d08035c314afcf513de77c2fd612b26da8a82537c64e8ac394b4b0a44a68fd3c

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Debug artifacts Embedded COFF debugging symbols

Plugin Output

Suspicious PEiD Signature: HQR data file
Info Interesting strings found in the binary: Contains domain names:
  • .eq.github.com
  • .hash.net
  • 8github.com
  • eq.github.com
  • github.com
  • golang.org
  • https://go.dev
  • https://support.paradoxplaza.com
  • interactive.com
  • paradox-interactive.com
  • paradoxplaza.com
  • s-telemetry.paradox-interactive.com
  • support.paradoxplaza.com
  • telemetry.paradox-interactive.com
  • textproto.nl
  • uintfilereadopensyncpipelinkStat.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: /4
Unusual section name found: /19
Unusual section name found: /32
Unusual section name found: /46
Unusual section name found: /65
Unusual section name found: /78
Unusual section name found: /90
Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Info The PE is digitally signed. Signer: Paradox Interactive AB (publ)
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/70 (Scanned on 2026-08-26 19:59:04) All the AVs think this file is safe.

Hashes

MD5 a408633bf9bd1e914d5d45ea176f70b3 🔍
SHA1 ed05020d1ebb404856b20444522bb6136ccf9c3c 🔍
SHA256 d08035c314afcf513de77c2fd612b26da8a82537c64e8ac394b4b0a44a68fd3c 🔍
SHA3 b8982c01e6f1bf276ef80ca0156c0c12f792a8674760ef469d6d83f4c023df2a 🔍
SSDeep 98304:VcxtrLohN/GDWkGR6auOaEbeoBui3qIq2wqEO2jCrOuaAYCMApRL1ckhp:VaoH/GyPaziaIqNqEOuCrgCrrc6p 🔍
Imports Hash d42595b695fc008ef2c56aabd8efd68e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 15
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x88fe00
NumberOfSymbols 8943
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x2d3200
SizeOfInitializedData 0x5a000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000077720 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x962000
SizeOfHeaders 0x600
Checksum 0x913f27
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e59b5958dcdf644a5915231d6e76983a 🔍
SHA1 e1ee400ae484a847c0565cd9343c1e6177f4008c 🔍
SHA256 4e33bae34ae9a5f72ff3662cc60cff798a69a70302e7b75351c259449f44ecc0 🔍
SHA3 7a9388de3cdd59130d8b74bf223638ce364abcbe9f357c1a8390c6cfd133d185 🔍
VirtualSize 0x2d30f1
VirtualAddress 0x1000
SizeOfRawData 0x2d3200
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.2029

.rdata

MD5 2c9df2e4f84075c1a49c3df6caca2ac9 🔍
SHA1 b3fcf31d4fe02ee22648f2023871966608496942 🔍
SHA256 fa1a580b60ba6cefd6ac69d26bb463b106e0423036d0d47dac5dcf2b743d0e9f 🔍
SHA3 a3d8e5bbb078f52fecfddf84e9ba407fa974d1244f2c11b76026c3b0b1962a99 🔍
VirtualSize 0x2e9690
VirtualAddress 0x2d5000
SizeOfRawData 0x2e9800
PointerToRawData 0x2d3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.55036

.data

MD5 359518045f7df06fc1745e16eb99fc26 🔍
SHA1 991d318c48b4a0c74fd9376cb8f04fa43391c3ce 🔍
SHA256 0a1cd0feeb2bafb11474adee9c4bade1470fcc6857893c2d4eee0b0b35218644 🔍
SHA3 72498c3878b3df993c19ecfd987540d6f034fca16582b26e8253423ffe50c766 🔍
VirtualSize 0xafa90
VirtualAddress 0x5bf000
SizeOfRawData 0x5a000
PointerToRawData 0x5bd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.93466

.pdata

MD5 27834e2cdf881a225c50add6b7db920c 🔍
SHA1 7806d6b808dddd86ccd584f23a9c6fb446d0f335 🔍
SHA256 77578d65276f1e872d6d83accbf29822454311b59965ef2927f53e31dcbfa7ce 🔍
SHA3 6a2ad6b2141b8a5e53f49a4f300c96194d6f5277b36cf7f94e038d64fff30589 🔍
VirtualSize 0x105e4
VirtualAddress 0x66f000
SizeOfRawData 0x10600
PointerToRawData 0x617000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.2577

.xdata

MD5 ba004bf4223de908941ff30668e6c435 🔍
SHA1 d01fd8aac73521cf2fbe46f0c84b2830515a435d 🔍
SHA256 272162b0e670f7b9bf5f2249869655b34462f00c69f0075e145e50c115b84156 🔍
SHA3 8259cadea0e7017c8d936343842589508f325eb521c3a87273f86aaad1ad68ef 🔍
VirtualSize 0xb4
VirtualAddress 0x680000
SizeOfRawData 0x200
PointerToRawData 0x627600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.76358

/4

MD5 523eaecd9190dfd8860c76496fe54d39 🔍
SHA1 4c150439725d926e90f25a2382a6fc0423f39c53 🔍
SHA256 55238d963c4c3315a9cda822f9392abe52bf62ca63d002c243df2fa55c8de088 🔍
SHA3 4a9b57bfc11367efc2692a9e762223f2e0362f9a8943e8c4d57a823353b1de6e 🔍
VirtualSize 0x14b
VirtualAddress 0x681000
SizeOfRawData 0x200
PointerToRawData 0x627800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.57872

/19

MD5 5cf1157ee95b1a02aeef6a202d8ac2d4 🔍
SHA1 2c89a488c81c986455234a1d133234570e19db5f 🔍
SHA256 a03ff0ea68ec2e7154c119bf209f20ecd421539a7333ad77fe40dae37da29526 🔍
SHA3 0f37a6e6c4f58e56f3f44638286f8960078435f6674aa4099bd0a1279c74cdcf 🔍
VirtualSize 0x816ab
VirtualAddress 0x682000
SizeOfRawData 0x81800
PointerToRawData 0x627a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99517

/32

MD5 8f36ebdf47c9b68c6ec2de879898f0b1 🔍
SHA1 0acf2f2f012aec691ccffbcc30ae4c26c5442b84 🔍
SHA256 e6195d632ae40d5adecdadb3ed8b0669886af2d79b8b9bd0856f5f5958eb576b 🔍
SHA3 cf7c7b2dbf308dd20dab87230ec5645f969ba9409b021bd405f1f4720b9e0d33 🔍
VirtualSize 0x1a9ee
VirtualAddress 0x704000
SizeOfRawData 0x1aa00
PointerToRawData 0x6a9200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.93637

/46

MD5 40cca7c46fc713b4f088e5d440ca7931 🔍
SHA1 3aaa1650bfaf5325fa9cb3a1a284aebcc92aebf4 🔍
SHA256 3e3c5f5d419b70e588da0ef0e3d9ce1a5863a5624febc16cd0c007cd14e89015 🔍
SHA3 a0e18fe9f6ac46417d52cdc99cf9ae56edb5a53f788995a085b10f88f348a0e4 🔍
VirtualSize 0x30
VirtualAddress 0x71f000
SizeOfRawData 0x200
PointerToRawData 0x6c3c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.855685

/65

MD5 8b5ba56e6c5061f41835c59963e872e9 🔍
SHA1 bf6ba533564031d5d1bbd04377f5d5987690fea0 🔍
SHA256 469c0311b7bf16e163d23b7cdf28a484aef35487614da5411b54fbbac1b12216 🔍
SHA3 a5b079678310c7df9d3cb4fc0d3b2f7998df4c2b0b83bcb74c4af4e60ebf926b 🔍
VirtualSize 0xe22ec
VirtualAddress 0x720000
SizeOfRawData 0xe2400
PointerToRawData 0x6c3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99811

/78

MD5 00353a180a12542a1436cb2f06203b68 🔍
SHA1 ccd5b709a80a4a6e79574357493952afea50fde3 🔍
SHA256 fdd34fb8ace9a0ba65911e602e987edbf32f349c317cab4b650a75fb0752a046 🔍
SHA3 f7e7c56b9ef0d5a0366c9308be7248faa469f87626f43a543542c317c6b8594a 🔍
VirtualSize 0xa83dc
VirtualAddress 0x803000
SizeOfRawData 0xa8400
PointerToRawData 0x7a6200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99563

/90

MD5 5b4f3aa3b923a0b84f440f34dc670e16 🔍
SHA1 cd6408f07b1b79f53750220d6ec242463701e555 🔍
SHA256 86cffef59f7be49b4cbcb4b64afaa82a7648c2e5fc3dfd97a32dc97f6eaaf568 🔍
SHA3 44a34f95f33b0375d6975f2ace09f1842680067bf8792b3de22c6c905342dbb9 🔍
VirtualSize 0x33176
VirtualAddress 0x8ac000
SizeOfRawData 0x33200
PointerToRawData 0x84e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.82217

.idata

MD5 a8010c6b6612f32ce98d832492f70b5d 🔍
SHA1 e47f7db0ff45993a664ccf757b01d88ef66c97f0 🔍
SHA256 045c2ce93d3ec4499defd8ae95209605fd778c9885331cad3cde9e5b1062001b 🔍
SHA3 eeecba0ddd39f36c8e7f669438dc58953e0f41ddef75404ce73edf65ed443b34 🔍
VirtualSize 0x53e
VirtualAddress 0x8e0000
SizeOfRawData 0x600
PointerToRawData 0x881800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.9538

.reloc

MD5 45a5cb13ad1daed56b22652e0d113c51 🔍
SHA1 a47dc65a389fa111634f5142fde39a3be80c4ead 🔍
SHA256 7a2ab1de5639e0c7c63614e6d6af9a77d46b9161e346d1c26fc032db993779e6 🔍
SHA3 fe86b617fcdda00ab7af509da6ccf38ccb30a0e280d8385928e47b51f94b8cc6 🔍
VirtualSize 0xde48
VirtualAddress 0x8e1000
SizeOfRawData 0xe000
PointerToRawData 0x881e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43278

.symtab

MD5 b192783e85e990ac357c083e4667ee67 🔍
SHA1 0cfe8a7c9f0ce23f0c3d77f146f3ddbc7516ec3e 🔍
SHA256 8864cef4468539e27786d3dc1f2dfd805dcb29d79bb0714f06b7ed3027b3a402 🔍
SHA3 146152ffdbf8180ca4c2ffc0278ae820900f9a8fc2fa69060dbefadf2e2ad0e5 🔍
VirtualSize 0x72fae
VirtualAddress 0x8ef000
SizeOfRawData 0x73000
PointerToRawData 0x88fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.35139

Imports

kernel32.dll WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4! [*] Warning: Tried to read outside the COFF string table to get the name of section /19! [*] Warning: Tried to read outside the COFF string table to get the name of section /32! [*] Warning: Tried to read outside the COFF string table to get the name of section /46! [*] Warning: Tried to read outside the COFF string table to get the name of section /65! [*] Warning: Tried to read outside the COFF string table to get the name of section /78! [*] Warning: Tried to read outside the COFF string table to get the name of section /90!
Leave a comment

No comments yet.