The BlackOps exe File Malware Analysis

Technical Analysis

File Name	BlackOps.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.229.174
Database Version	2025-11-24 22:00:27 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	c1adab60073a2c6d637310f622d749fb
SHA1	ee5e0c1c4cd5d2b1319a0a0c87ac8204e3e8ade9
SHA256	2ba4a04e81de2b60582da0e4489efde21e6cb07904a223bae633b6ccaebbf759
SHA512	17a85ab3678c92076f7b3b5102281a4608cb474b431972cbc0715e766204c9a60ab85f4062a4eef63146688894bbe8740e7137197fc8a70ca552270588c8aa48
ImpHash	c4e1aa7a1cbeff7f7b939ba10eb1c37f

PE Analysis

Basic Information

▼

Icon	Hash: 61c2ddbe742a2f3e1492302877c0d6f0 Fuzzy: 8b9fcd47abd9f49aabbd06d1910f0fc6 dHash: f0c8c0f0d4696969
Image Base	`0x00400000`
Entry Point	`0x0096da57`
Compilation Time	2011-09-01 23:06:57
Checksum	0x007c804e (Actual: 0x007c2b32)
OS Version	5.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`C:\projects_pc\cod\codsrc\src\obj\t5\CoDSteam_CEG_bin\BlackOps.pdb`
Digital Signature	Insufficient data - 1 bytes requested but only 0 available while parsing asn1crypto.cms.SignerInfo
Imports	16 libraries
Exports	0 functions
Resources	10 Resources
Sections	7 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	5,904,912 bytes	5,905,408 bytes	6.73 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`45A99BC4E47B6084DF8ACE730AD9B7F1`
`.rdata`	`0x005a3000`	1,869,498 bytes	1,869,824 bytes	4.49 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9EA41E25DA9F2565A3669140BCD5D22E`
`.data`	`0x0076c000`	61,814,468 bytes	238,592 bytes	3.51 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E2676ACD7F182597640FBC42675CE90A`
`.tls`	`0x04260000`	109 bytes	512 bytes	0.04 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`05CD60205149D8F1BF53C4396765FC0D`
`.rodata`	`0x04261000`	1,904 bytes	2,048 bytes	3.73 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6B15B62292DE445D9D3B3961FD0619FE`
`.version`	`0x04262000`	4 bytes	512 bytes	0.08 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E0C4D73DE06653B9A9A91649F26A0BB0`
`.rsrc`	`0x04263000`	78,020 bytes	78,336 bytes	7.86 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`27D6358333C3FFCED6BCC04A3C38F52A`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 10 (77,333 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	5	77,159 bytes	99.8%
RT_STRING	1	50 bytes	0.1%
RT_RCDATA	3	48 bytes	0.1%
RT_GROUP_ICON	1	76 bytes	0.1%

Certificate Chain Analysis

▼

Certificate Information

Signing Date	12:00 AM 1/1/1601 (155235 days ago)
Verification Status	The digital signature of the object did not verify.

Certificate Chain Summary

DigiCert SHA2 Assured ID Code Signing CA #1 Primary

Validity Period: 2013-10-22 12:00:00 → 2028-10-22 12:00:00

Signature Algorithm: sha256RSA

Serial Number: 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08

Valve Corp. #2 Chain

Validity Period: 2014-06-25 00:00:00 → 2017-06-29 12:00:00

Signature Algorithm: sha256RSA

Serial Number: 05 5C 80 C6 D0 2D D5 1E 55 BA A6 82 10 59 9B 4A

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

Insufficient data - 1 bytes requested but only 0 available while parsing asn1crypto.cms.SignerInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The BlackOps.exe File Analysis