Manalyze report for fe2af5251f2fc4c4605234b24153852518b89c7dfd0f00c9fba49c6b4dcd856e

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Jun-28 00:18:58
Detected languages	English - United States
Debug artifacts	C:\Users\Trixk\Desktop\Byte Services\RzChromaSDK64.pdb

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 8.0` `MASM/TASM - sig1(h)`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: virus` `Contains domain names: fontawesome.com github.com https://fontawesome.com https://github.com`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryA GetProcAddress` `Possibly launches other programs: ShellExecuteW` `Uses functions commonly found in keyloggers: GetAsyncKeyState GetForegroundWindow` `Manipulates other processes: OpenProcess` `Reads the contents of the clipboard: GetClipboardData`
Malicious	VirusTotal score: 5/66 (Scanned on 2026-08-09 05:44:21)	`Bkav: W32.Malware.E312E86D` `CrowdStrike: win/malicious_confidence_60% (D)` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `McAfeeD: ti!FE2AF5251F2F`

Hashes

MD5	`3a0bd189b61dfd8e776b12f95a7d7a16`
SHA1	`be6770dd663914b1f19cb40b93302892a6ea4c48`
SHA256	`fe2af5251f2fc4c4605234b24153852518b89c7dfd0f00c9fba49c6b4dcd856e`
SHA3	`d9e430186a3ad8a14df98577205937ab7b8864dfcfcc020440a3106dfecc9310`
SSDeep	`12288:KqLGxYS0Gc6jggye2QLBsglMZtQrMQ6TnSEl1yt6zzng0LeYicndsQyUS/qeh:gYS0GZKebxGqg5RpicnryUY1`
Imports Hash	`4ad83d05b2f15cf8851d2a950469aae1`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Jun-28 00:18:58
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x81200`
SizeOfInitializedData	`0x1fea00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000081544 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x180000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x285000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`b0148db974b82e165992c913f19eb5c2`
SHA1	`77c7ae4f8565ab95fbeaa46ffc3e88718c4b0961`
SHA256	`b1bab325624dbc8b0dab47c3e8dfd4ce4bef794ee5cbf171c96f36bd5f349ec2`
SHA3	`24198def56fbfc9d8c6d88b5c4858eeb85eaff3b27bad0697ebf629bef0b5d5a`
VirtualSize	`0x81130`
VirtualAddress	`0x1000`
SizeOfRawData	`0x81200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.5265`

.rdata

MD5	`078aa6f08cf00bee4d0665f240d8fbda`
SHA1	`0f7fc76ead9ffffae7c8e5958e35b324ca642038`
SHA256	`6d9f2425b4c930e27b2183eca919c34c27e660f727d968ae0bedd78fc96bde92`
SHA3	`be347d227b977c3d596367a0e78ed4713c01e168d6b08f149f3c877b1f86a2a7`
VirtualSize	`0x67ab2`
VirtualAddress	`0x83000`
SizeOfRawData	`0x67c00`
PointerToRawData	`0x81600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.28776`

.data

MD5	`941311f083be2a405f3ba4a10098af4f`
SHA1	`39f91990c7a5ce812d1b3d29043568b2b212ff8d`
SHA256	`ae982ec17b690660c1b95488bc8ff14b36d5d5e917173a080ace0a53341b53b1`
SHA3	`7523d474bf75ac7f5da37a5d3c3a6c55a60da2f2da105f6b6c7067e210e45018`
VirtualSize	`0x1911d8`
VirtualAddress	`0xeb000`
SizeOfRawData	`0x400`
PointerToRawData	`0xe9200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.00431`

.pdata

MD5	`4096bcc1c3ba45e4a0cd91ef40256ff0`
SHA1	`b8f8d0c02804eeeac7bc4e9cde3b005871378b2b`
SHA256	`0040d8e695a817e034190bf355a4ac3d71812f26ef5eb9822a1d304241f47fbf`
SHA3	`ac4f94790b626558eee6422c3af0fad00cc30d3d327a7cc5e43b0283a9c29ec3`
VirtualSize	`0x55a4`
VirtualAddress	`0x27d000`
SizeOfRawData	`0x5600`
PointerToRawData	`0xe9600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.93183`

.rsrc

MD5	`7ebd2783a0ab281f979111a4e46b67b4`
SHA1	`995b80b045f1c43e4c01aac35c9f32e562bbe817`
SHA256	`b4b6b705c6126f1ced8abb7c4fe559dc4d98a3a3127fdf1a546f8727c083de0a`
SHA3	`3de221137df2d59aa9466721a979732446b48cd33014f03e3bd8a6922bc5e50d`
VirtualSize	`0xf8`
VirtualAddress	`0x283000`
SizeOfRawData	`0x200`
PointerToRawData	`0xeec00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.52496`

.reloc

MD5	`aae350bbd1ea9064ff4cc3ef8eed9232`
SHA1	`44a966e396c3988247dddf96a925b2c0be768023`
SHA256	`aacf4a823f59654d9fd629bdb346a5258f2b8dc4fb2cb1737d6a53cadf8809bf`
SHA3	`869409d2a5190c92172f6b2d0d2dfc7e21c48aa785b4137e1009a1fa4fd3166e`
VirtualSize	`0x274`
VirtualAddress	`0x284000`
SizeOfRawData	`0x400`
PointerToRawData	`0xeee00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`3.87769`

