ffmpeg[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffmpeg.exe
Size

129.1MB
MD5

09c6423522fb9cd0f990f20c9f6bd843
SHA1

9354f2cf02888f8758afb182553afeedc5fc8dd1
SHA256

2e00e43aeb1929d19763ed3ca1e226b3bc81cb50f6b0b04709f1ee504657e2c5
SHA512

fe8a77756c3844a0c7fbace9f0be9e441e707873fd7ea2e3f82748818b91d726feb4572414062af02bd02c543a2844f341e97eb008a25d7f9c4c2bf795ed2a0f
SSDEEP

1572864:fwBy5oRekum1Eyz89wdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhnZPFCT:OZptFCuT62NesUus

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffmpeg.exe

Files

ffmpeg.exe
.exe windows:4 windows x64 arch:x64

e620ca7b2640c0c7ca411b5a986d7818

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA
DeregisterEventSource
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetUserNameA
GetUserNameW
InitializeSecurityDescriptor
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegisterEventSourceW
ReportEventW
SetSecurityDescriptorDacl
SystemFunction036

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

cfgmgr32

CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Open_DevNode_Key

crypt32

CertCloseStore
CertDeleteCertificateFromStore
CertEnumCRLsInStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
PFXImportCertStore

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

gdi32

BitBlt
ChoosePixelFormat
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreatePen
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
DescribePixelFormat
EnumFontFamiliesW
ExtTextOutW
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetDeviceGammaRamp
GetICMProfileW
GetObjectA
GetPixelFormat
GetStockObject
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextFaceW
GetTextMetricsW
Rectangle
SelectObject
SetBkMode
SetDeviceGammaRamp
SetPixelFormat
SetTextColor
SwapBuffers

imm32

ImmAssociateContext
ImmGetCandidateListW
ImmGetCompositionStringW
ImmGetContext
ImmGetIMEFileNameA
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionStringW
ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo
if_indextoname
if_nametoindex

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AllocConsole
AreFileApisANSI
AttachConsole
CancelIo
CancelIoEx
CloseHandle
CompareStringA
ConvertFiberToThread
ConvertThreadToFiberEx
CreateConsoleScreenBuffer
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DebugBreak
DeleteCriticalSection
DeleteFiber
DeviceIoControl
DuplicateHandle
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileExW
FindFirstFileW
FindNextFileA
FindNextFileW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetActiveProcessorGroupCount
GetCPInfo
GetCommandLineW
GetComputerNameA
GetComputerNameW
GetConsoleCursorInfo
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentConsoleFont
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesExA
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetNumberOfConsoleInputEvents
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetShortPathNameW
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemPowerStatus
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetThreadContext
GetThreadGroupAffinity
GetThreadLocale
GetThreadPriority
GetThreadTimes
GetTickCount
GetTickCount64
GetTimeZoneInformation
GetUserDefaultLocaleName
GetVersion
GetVersionExA
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
IsDBCSLeadByteEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsWow64Process
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExA
MoveFileExW
MulDiv
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekConsoleInputA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleInputA
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleActiveScreenBuffer
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleTitleA
SetConsoleWindowInfo
SetCurrentDirectoryA
SetDllDirectoryA
SetDllDirectoryW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetHandleInformation
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadErrorMode
SetThreadExecutionState
SetThreadGroupAffinity
SetThreadPriority
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SuspendThread
SwitchToFiber
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleOutputW
WriteConsoleW
WriteFile
__C_specific_handler
lstrcmpiW
lstrcpyA
lstrcpynA

msvcrt

___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_access
_aligned_free
_aligned_malloc
_aligned_realloc
_access
_amsg_exit
_assert
_beginthread
_beginthreadex
_cexit
_chdir
_chmod
_chsize
_close
_close
_commit
_commode
_dup
_dup2
_dup2
_endthreadex
_errno
_exit
_fdopen
_fdopen
_filelengthi64
_fileno
_fileno
_findclose
_findfirst64
_findnext64
_fmode
_fstat64
_ftime64
_ftime64_s
_get_osfhandle
_getch
_getcwd
_getdrive
_getmaxstdio
_getpid
_gmtime64
_hypot
_i64toa
_initterm
_isatty
_isatty
_isctype
_itoa_s
_itoa
_j1
_kbhit
_kbhit
_localtime64
_lock
_locking
_lseeki64
_ltoa
_mbsrchr
_mkdir
_mkdir
_mktime64
_onexit
_open
_open
_open_osfhandle
_pipe
_putenv
_read
_read
_rmdir
_rmdir
_nextafter
_setjmp
_setmaxstdio
_setmode
_setmode
_snwprintf_s
_sopen
_stat64
_strdup
_strdup
_stricmp
_strlwr
_strnicmp
_strrev
_strtoi64
_strtoui64
_strtoui64
_strupr
_time64
_ui64toa
_ui64toa_s
_ultoa
_unlink
_unlock
_unlink
_vscprintf
_vsnprintf
_vsnprintf_s
_vsnwprintf
_vsnprintf_s
_waccess
_wassert
_wchdir
_wchmod
_wcsdup
_wcsdup
_wcsicmp
_wcsicmp
_wcsnicmp
_wfindfirst64
_wfindnext64
_wfopen
_wfopen_s
_wfreopen
_wfullpath
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wputenv
_wremove
_wrename
_write
_wrmdir
_wsopen
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wstat64
_wunlink
_wutime64
abort
acos
asin
atan
atof
atoi
bsearch
calloc
clearerr
clock
fseek
fwprintf
cosh
div
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fopen_s
fprintf
fputc
fputs
fputwc
fread
free
freopen
fsetpos
ftell
fwrite
getc
getchar
getenv
getwc
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
log10
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
puts
putwc
qsort
raise
rand
realloc
remove
rename
rewind
setlocale
setvbuf
signal
sinh
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcpy_s
strcspn
strerror
strftime
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strpbrk
strrchr
strspn
strstr
strtok
strtok_s
strtol
strtoul
strxfrm
tan
tanh
tolower
toupper
towlower
towupper
vfprintf
ungetc
ungetwc
wcscat
wcschr
wcscmp
wcscoll
wcscpy
wcscpy_s
wcsftime
wcslen
wcsncmp
wcsncpy_s
wcsrchr
wcsspn
wcsstr
wcstol
wcstombs
wcstombs_s
wcstoul
wcsxfrm
wctomb

ncrypt

NCryptDecrypt
NCryptDeleteKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSignHash

ntdll

NtWriteFile
RtlNtStatusToDosError

ole32

CLSIDFromString
CoCreateInstance
CoGetMalloc
CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
OleLoadFromStream
OleSaveToStream
PropVariantClear
StringFromGUID2

oleaut32

OleCreatePropertyFrame
SysFreeString

setupapi

CM_Get_Device_IDA
CM_Get_Parent
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA

shell32

CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
ExtractIconExW
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
ShellExecuteW

shlwapi

PathRemoveFileSpecW
SHCreateStreamOnFileA

user32

AdjustWindowRectEx
AttachThreadInput
BeginPaint
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CopyIcon
CopyImage
CreateIconFromResource
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DialogBoxIndirectParamW
DispatchMessageA
DispatchMessageW
DrawIcon
DrawTextW
EmptyClipboard
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsW
FillRect
FindWindowW
FlashWindowEx
FrameRect
GetAsyncKeyState
GetClassInfoExW
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardSequenceNumber
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageExtraInfo
GetMessageW
GetMonitorInfoW
GetParent
GetProcessWindowStation
GetPropW
GetRawInputData
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetSystemMetrics
GetUpdateRect
GetUserObjectInformationW
GetWindowLongPtrA
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsWindow
KillTimer
LoadCursorA
LoadCursorW
LoadIconW
MapVirtualKeyW
MessageBoxA
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjectsEx
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageA
PostMessageW
PostThreadMessageW
PtInRect
RegisterClassExA
RegisterClassExW
RegisterClassW
RegisterDeviceNotificationW
RegisterRawInputDevices
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetPropW
SetTimer
SetWindowLongPtrA
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicode
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
ValidateRect
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

winmm

mciGetErrorStringA
mciSendCommandA
timeBeginPeriod
timeEndPeriod
waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetErrorTextW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSADuplicateSocketA
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecvFrom
WSAResetEvent
WSASendMsg
WSASendTo
WSASetEvent
WSASetLastError
WSASocketA
WSAStartup
WSAStringToAddressA
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Exports

Exports

FT_Activate_Size
FT_Add_Default_Modules
FT_Add_Module
FT_Angle_Diff
FT_Atan2
FT_Attach_File
FT_Attach_Stream
FT_Bitmap_Blend
FT_Bitmap_Convert
FT_Bitmap_Copy
FT_Bitmap_Done
FT_Bitmap_Embolden
FT_Bitmap_Init
FT_Bitmap_New
FT_CeilFix
FT_Cos
FT_DivFix
FT_Done_Face
FT_Done_FreeType
FT_Done_Glyph
FT_Done_Library
FT_Done_MM_Var
FT_Done_Size
FT_Error_String
FT_Face_GetCharVariantIndex
FT_Face_GetCharVariantIsDefault
FT_Face_GetCharsOfVariant
FT_Face_GetVariantSelectors
FT_Face_GetVariantsOfChar
FT_Face_Properties
FT_FloorFix
FT_Get_Advance
FT_Get_Advances
FT_Get_BDF_Charset_ID
FT_Get_BDF_Property
FT_Get_CMap_Format
FT_Get_CMap_Language_ID
FT_Get_Char_Index
FT_Get_Charmap_Index
FT_Get_Color_Glyph_ClipBox
FT_Get_Color_Glyph_Layer
FT_Get_Color_Glyph_Paint
FT_Get_Colorline_Stops
FT_Get_Default_Named_Instance
FT_Get_First_Char
FT_Get_Font_Format
FT_Get_Glyph
FT_Get_Glyph_Name
FT_Get_Kerning
FT_Get_MM_Blend_Coordinates
FT_Get_MM_Var
FT_Get_MM_WeightVector
FT_Get_Module
FT_Get_Multi_Master
FT_Get_Name_Index
FT_Get_Next_Char
FT_Get_PS_Font_Info
FT_Get_PS_Font_Private
FT_Get_PS_Font_Value
FT_Get_Paint
FT_Get_Paint_Layers
FT_Get_Postscript_Name
FT_Get_Renderer
FT_Get_Sfnt_LangTag
FT_Get_Sfnt_Name
FT_Get_Sfnt_Name_Count
FT_Get_Sfnt_Table
FT_Get_SubGlyph_Info
FT_Get_Track_Kerning
FT_Get_Transform
FT_Get_TrueType_Engine_Type
FT_Get_Var_Axis_Flags
FT_Get_Var_Blend_Coordinates
FT_Get_Var_Design_Coordinates
FT_Get_X11_Font_Format
FT_GlyphSlot_Own_Bitmap
FT_Glyph_Copy
FT_Glyph_Get_CBox
FT_Glyph_Stroke
FT_Glyph_StrokeBorder
FT_Glyph_To_Bitmap
FT_Glyph_Transform
FT_Has_PS_Glyph_Names
FT_Init_FreeType
FT_Library_SetLcdFilter
FT_Library_SetLcdFilterWeights
FT_Library_SetLcdGeometry
FT_Library_Version
FT_List_Add
FT_List_Finalize
FT_List_Find
FT_List_Insert
FT_List_Iterate
FT_List_Remove
FT_List_Up
FT_Load_Char
FT_Load_Glyph
FT_Load_Sfnt_Table
FT_Matrix_Invert
FT_Matrix_Multiply
FT_MulDiv
FT_MulFix
FT_New_Face
FT_New_Glyph
FT_New_Library
FT_New_Memory_Face
FT_New_Size
FT_Open_Face
FT_Outline_Check
FT_Outline_Copy
FT_Outline_Decompose
FT_Outline_Done
FT_Outline_Embolden
FT_Outline_EmboldenXY
FT_Outline_GetInsideBorder
FT_Outline_GetOutsideBorder
FT_Outline_Get_Bitmap
FT_Outline_Get_CBox
FT_Outline_Get_Orientation
FT_Outline_New
FT_Outline_Render
FT_Outline_Reverse
FT_Outline_Transform
FT_Outline_Translate
FT_Palette_Data_Get
FT_Palette_Select
FT_Palette_Set_Foreground_Color
FT_Property_Get
FT_Property_Set
FT_Reference_Face
FT_Reference_Library
FT_Remove_Module
FT_Render_Glyph
FT_Request_Size
FT_RoundFix
FT_Select_Charmap
FT_Select_Size
FT_Set_Char_Size
FT_Set_Charmap
FT_Set_Debug_Hook
FT_Set_Default_Log_Handler
FT_Set_Default_Properties
FT_Set_Log_Handler
FT_Set_MM_Blend_Coordinates
FT_Set_MM_Design_Coordinates
FT_Set_MM_WeightVector
FT_Set_Named_Instance
FT_Set_Pixel_Sizes
FT_Set_Renderer
FT_Set_Transform
FT_Set_Var_Blend_Coordinates
FT_Set_Var_Design_Coordinates
FT_Sfnt_Table_Info
FT_Sin
FT_Stream_OpenLZW
FT_Stroker_BeginSubPath
FT_Stroker_ConicTo
FT_Stroker_CubicTo
FT_Stroker_Done
FT_Stroker_EndSubPath
FT_Stroker_Export
FT_Stroker_ExportBorder
FT_Stroker_GetBorderCounts
FT_Stroker_GetCounts
FT_Stroker_LineTo
FT_Stroker_New
FT_Stroker_ParseOutline
FT_Stroker_Rewind
FT_Stroker_Set
FT_Tan
FT_Trace_Set_Default_Level
FT_Trace_Set_Level
FT_Vector_From_Polar
FT_Vector_Length
FT_Vector_Polarize
FT_Vector_Rotate
FT_Vector_Transform
FT_Vector_Unit
TT_New_Context
TT_RunIns
flite_lang_list
flite_lang_list_length
flite_voice_list
gme_ay_type
gme_clear_playlist
gme_delete
gme_enable_accuracy
gme_equalizer
gme_free_info
gme_gbs_type
gme_gym_type
gme_hes_type
gme_identify_extension
gme_identify_file
gme_identify_header
gme_ignore_silence
gme_kss_type
gme_load_custom
gme_load_data
gme_load_file
gme_multi_channel
gme_mute_voice
gme_mute_voices
gme_new_emu
gme_new_emu_multi_channel
gme_nsf_type
gme_nsfe_type
gme_open_data
gme_open_file
gme_play
gme_sap_type
gme_seek
gme_seek_samples
gme_set_autoload_playback_limit
gme_set_equalizer
gme_set_fade
gme_set_stereo_depth
gme_set_tempo
gme_set_user_cleanup
gme_set_user_data
gme_spc_type
gme_start_track
gme_tell
gme_tell_samples
gme_track_count
gme_track_ended
gme_track_info
gme_type
gme_type_extension
gme_type_list
gme_type_multitrack
gme_type_system
gme_user_data
gme_vgm_type
gme_vgz_type
gme_voice_count
gme_voice_name
gme_warning
gme_wrong_file_type
memcpy_layout
pl_alpha_overlay
pl_bit_encoding_equal
pl_buf_copy
pl_buf_create
pl_buf_destroy
pl_buf_export
pl_buf_poll
pl_buf_read
pl_buf_recreate
pl_buf_write
pl_cache_create
pl_cache_default_params
pl_cache_destroy
pl_cache_get
pl_cache_iterate
pl_cache_load
pl_cache_load_ex
pl_cache_objects
pl_cache_reset
pl_cache_save
pl_cache_save_ex
pl_cache_set
pl_cache_signature
pl_cache_size
pl_cache_try_set
pl_chroma_location_offset
pl_color_adjustment_neutral
pl_color_levels_guess
pl_color_map_default_params
pl_color_map_high_quality_params
pl_color_primaries_guess
pl_color_primaries_is_wide_gamut
pl_color_repr_decode
pl_color_repr_equal
pl_color_repr_hdtv
pl_color_repr_jpeg
pl_color_repr_merge
pl_color_repr_normalize
pl_color_repr_rgb
pl_color_repr_sdtv
pl_color_repr_uhdtv
pl_color_repr_unknown
pl_color_space_bt2020_hlg
pl_color_space_bt709
pl_color_space_equal
pl_color_space_hdr10
pl_color_space_infer
pl_color_space_infer_map
pl_color_space_infer_ref
pl_color_space_is_black_scaled
pl_color_space_is_hdr
pl_color_space_merge
pl_color_space_monitor
pl_color_space_nominal_luma_ex
pl_color_space_srgb
pl_color_space_unknown
pl_color_system_guess_ycbcr
pl_color_system_is_linear
pl_color_system_is_ycbcr_like
pl_color_transfer_nominal_peak
pl_deband_default_params
pl_deinterlace_default_params
pl_desc_access_glsl_name
pl_desc_namespace
pl_dispatch_abort
pl_dispatch_begin
pl_dispatch_callback
pl_dispatch_compute
pl_dispatch_create
pl_dispatch_destroy
pl_dispatch_finish
pl_dispatch_load
pl_dispatch_reset_frame
pl_dispatch_save
pl_dispatch_vertex
pl_distort_default_params
pl_dither_default_params
pl_error_diffusion_atkinson
pl_error_diffusion_burkes
pl_error_diffusion_false_fs
pl_error_diffusion_floyd_steinberg
pl_error_diffusion_jarvis_judice_ninke
pl_error_diffusion_kernels
pl_error_diffusion_shmem_req
pl_error_diffusion_sierra2
pl_error_diffusion_sierra3
pl_error_diffusion_sierra_lite
pl_error_diffusion_simple
pl_error_diffusion_stucki
pl_filter_bicubic
pl_filter_bilinear
pl_filter_box
pl_filter_catmull_rom
pl_filter_config_eq
pl_filter_configs
pl_filter_ewa_ginseng
pl_filter_ewa_hann
pl_filter_ewa_jinc
pl_filter_ewa_lanczos
pl_filter_ewa_lanczos4sharpest
pl_filter_ewa_lanczossharp
pl_filter_ewa_robidoux
pl_filter_ewa_robidouxsharp
pl_filter_free
pl_filter_function_bcspline
