5d8

TLS Callbacks

StartAddressOfRawData 0x7ff6ba420600
EndAddressOfRawData 0x7ff6ba43c876
AddressOfIndex 0x7ff6ba4a3c08
AddressOfCallbacks 0x7ff6b9f04e10
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks 0x00007FF6B9E3FE80
0x00007FF6B9E3FEF0

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x7ff6ba49b180
GuardCFCheckFunctionPointer 140697658215632
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xc554276d
Unmarked objects 0
ASM objects (33145) 8
C objects (35207) 19
ASM objects (35207) 12
C++ objects (35207) 104
C objects (CVTCIL) (33145) 1
C objects (33145) 23
Unmarked objects (#2) 6
C++ objects (33145) 189
Imports (33145) 27
Total imports 433
C++ objects (LTCG) (35228) 65
Resource objects (35228) 1
151 2
Linker (35228) 1

Errors

[*] Warning: The PE's certificate directory is outside the file. [*] Warning: Section .fptable has a size of 0!
Leave a comment

No comments yet.