ffplay[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffplay.exe
Size

118.8MB
MD5

e3f4eb0f4b9864fa741971d200662af5
SHA1

50654340e4e85c711ac6a7a15c6555289f869d5c
SHA256

95234ce5a71fa7d79623d3581cb672097d06525ea29b6facaaf09554e13aa08d
SHA512

1e95c77635ceeb887f59cc923b8273bfe7a15993a489c61c2afde0617021e8fe9eef6bf1a182eba94bf0b7e459ff72335919dd19b557909caa34c7cb0797d743
SSDEEP

1572864:R0ZCKA6R3KPwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhiBvI:iSBI

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffplay.exe

Files

ffplay.exe
.exe windows:4 windows x64 arch:x64

d2c966be067ca55b3b98ee2d9328383c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetUserNameA
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegisterEventSourceW
ReportEventW

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

cfgmgr32

CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Open_DevNode_Key

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertOpenSystemStoreW

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

gdi32

BitBlt
ChoosePixelFormat
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreatePen
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
DescribePixelFormat
EnumFontFamiliesExW
EnumFontFamiliesW
ExtTextOutW
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetDeviceGammaRamp
GetICMProfileW
GetObjectA
GetPixelFormat
GetStockObject
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextFaceW
GetTextMetricsW
Rectangle
SelectObject
SetBkMode
SetDeviceGammaRamp
SetPixelFormat
SetTextColor
SwapBuffers

imm32

ImmAssociateContext
ImmGetCandidateListW
ImmGetCompositionStringW
ImmGetContext
ImmGetIMEFileNameA
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionStringW
ImmSetCompositionWindow

iphlpapi

GetAdaptersInfo
if_nametoindex

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AreFileApisANSI
CancelIo
CancelIoEx
CloseHandle
CompareStringA
ConvertFiberToThread
ConvertThreadToFiberEx
CopyFileA
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateMutexA
CreateSemaphoreA
CreateSemaphoreW
CreateSymbolicLinkA
CreateThread
CreateToolhelp32Snapshot
DebugBreak
DeleteCriticalSection
DeleteFiber
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
EnumResourceNamesW
ExitProcess
ExpandEnvironmentStringsA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
FindNextFileA
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetCommandLineW
GetComputerNameA
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDriveTypeA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocaleInfoA
GetLogicalDrives
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemPowerStatus
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadGroupAffinity
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetUserDefaultLocaleName
GetVersion
GetVolumeInformationW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAlloc
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
IsDebuggerPresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExA
MoveFileExW
MulDiv
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekConsoleInputA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleInputA
ReadConsoleW
ReadFile
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryA
RemoveDirectoryW
ResetEvent
ResumeThread
RtlCaptureStackBackTrace
RtlUnwindEx
SetConsoleMode
SetConsoleTextAttribute
SetDllDirectoryA
SetDllDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadErrorMode
SetThreadExecutionState
SetThreadGroupAffinity
SetThreadPriority
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFileEx
UnmapViewOfFile
UnregisterWait
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
lstrcmpiW

api-ms-win-crt-convert-l1-1-0

_i64toa
_itoa_s
_ui64toa
_ultoa
atof
atoi
mbrtowc
mbstowcs
strtod
strtol
strtoll
strtoul
strtoull
strtoumax
wcrtomb
wcstombs
wcstombs_s
wcstoul
_ltoa
_itoa

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron
_wgetcwd
_wgetenv
getenv

api-ms-win-crt-filesystem-l1-1-0

_access
_findfirst64
_findclose
_findnext64
_fstat64
_fullpath
_lock_file
_mkdir
_rmdir
_stat64
_unlink
_unlock_file
_waccess
_wchdir
_wchmod
_wfindfirst64
_wfindnext64
_wfullpath
_wmkdir
_wremove
_wrename
_wrmdir
_wstat64
_wunlink
remove
rename
_unlink
_rmdir
_mkdir
_chmod

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_aligned_realloc
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_hypot
_j1
acos
acosf
asin
asinf
asinhf
atan
atan2
atan2f
atanf
cbrt
cbrtf
ceil
ceilf
cos
cosf
cosh
erf
erff
exp
exp2
exp2f
expf
expm1
fabs
floor
floorf
fma
fmaf
fmax
fmaxf
fmin
fminf
fmod
fmodf
frexp
hypot
llround
llroundf
log
log10
log10f
log1p
log1pf
log2
log2f
logf
lrint
lrintf
lround
lroundf
modf
modff
nextafter
pow
powf
remainder
round
roundf
sin
sinf
sinh
sinhf
sqrt
sqrtf
tan
tanf
tanh
tanhf
tgamma
_fdopen

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memchr
memcmp
memcpy
memmove
strchr
strrchr
strstr
wcsrchr
wcsstr

api-ms-win-crt-runtime-l1-1-0

_set_app_type
__p___argc
__p___argv
__p___wargv
_assert
_beginthreadex
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_endthreadex
_errno
_exit
_get_errno
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_errno
_set_invalid_parameter_handler
_wassert
abort
exit
perror
raise
signal
strerror
strerror_s
_getpid

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
_close
_fseeki64
_ftelli64
_get_osfhandle
_locking
_lseeki64
_open
_read
_setmode
_telli64
_wfopen
_wopen
_wsopen
clearerr
fclose
feof
ferror
fflush
fgetc
fgets
fopen
fopen_s
fputc
fputs
fread
fseek
ftell
fwrite
getc
getchar
getwc
putc
putchar
puts
putwc
rewind
setbuf
setvbuf
ungetc
ungetwc
_write
_write
_sopen
_setmode
_read
_open
_isatty
_getcwd
_fileno
_fileno
_dup
_close

api-ms-win-crt-string-l1-1-0

_isctype
_strlwr
_strnicmp
_strrev
_wcsicmp
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
mbrlen
memset
strcat
strcmp
strcoll
strcpy
strcspn
strlen
strncat
strncmp
strncpy
strncpy_s
strpbrk
strspn
strtok
strtok_s
strxfrm
tolower
toupper
towlower
towupper
wcscat
wcscat_s
wcscmp
wcscoll
wcscpy
wcscpy_s
wcslen
wcsncmp
wcsncpy
wcsxfrm
_wcsnicmp
_wcsdup
_strupr
_stricmp
_strdup
_strdup

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_ftime64
_ftime64_s
_gmtime64
_gmtime64_s
_localtime64
_localtime64_s
_mktime64
_time64
_tzset
_wutime64
clock
strftime
wcsftime

api-ms-win-crt-utility-l1-1-0

bsearch
div
qsort
rand
rand_s
srand

ntdll

NtWriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlNtStatusToDosError
RtlVirtualUnwind

ole32

CLSIDFromString
CoCreateInstance
CoGetMalloc
CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
OleLoadFromStream
OleSaveToStream
PropVariantClear
StringFromCLSID
StringFromGUID2

oleaut32

OleCreatePropertyFrame
SysFreeString

secur32

AcquireCredentialsHandleA
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA

setupapi

CM_Get_Device_IDA
CM_Get_Parent
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA

shell32

CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
SHGetFolderPathA
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
ShellExecuteW

shlwapi

PathRemoveFileSpecW
SHCreateStreamOnFileA

user32

AdjustWindowRectEx
AttachThreadInput
BeginPaint
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CopyIcon
CopyImage
CreateIconFromResource
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DialogBoxIndirectParamW
DispatchMessageA
DispatchMessageW
DrawIcon
DrawTextW
EmptyClipboard
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsW
FillRect
FindWindowW
FlashWindowEx
FrameRect
GetAsyncKeyState
GetClassInfoExW
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardSequenceNumber
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageExtraInfo
GetMessageTime
GetMessageW
GetMonitorInfoW
GetParent
GetProcessWindowStation
GetPropW
GetRawInputData
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetSystemMetrics
GetUpdateRect
GetUserObjectInformationW
GetWindowLongPtrA
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsClipboardFormatAvailable
IsIconic
KillTimer
LoadCursorA
LoadCursorW
LoadIconW
MapVirtualKeyW
MessageBoxA
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjects
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageW
PostThreadMessageW
PtInRect
RegisterClassExA
RegisterClassExW
RegisterClassW
RegisterDeviceNotificationW
RegisterRawInputDevices
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetPropW
SetTimer
SetWindowLongPtrA
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicode
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
ValidateRect