pl_filter_function_bicubic
pl_filter_function_blackman
pl_filter_function_bohman
pl_filter_function_box
pl_filter_function_catmull_rom
pl_filter_function_cosine
pl_filter_function_cubic
pl_filter_function_eq
pl_filter_function_gaussian
pl_filter_function_hamming
pl_filter_function_hann
pl_filter_function_hermite
pl_filter_function_jinc
pl_filter_function_kaiser
pl_filter_function_mitchell
pl_filter_function_oversample
pl_filter_function_presets
pl_filter_function_quadratic
pl_filter_function_robidoux
pl_filter_function_robidouxsharp
pl_filter_function_sinc
pl_filter_function_sphinx
pl_filter_function_spline16
pl_filter_function_spline36
pl_filter_function_spline64
pl_filter_function_triangle
pl_filter_function_welch
pl_filter_functions
pl_filter_gaussian
pl_filter_generate
pl_filter_ginseng
pl_filter_hermite
pl_filter_lanczos
pl_filter_mitchell
pl_filter_mitchell_clamp
pl_filter_nearest
pl_filter_oversample
pl_filter_presets
pl_filter_robidoux
pl_filter_robidouxsharp
pl_filter_sample
pl_filter_sinc
pl_filter_spline16
pl_filter_spline36
pl_filter_spline64
pl_find_error_diffusion_kernel
pl_find_filter_config
pl_find_filter_function
pl_find_filter_function_preset
pl_find_filter_preset
pl_find_fmt
pl_find_fourcc
pl_find_gamut_map_function
pl_find_named_fmt
pl_find_option
pl_find_tone_map_function
pl_find_vertex_fmt
pl_fix_ver
pl_fmt_has_modifier
pl_fmt_is_float
pl_fmt_is_ordered
pl_frame_clear_rgba
pl_frame_from_swapchain
pl_frame_is_cropped
pl_frame_mix_current
pl_frame_mix_nearest
pl_frame_mixers
pl_frame_set_chroma_location
pl_frames_infer
pl_frames_infer_mix
pl_gamut_map_absolute
pl_gamut_map_clip
pl_gamut_map_darken
pl_gamut_map_desaturate
pl_gamut_map_functions
pl_gamut_map_generate
pl_gamut_map_highlight
pl_gamut_map_linear
pl_gamut_map_params_equal
pl_gamut_map_params_noop
pl_gamut_map_perceptual
pl_gamut_map_relative
pl_gamut_map_sample
pl_gamut_map_saturation
pl_gamut_map_softclip
pl_generate_bayer_matrix
pl_generate_blue_noise
pl_get_adaptation_matrix
pl_get_color_mapping_matrix
pl_get_cone_matrix
pl_get_detected_hdr_metadata
pl_get_rgb2xyz_matrix
pl_get_xyz2rgb_matrix
pl_gpu_finish
pl_gpu_flush
pl_gpu_is_failed
pl_gpu_set_cache
pl_hdr_metadata_contains
pl_hdr_metadata_empty
pl_hdr_metadata_equal
pl_hdr_metadata_hdr10
pl_hdr_metadata_merge
pl_hdr_rescale
pl_icc_close
pl_icc_decode
pl_icc_default_params
pl_icc_encode
pl_icc_open
pl_icc_profile_compute_signature
pl_icc_profile_equal
pl_icc_update
pl_ipt_ipt2lms
pl_ipt_lms2ipt
pl_ipt_lms2rgb
pl_ipt_rgb2lms
pl_log_color
pl_log_create_342
pl_log_default_params
pl_log_destroy
pl_log_level_update
pl_log_simple
pl_log_update
pl_lut_free
pl_lut_parse_cube
pl_matrix2x2_apply
pl_matrix2x2_apply_rc
pl_matrix2x2_identity
pl_matrix2x2_invert
pl_matrix2x2_mul
pl_matrix2x2_rmul
pl_matrix2x2_rotation
pl_matrix2x2_scale
pl_matrix3x3_apply
pl_matrix3x3_apply_rc
pl_matrix3x3_identity
pl_matrix3x3_invert
pl_matrix3x3_mul
pl_matrix3x3_rmul
pl_matrix3x3_scale
pl_mpv_user_shader_destroy
pl_mpv_user_shader_parse
pl_needs_film_grain
pl_num_error_diffusion_kernels
pl_num_filter_configs
pl_num_filter_function_presets
pl_num_filter_functions
pl_num_filter_presets
pl_num_frame_mixers
pl_num_gamut_map_functions
pl_num_scale_filters
pl_num_tone_map_functions
pl_option_count
pl_option_list
pl_options_add_hook
pl_options_alloc

