ffmpeg[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ffmpeg.exe
Size

22.4MB
MD5

2209a1213ca2dbc6dea064c67204db32
SHA1

92427997c3578bb2b99a93ad68c6d2a1c9a971fa
SHA256

f659da0cab01498ef177b152271f4b708e257af237b2b81da8ab6be0132554f6
SHA512

e258ac82f62e2418d476afbcb10f74d118a05cbf87ef5210d5b958b8cec89b17a4047871b3731de304c601a27d2b42022b26c968a09cdeb834be6c2336c85298
SSDEEP

393216:X63lkSUrXM/NMNMJC1kepkXcpjsqYOq94nJXU:k/Kuyq94nNU

Score

1^/10

Malware Config

Signatures

Files

ffmpeg.exe
.exe windows x64

24ad4f78ee38b3d58a57a054d67e29f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetProcessMemoryInfo

ole32

OleLoadFromStream
OleSaveToStream
CoTaskMemAlloc
CoInitializeEx
CreateBindCtx
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoGetMalloc
CoInitialize

oleaut32

OleCreatePropertyFrame

shlwapi

SHCreateStreamOnFileA

gdi32

BitBlt
GetObjectA
GetDIBColorTable
CreateDIBSection
SelectObject
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateRectRgn
CreateCompatibleDC
CombineRgn

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

mfplat

MFCreateSample
MFCreateAlignedMemoryBuffer
MFShutdown
MFStartup
MFCreateMediaType

user32

GetDesktopWindow
GetWindowLongPtrA
SendMessageA
GetCursorInfo
GetIconInfo
CopyIcon
DestroyCursor
LoadCursorA
FindWindowA
SetWindowLongPtrA
FrameRect
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowRgn
EndPaint
BeginPaint
ReleaseDC
GetDC
DrawIcon
GetSystemMetrics
ShowWindow
DestroyWindow
CreateWindowExA
DefWindowProcA
PeekMessageA
DispatchMessageA

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom

shell32

CommandLineToArgvW

kernel32

RtlCaptureContext
InitializeSListHead
DuplicateHandle
SetEvent
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
ResetEvent
GetCurrentThread
GetStartupInfoW
MultiByteToWideChar
SetConsoleCtrlHandler
GetConsoleMode
GetCurrentProcess
GetProcessTimes
Sleep
FreeLibrary
LoadLibraryA
LoadLibraryExW
LoadLibraryExA
GetModuleFileNameW
GetSystemDirectoryW
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetSystemTimeAsFileTime
GetProcessAffinityMask
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleW
GetProcAddress
GetModuleHandleW
WakeAllConditionVariable
MoveFileExW
MoveFileExA
SleepConditionVariableSRW
WakeConditionVariable
InitializeConditionVariable
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceComplete
InitOnceBeginInitialize
GetLastError
WaitForMultipleObjects
CreateEventA
WaitForSingleObjectEx
CreateMutexA
WaitForSingleObject
GetCommandLineW
GetModuleFileNameA
GetModuleHandleA
LocalFree
SetDllDirectoryA
WideCharToMultiByte
GetStdHandle
CloseHandle
PeekNamedPipe
ReleaseMutex

vcruntime140

memcpy
strrchr
memset
strstr
memmove
memcmp
memchr
wcsrchr
__C_specific_handler
__std_type_info_destroy_list
strchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__p__commode
_tempnam
fread
fseek
_kbhit
__stdio_common_vsscanf
_write
__stdio_common_vfprintf
fgets
fflush
fclose
_sopen
__acrt_iob_func
_get_osfhandle
_close
_setmode
_isatty
_wsopen
fwrite
ftell
setvbuf
fgetc
_lseeki64
getchar
_read
fopen
fputc
fputs
_set_fmode
__stdio_common_vfscanf

api-ms-win-crt-runtime-l1-1-0

terminate
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_register_thread_local_exe_atexit_callback
_beginthreadex
_c_exit
_cexit
perror
__p___argv
__p___argc
_exit
_initterm_e
_initterm
exit
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_crt_atexit
_execute_onexit_table
signal
_errno
abort
_wassert
_crt_at_quick_exit
strerror

api-ms-win-crt-convert-l1-1-0

strtoll
atoi
strtol
strtod
atof
strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strncpy
strncat
tolower
toupper
strcmp
_wcsdup
strspn
strtok
strncmp
strcspn

api-ms-win-crt-time-l1-1-0

clock
_mktime64
_gmtime64
_localtime64
_time64
strftime

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

api-ms-win-crt-math-l1-1-0

trunc
truncf
exp2f
__setusermatherr
scalbn
fabs
log2f
round
_fdopen
tanf
asinf
acosf
floor
llrint
llrintf
lrintf
cbrtf
floorf
fmodf
log10
frexp
ldexp
logf
atan2f
_hypotf
exp
log
sqrt
sin
sinf
cbrt
acos
asin
cos
exp2
roundf
fmod
_dclass
fmin
hypot
pow
fmax
lrint
fmaxf
atan
cosh
powf
fminf
atan2
sqrtf
ceil
sinh
tan
expf
_fdclass
rint
cosf
log10f
ceilf
atanf
tanh
tanhf
copysign
erf
log2
modf

api-ms-win-crt-heap-l1-1-0

_aligned_free
free
_aligned_malloc
_aligned_realloc
_set_new_mode
realloc
calloc
malloc

api-ms-win-crt-filesystem-l1-1-0

_wunlink
_unlink
_fstat64
_fstat64i32
_wrmdir
_rmdir
_mkdir
_stat64
_wmkdir
_wstat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 15.6MB - Virtual size: 15.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 375KB - Virtual size: 12.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24ad4f78ee38b3d58a57a054d67e29f0

Headers

DLL Characteristics

File Characteristics

Imports

psapi

ole32

oleaut32

shlwapi

gdi32

avicap32

mfplat

user32

bcrypt

shell32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 15.6MB - Virtual size: 15.6MB

.rdata Size: 5.7MB - Virtual size: 5.7MB

.data Size: 375KB - Virtual size: 12.8MB

.pdata Size: 496KB - Virtual size: 495KB

.idata Size: 16KB - Virtual size: 16KB

.gfids Size: 512B - Virtual size: 300B

_RDATA Size: 69KB - Virtual size: 69KB

.00cfg Size: 512B - Virtual size: 283B

.reloc Size: 182KB - Virtual size: 182KB

.text
Size: 15.6MB - Virtual size: 15.6MB

.rdata
Size: 5.7MB - Virtual size: 5.7MB

.data
Size: 375KB - Virtual size: 12.8MB

.pdata
Size: 496KB - Virtual size: 495KB

.idata
Size: 16KB - Virtual size: 16KB

.gfids
Size: 512B - Virtual size: 300B

_RDATA
Size: 69KB - Virtual size: 69KB

.00cfg
Size: 512B - Virtual size: 283B

.reloc
Size: 182KB - Virtual size: 182KB