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

winmm

timeBeginPeriod
timeEndPeriod
waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetErrorTextW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAGetLastError
WSAGetOverlappedResult
WSARecvFrom
WSAResetEvent
WSASendMsg
WSASendTo
WSASetLastError
WSAStartup
WSAStringToAddressA
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

Exports

Exports

Java_java_awt_BDFontMetrics_charWidthN
Java_java_awt_BDFontMetrics_charsWidthN
Java_java_awt_BDFontMetrics_destroyFontN
Java_java_awt_BDFontMetrics_destroyN
Java_java_awt_BDFontMetrics_getFontFamilyAndStyleN
Java_java_awt_BDFontMetrics_initN
Java_java_awt_BDFontMetrics_loadFontN
Java_java_awt_BDFontMetrics_resolveFontN
Java_java_awt_BDFontMetrics_stringWidthN
Java_java_awt_BDFontMetrics_unloadFontConfigN
Java_java_awt_BDGraphics_drawStringN
Java_org_videolan_Libbluray_cacheBdRomFileN
Java_org_videolan_Libbluray_getAacsDataN
Java_org_videolan_Libbluray_getBdjoN
Java_org_videolan_Libbluray_getPlaylistInfoN
Java_org_videolan_Libbluray_getTitleInfosN
Java_org_videolan_Libbluray_getUOMaskN
Java_org_videolan_Libbluray_listBdFilesN
Java_org_videolan_Libbluray_readRegN
Java_org_videolan_Libbluray_seekN
Java_org_videolan_Libbluray_selectAngleN
Java_org_videolan_Libbluray_selectPlaylistN
Java_org_videolan_Libbluray_selectRateN
Java_org_videolan_Libbluray_selectTitleN
Java_org_videolan_Libbluray_setKeyInterestN
Java_org_videolan_Libbluray_setUOMaskN
Java_org_videolan_Libbluray_setVirtualPackageN
Java_org_videolan_Libbluray_soundEffectN
Java_org_videolan_Libbluray_tellTimeN
Java_org_videolan_Libbluray_updateGraphicN
Java_org_videolan_Libbluray_writeRegN
Java_org_videolan_Logger_logN
JxlColorEncodingSetToLinearSRGB
JxlColorEncodingSetToSRGB
JxlDecoderCloseInput
JxlDecoderCreate
JxlDecoderDestroy
JxlDecoderExtraChannelBufferSize
JxlDecoderFlushImage
JxlDecoderGetBasicInfo
JxlDecoderGetBoxSizeContents
JxlDecoderGetBoxSizeRaw
JxlDecoderGetBoxType
JxlDecoderGetColorAsEncodedProfile
JxlDecoderGetColorAsICCProfile
JxlDecoderGetExtraChannelBlendInfo
JxlDecoderGetExtraChannelInfo
JxlDecoderGetExtraChannelName
JxlDecoderGetFrameHeader
JxlDecoderGetFrameName
JxlDecoderGetICCProfileSize
JxlDecoderGetIntendedDownsamplingRatio
JxlDecoderImageOutBufferSize
JxlDecoderPreviewOutBufferSize
JxlDecoderProcessInput
JxlDecoderReleaseBoxBuffer
JxlDecoderReleaseInput
JxlDecoderReleaseJPEGBuffer
JxlDecoderReset
JxlDecoderRewind
JxlDecoderSetBoxBuffer
JxlDecoderSetCms
JxlDecoderSetCoalescing
JxlDecoderSetDecompressBoxes
JxlDecoderSetDesiredIntensityTarget
JxlDecoderSetExtraChannelBuffer
JxlDecoderSetImageOutBitDepth
JxlDecoderSetImageOutBuffer
JxlDecoderSetImageOutCallback
JxlDecoderSetInput
JxlDecoderSetJPEGBuffer
JxlDecoderSetKeepOrientation
JxlDecoderSetMultithreadedImageOutCallback
JxlDecoderSetOutputColorProfile
JxlDecoderSetParallelRunner
JxlDecoderSetPreferredColorProfile
JxlDecoderSetPreviewOutBuffer
JxlDecoderSetProgressiveDetail
JxlDecoderSetRenderSpotcolors
JxlDecoderSetUnpremultiplyAlpha
JxlDecoderSizeHintBasicInfo
JxlDecoderSkipCurrentFrame
JxlDecoderSkipFrames
JxlDecoderSubscribeEvents
JxlDecoderVersion
JxlEncoderAddBox
JxlEncoderAddChunkedFrame
JxlEncoderAddImageFrame
JxlEncoderAddJPEGFrame
JxlEncoderAllowExpertOptions
JxlEncoderCloseBoxes
JxlEncoderCloseFrames
JxlEncoderCloseInput
JxlEncoderCollectStats
JxlEncoderCreate
JxlEncoderDestroy
JxlEncoderDistanceFromQuality
JxlEncoderFlushInput
JxlEncoderFrameSettingsCreate
JxlEncoderFrameSettingsSetFloatOption
JxlEncoderFrameSettingsSetOption
JxlEncoderGetError
JxlEncoderGetRequiredCodestreamLevel
JxlEncoderInitBasicInfo
JxlEncoderInitBlendInfo
JxlEncoderInitExtraChannelInfo
JxlEncoderInitFrameHeader
JxlEncoderProcessOutput
JxlEncoderReset
JxlEncoderSetBasicInfo
JxlEncoderSetCms
JxlEncoderSetCodestreamLevel
JxlEncoderSetColorEncoding
JxlEncoderSetDebugImageCallback
JxlEncoderSetExtraChannelBlendInfo
JxlEncoderSetExtraChannelBuffer
JxlEncoderSetExtraChannelDistance
JxlEncoderSetExtraChannelInfo
JxlEncoderSetExtraChannelName
JxlEncoderSetFrameBitDepth
JxlEncoderSetFrameDistance
JxlEncoderSetFrameHeader
JxlEncoderSetFrameLossless
JxlEncoderSetFrameName
JxlEncoderSetICCProfile
JxlEncoderSetOutputProcessor
JxlEncoderSetParallelRunner
JxlEncoderSetUpsamplingMode
JxlEncoderStatsCreate
JxlEncoderStatsDestroy
JxlEncoderStatsGet
JxlEncoderStatsMerge
JxlEncoderStoreJPEGMetadata
JxlEncoderUseBoxes
JxlEncoderUseContainer
JxlEncoderVersion
JxlSignatureCheck

