The Game exe (nwjs) The NW js Community File Malware Analysis

The Game.exe (nwjs) File Analysis

Updated 3 months ago

Checked by Malaware Check

Game.exe

Hash Type	Value	Action
MD5	79f72c7b542d7192ddd02a23706aa311
SHA1	ee58a4397f8e1cebc7b835b3d8f42900034e3d97
SHA256	2f80660cd888b0683ec8becc8fbb5a1f923f4b906d56d39542d21dd0a60d490a
SHA512	0da9b36dd049e5c10945c7ddcdc1400471dc2f530db15f833252262e95a8aaa6643301be110d6117d30711e66e14535511295a81a1f8b755c6ccc7c163510867
ImpHash	614f0bd19a4b46ee120cc9912646f0fd

Hash Type

Value

Action

MD5

79f72c7b542d7192ddd02a23706aa311

SHA1

ee58a4397f8e1cebc7b835b3d8f42900034e3d97

SHA256

2f80660cd888b0683ec8becc8fbb5a1f923f4b906d56d39542d21dd0a60d490a

SHA512

0da9b36dd049e5c10945c7ddcdc1400471dc2f530db15f833252262e95a8aaa6643301be110d6117d30711e66e14535511295a81a1f8b755c6ccc7c163510867

ImpHash

614f0bd19a4b46ee120cc9912646f0fd

PE Analysis

Basic Information

▼

Icon	Hash: c78ea2e284ddc9feb131b0bb9b0335f2 Fuzzy: 359bb7409f6d66c2043431322b378e73 dHash: 70f0b23319aecc70
Image Base	`0x140000000`
Entry Point	`0x140155590`
Compilation Time	2020-10-04 05:00:00
Checksum	0x00000000 (Actual: 0x00258659)
OS Version	5.2
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB Path	`E:\nw71_sdk_win64\node-webkit\src\outst\nw\initialexe\nw.exe.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	3 libraries nw_elf, KERNEL32, VERSION
Exports	3 functions
Resources	62 Resources
Sections	14 Sections

Version Information

▼

CompanyName	The NW.js Community
FileDescription	nwjs
FileVersion	0.71.0
InternalName	nw_exe
LegalCopyright	Copyright 2020, The NW.js community and The Chromium Authors. All rights reserved.
OriginalFilename	nw.exe
ProductName	nwjs
ProductVersion	0.71.0
CompanyShortName	nwjs.io
ProductShortName	nwjs
LastChange	62f83a7521ae1f32e563795732dff0c9da1b660d-refs/heads/master@{#812354}
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	1,631,041 bytes	1,631,232 bytes	6.59 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`C1E91468A9D43C3390FAD3D02FB17763`
`.rdata`	`0x00190000`	337,996 bytes	338,432 bytes	5.53 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C7273CBB87215FC7FFF21F0C80015FEA`
`.data`	`0x001e3000`	52,704 bytes	18,432 bytes	3.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B42D2BD7371B544F76E4627E90A446A3`
`.pdata`	`0x001f0000`	60,120 bytes	60,416 bytes	6.01 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B6C463222BF593D4F5BE806634C2BD9F`
`.00cfg`	`0x001ff000`	40 bytes	512 bytes	0.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4EE4FEFBD4BA695BAD80650F3E51C5CA`
`.gxfg`	`0x00200000`	11,456 bytes	11,776 bytes	5.15 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6E165298F9AD55FC08C87782A40B0FE4`
`.retplne`	`0x00203000`	116 bytes	512 bytes	1.12 (Normal)	`0x00000000`	`5B9AE538AE2A6135B6C4750C10AD0A45`
`.tls`	`0x00204000`	385 bytes	512 bytes	0.14 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`84A5CC7FDE7AB630DE2A035B64EE65F2`
`.voltbl`	`0x00205000`	68 bytes	512 bytes	1.14 (Normal)	`0x00000000`	`A596ACE00344A4353F556BC517A7E489`
`CPADinfo`	`0x00206000`	56 bytes	512 bytes	0.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`60D3EA61D541C9BE2E845D2787FB9574`
`_RDATA`	`0x00207000`	244 bytes	512 bytes	2.44 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`16E785FFF73F76EA648ACA912DE8FED2`
`malloc_h`	`0x00208000`	326 bytes	512 bytes	4.70 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CC3E8834ABA34F2E67E0B921DD3003CD`
`.rsrc`	`0x00209000`	379,392 bytes	379,392 bytes	4.71 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`35AE4171CE7F1BB2B16090E29CA5B100`
`.reloc`	`0x00266000`	8,504 bytes	8,704 bytes	5.44 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`D284AB708EFD77754007A8E096C59A14`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 62 (375,859 bytes)

Resource Type	Count	Total Size	Percentage
GOOGLEUPDATEAPPLICATIONCOMMANDS	1	4 bytes	0%
RT_CURSOR	23	56,516 bytes	15%
RT_ICON	12	316,655 bytes	84.2%
RT_GROUP_CURSOR	21	448 bytes	0.1%
RT_GROUP_ICON	3	186 bytes	0%
RT_VERSION	1	1,072 bytes	0.3%
RT_MANIFEST	1	978 bytes	0.3%

Certificate Chain Analysis

▼

Certificate Information

Product	nwjs
Description	nwjs
File Version	0.71.0
Original Name	nw.exe
Internal Name	nw_exe
Copyright	Copyright 2020, The NW.js community and The Chromium Authors. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	Game.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.209.174
Database Version	2025-03-01 08:00:34 UTC

The Game.exe (nwjs) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification