The BGamerT5MP exe File Malware Analysis

Technical Analysis

File Name	BGamerT5MP.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.229.174
Database Version	2025-11-24 22:00:27 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	30b08f14d7b0f3ca30daf3d59f2a1802
SHA1	14a59aeb8b4f81360588fdfe850ced3ea6e4a892
SHA256	0a636f0edeb8d827aa39c1a5b61fa03dab8dbe07f7fdd530257db822ff550c68
SHA512	a298404edce35b2016db2b7d16470bcfcf850bd3bd05607ec51577332a464f7bb57efb3989eb359fbe407f0438652baffb54ca998c988b67ea5fe945f8f49c51
ImpHash	613dc9f2cfdbf6e95d97e0107a316be9

PE Analysis

Basic Information

▼

Icon	Hash: be60466faf5fd7c9cae93f7cfa9b7398 Fuzzy: faa69c38d2a900838565c2355c052d33 dHash: f0d8c4f0d4696969
Image Base	`0x00400000`
Entry Point	`0x009d9b36`
Compilation Time	2011-08-15 21:38:49
Checksum	0x00837f39 (Actual: 0x0083d00d)
OS Version	5.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`C:\projects_pc\cod\codsrc\src\obj\t5\CoDMPSteam_CEG_bin\BlackOpsMP.pdb`
Digital Signature	The expected hash does not match the digest in SpcInfo
Imports	16 libraries
Exports	0 functions
Resources	10 Resources
Sections	7 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	6,360,480 bytes	6,360,576 bytes	6.73 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`49EFF83B463FBD5C6F58250E04FDD4FB`
`.rdata`	`0x00612000`	1,952,494 bytes	1,952,768 bytes	6.78 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BBEA526D3C11E6998A14579F40FC2F32`
`.data`	`0x007ef000`	75,319,236 bytes	235,520 bytes	4.08 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4C793BA4E24156FDC8B20BCAEAF5E42F`
`.tls`	`0x04fc4000`	109 bytes	512 bytes	0.04 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`05CD60205149D8F1BF53C4396765FC0D`
`.rodata`	`0x04fc5000`	1,904 bytes	2,048 bytes	3.73 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6B15B62292DE445D9D3B3961FD0619FE`
`.version`	`0x04fc6000`	4 bytes	512 bytes	0.08 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E0C4D73DE06653B9A9A91649F26A0BB0`
`.rsrc`	`0x04fc7000`	51,084 bytes	51,200 bytes	7.78 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A4DFB9E80F8BCBADBDD2D5EB6447C1C4`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 10 (50,398 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	5	50,224 bytes	99.7%
RT_STRING	1	50 bytes	0.1%
RT_RCDATA	3	48 bytes	0.1%
RT_GROUP_ICON	1	76 bytes	0.2%

Certificate Chain Analysis

▼

Certificate Information

Verification Status	The digital signature of the object did not verify.
Signers	Valve Corporation; VeriSign Class 3 Code Signing 2004 CA; VeriSign Class 3 Public Primary CA

Certificate Chain Summary

Certificate #1 Primary

Validity Period: 1996-01-29 00:00:00 → 2028-08-01 23:59:59

Signature Algorithm: 1.2.840.113549.1.1.2

Serial Number: 70 BA E4 1D 10 D9 29 34 B6 38 CA 7B 03 CC BA BF

VeriSign Class 3 Code Signing 2004 CA #2 Chain

Validity Period: 2004-07-16 00:00:00 → 2014-07-15 23:59:59

Signature Algorithm: sha1RSA

Serial Number: 41 91 A1 5A 39 78 DF CF 49 65 66 38 1D 4C 75 C2

Valve Corporation #3 Chain

Validity Period: 2009-04-20 00:00:00 → 2012-04-19 23:59:59

Signature Algorithm: sha1RSA

Serial Number: 6C 40 9E 48 C3 2B 0D 11 00 F8 0B 9D 29 BC 1F B9

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The BGamerT5MP.exe File Analysis