Sections

.text
Size: 96.6MB - Virtual size: 96.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17.4MB - Virtual size: 17.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 27.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2c966be067ca55b3b98ee2d9328383c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

cfgmgr32

crypt32

d2d1

dwrite

gdi32

imm32

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

ole32

oleaut32

secur32

setupapi

shell32

shlwapi

user32

version

avicap32

winmm

ws2_32

api-ms-win-core-synch-l1-2-0

Exports

Exports

Sections

.text Size: 96.6MB - Virtual size: 96.6MB

.rodata Size: 24KB - Virtual size: 24KB

.data Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 17.4MB - Virtual size: 17.4MB

.pdata Size: 1.2MB - Virtual size: 1.2MB

.xdata Size: 1.9MB - Virtual size: 1.9MB

.bss Size: - Virtual size: 27.1MB

.edata Size: 5KB - Virtual size: 5KB

.idata Size: 34KB - Virtual size: 34KB

.CRT Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 584B

.reloc Size: 357KB - Virtual size: 357KB

.text
Size: 96.6MB - Virtual size: 96.6MB

.rodata
Size: 24KB - Virtual size: 24KB

.data
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 17.4MB - Virtual size: 17.4MB

.pdata
Size: 1.2MB - Virtual size: 1.2MB

.xdata
Size: 1.9MB - Virtual size: 1.9MB

.bss
Size: - Virtual size: 27.1MB

.edata
Size: 5KB - Virtual size: 5KB

.idata
Size: 34KB - Virtual size: 34KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 584B

.reloc
Size: 357KB - Virtual size: 357KB