Imports

KERNEL32.dll	`AcquireSRWLockExclusive` `CloseHandle` `CreateThread` `GetLocalTime` `AddVectoredExceptionHandler` `GetModuleHandleW` `WideCharToMultiByte` `QueryFullProcessImageNameW` `GetTickCount` `OutputDebugStringA` `MultiByteToWideChar` `GlobalAlloc` `GlobalFree` `GlobalLock` `GlobalUnlock` `GetLocaleInfoA` `LoadLibraryA` `QueryPerformanceFrequency` `OpenProcess` `GetProcAddress` `DisableThreadLibraryCalls` `QueryPerformanceCounter` `GetModuleHandleA` `TerminateProcess` `InitializeSListHead` `GetSystemTimeAsFileTime` `GetCurrentThreadId` `GetCurrentProcessId` `IsProcessorFeaturePresent` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `IsDebuggerPresent` `RtlVirtualUnwind` `RtlLookupFunctionEntry` `RtlCaptureContext` `SleepConditionVariableSRW` `WakeAllConditionVariable` `lstrcpynW` `GetCurrentProcess` `GetCurrentThread` `ReleaseSRWLockExclusive` `GetModuleHandleExA` `Sleep` `VirtualProtect` `IsDBCSLeadByte` `GetModuleFileNameA`
USER32.dll	`DefWindowProcW` `GetKeyState` `GetMessageExtraInfo` `LoadCursorA` `ScreenToClient` `GetAsyncKeyState` `ClientToScreen` `TrackMouseEvent` `GetKeyboardLayout` `GetForegroundWindow` `SetCapture` `SetCursor` `GetClientRect` `GetCapture` `SetWindowLongPtrW` `DestroyWindow` `CallWindowProcW` `GetWindowThreadProcessId` `SetClipboardData` `GetClipboardData` `EmptyClipboard` `DefWindowProcA` `CreateWindowExA` `IsWindowUnicode` `ReleaseCapture` `SetCursorPos` `GetCursorPos` `OpenClipboard` `CloseClipboard` `mouse_event` `UnregisterClassA` `RegisterClassExA` `GetWindowTextW` `EnumWindows`
SHELL32.dll	`ShellExecuteW`
MSVCP140.dll	`?_Xout_of_range@std@@YAXPEBD@Z` `?_Xlength_error@std@@YAXPEBD@Z`
d3d11.dll	`D3D11CreateDeviceAndSwapChain`
dbghelp.dll	`SymCleanup` `SymGetModuleBase64` `SymFromAddr` `StackWalk64` `SymFunctionTableAccess64` `SymInitialize`
IMM32.dll	`ImmSetCandidateWindow` `ImmReleaseContext` `ImmGetContext` `ImmSetCompositionWindow`
D3DCOMPILER_47.dll	`D3DCompile`
VCRUNTIME140.dll	`__std_exception_copy` `strrchr` `strchr` `memchr` `memcmp` `memcpy` `memset` `_CxxThrowException` `__std_type_info_destroy_list` `__std_exception_destroy` `__C_specific_handler` `memmove`
api-ms-win-crt-runtime-l1-1-0.dll	`_seh_filter_dll` `_configure_narrow_argv` `_initialize_narrow_environment` `_initialize_onexit_table` `_register_onexit_function` `_invoke_watson` `_crt_atexit` `_cexit` `_initterm` `_initterm_e` `_execute_onexit_table` `_wassert`
api-ms-win-crt-string-l1-1-0.dll	`strcmp` `strcpy_s` `strncmp` `strncpy` `_wcsicmp`
api-ms-win-crt-stdio-l1-1-0.dll	`fread` `_wfopen` `fwrite` `fseek` `fflush` `__acrt_iob_func` `ftell` `__stdio_common_vsprintf` `fopen_s` `__stdio_common_vswprintf` `__stdio_common_vfprintf` `fclose` `__stdio_common_vsscanf`
api-ms-win-crt-convert-l1-1-0.dll	`atof` `strtoul`
api-ms-win-crt-math-l1-1-0.dll	`powf` `pow` `logf` `round` `sin` `atan2f` `log` `fmodf` `sinf` `sqrt` `atan2` `sqrtf` `acosf` `ceilf` `cos` `cosf`
api-ms-win-crt-utility-l1-1-0.dll	`qsort`
api-ms-win-crt-heap-l1-1-0.dll	`free` `malloc` `_callnewh`

Delayed Imports

2

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x91`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.8858`
MD5	`f7ad1eab748bc07570a57ec87787cf90`
SHA1	`0b1608da9fef218386e825db575c65616826d9f4`
SHA256	`d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04`
SHA3	`6c9541b36948c19ae507d74223621875b3af4064f7cd8200bdb97e15a047e96a`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Jun-28 00:18:58
Version	`0.0`
SizeofData	`79`
AddressOfRawData	`0xe1108`
PointerToRawData	`0xdf708`
Referenced File	C:\Users\Trixk\Desktop\Byte Services\RzChromaSDK64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Jun-28 00:18:58
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0xe1158`
PointerToRawData	`0xdf758`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Jun-28 00:18:58
Version	`0.0`
SizeofData	`832`
AddressOfRawData	`0xe116c`
PointerToRawData	`0xdf76c`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Jun-28 00:18:58
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x1800e14d0`
EndAddressOfRawData	`0x1800e14d8`
AddressOfIndex	`0x1800eb324`
AddressOfCallbacks	`0x180083620`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1800eb040`

RICH Header

XOR Key	`0x3cf2073b`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`14`
ASM objects (35207)	`4`
C objects (35207)	`8`
C++ objects (35207)	`20`
Imports (35207)	`4`
Imports (33145)	`19`
Total imports	`214`
C++ objects (LTCG) (35228)	`8`
Resource objects (35228)	`1`
Linker (35228)	`1`

Errors

Leave a comment

No comments yet.