Sections

.text
Size: 91.0MB - Virtual size: 91.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 33.0MB - Virtual size: 33.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 26.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 615KB - Virtual size: 614KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e620ca7b2640c0c7ca411b5a986d7818

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

cfgmgr32

crypt32

d2d1

dwrite

gdi32

imm32

iphlpapi

kernel32

msvcrt

ncrypt

ntdll

ole32

oleaut32

setupapi

shell32

shlwapi

user32

version

avicap32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 91.0MB - Virtual size: 91.0MB

.data Size: 1.4MB - Virtual size: 1.4MB

.rodata Size: 22KB - Virtual size: 21KB

.rdata Size: 33.0MB - Virtual size: 33.0MB

.pdata Size: 1.2MB - Virtual size: 1.2MB

.xdata Size: 1.8MB - Virtual size: 1.8MB

.bss Size: - Virtual size: 26.8MB

.edata Size: 21KB - Virtual size: 20KB

.idata Size: 35KB - Virtual size: 34KB

.CRT Size: 512B - Virtual size: 128B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 615KB - Virtual size: 614KB

.text
Size: 91.0MB - Virtual size: 91.0MB

.data
Size: 1.4MB - Virtual size: 1.4MB

.rodata
Size: 22KB - Virtual size: 21KB

.rdata
Size: 33.0MB - Virtual size: 33.0MB

.pdata
Size: 1.2MB - Virtual size: 1.2MB

.xdata
Size: 1.8MB - Virtual size: 1.8MB

.bss
Size: - Virtual size: 26.8MB

.edata
Size: 21KB - Virtual size: 20KB

.idata
Size: 35KB - Virtual size: 34KB

.CRT
Size: 512B - Virtual size: 128B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 615KB - Virtual size: 614KB