The Game exe (nwjs) The NW js Community File Malware Analysis

The Game.exe (nwjs) File Analysis

Updated 1 month ago

Checked by Malware Check

Game.exe

Hash Type	Value	Action
MD5	f6d594cc22fb0fc89928044a9a277db9
SHA1	ab8d40aa06dae20ccd95636f856f9b2ebf5ac1da
SHA256	1ae624ef277d81acf2ab5f414b55fc769f9bb7a731f3295de1fa7f60141b9afa
SHA512	08bb2d443ebea1624fdae8e2ccefb7140ac48c87968f49879216137450167c3f7a7f8b21069486dceb43dc0d8d192899b46863ec8d581f2e38182537615777b4
ImpHash	b3e7238a2dac83feec37e4ff788d7d80

Hash Type

Value

Action

MD5

f6d594cc22fb0fc89928044a9a277db9

SHA1

ab8d40aa06dae20ccd95636f856f9b2ebf5ac1da

SHA256

1ae624ef277d81acf2ab5f414b55fc769f9bb7a731f3295de1fa7f60141b9afa

SHA512

08bb2d443ebea1624fdae8e2ccefb7140ac48c87968f49879216137450167c3f7a7f8b21069486dceb43dc0d8d192899b46863ec8d581f2e38182537615777b4

ImpHash

b3e7238a2dac83feec37e4ff788d7d80

PE Analysis

Basic Information

▼

Icon	Hash: c78ea2e284ddc9feb131b0bb9b0335f2 Fuzzy: 359bb7409f6d66c2043431322b378e73 dHash: 70f0b23319aecc70
Image Base	`0x140000000`
Entry Point	`0x14018c9d0`
Compilation Time	2024-06-02 05:00:00
Checksum	0x00000000 (Actual: 0x002ad1e3)
OS Version	10.0
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB Path	`nw.exe.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	4 libraries nw_elf, KERNEL32, VERSION, ntdll
Exports	3 functions
Resources	78 Resources
Sections	14 Sections

Version Information

▼

CompanyName	The NW.js Community
FileDescription	nwjs
FileVersion	0.94.0
InternalName	nw_exe
LegalCopyright	Copyright @LASTCHANGE_YEAR@, The NW.js community and The Chromium Authors. All rights reserved.
OriginalFilename	nw.exe
ProductName	nwjs
ProductVersion	0.94.0
CompanyShortName	nwjs.io
ProductShortName	nwjs
LastChange	0000000000000000000000000000000000000000-0000000000000000000000000000000000000000
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	1,857,583 bytes	1,858,048 bytes	6.52 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2DAF0FDE7A7E21749BF4655C3C04069D`
`.rdata`	`0x001c7000`	308,580 bytes	308,736 bytes	5.66 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E844B6D415698CD052C9FD876B51B8B0`
`.data`	`0x00213000`	38,144 bytes	13,824 bytes	3.28 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`599C61F14B8124F499FF8E4DFC209A5E`
`.pdata`	`0x0021d000`	59,352 bytes	59,392 bytes	6.04 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5FA9B4F78246ADF948348EE4A55C745A`
`.gxfg`	`0x0022c000`	11,584 bytes	11,776 bytes	5.18 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`70FBD260EF6B5C444A268B917A5D39F4`
`.retplne`	`0x0022f000`	168 bytes	512 bytes	1.32 (Normal)	`0x00000000`	`5ECCA2C6EA1D296F112E2A3940D7AF4A`
`.tls`	`0x00230000`	657 bytes	1,024 bytes	0.23 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`69D538F48AA9CCF15079223A54B321DC`
`.voltbl`	`0x00231000`	68 bytes	512 bytes	1.14 (Normal)	`0x00000000`	`3E0C0EC85F664161CF947E236F80C926`
`CPADinfo`	`0x00232000`	56 bytes	512 bytes	0.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`60D3EA61D541C9BE2E845D2787FB9574`
`_RDATA`	`0x00233000`	244 bytes	512 bytes	2.45 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`06B1BFD8F1CC7C04E103D36A93317B06`
`malloc_h`	`0x00234000`	304 bytes	512 bytes	4.45 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`3678B8D4F45B7B6498CE0C54EF6FCF18`
`prot`	`0x00235000`	116 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00236000`	493,680 bytes	494,080 bytes	5.42 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1000B5698AE8B48E152A27AF4D455163`
`.reloc`	`0x002af000`	9,140 bytes	9,216 bytes	5.45 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`C7BBCE648D2986B72C9A6FAAF513A4FF`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 78 (489,294 bytes)

Resource Type	Count	Total Size	Percentage
GOOGLEUPDATEAPPLICATIONCOMMANDS	1	4 bytes	0%
RT_CURSOR	23	56,516 bytes	11.6%
RT_ICON	26	429,834 bytes	87.8%
RT_GROUP_CURSOR	21	448 bytes	0.1%
RT_GROUP_ICON	5	394 bytes	0.1%
RT_VERSION	1	1,120 bytes	0.2%
RT_MANIFEST	1	978 bytes	0.2%

Certificate Chain Analysis

▼

Certificate Information

Product	nwjs
Description	nwjs
File Version	0.94.0
Original Name	nw.exe
Internal Name	nw_exe
Copyright	Copyright @LASTCHANGE_YEAR@, The NW.js community and The Chromium Authors. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	Game.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.216.174
Database Version	2025-05-19 19:00:25 UTC

The Game.exe (nwjs) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification