ffplay[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ffplay.exe
Size 83.4MB
Sample261102-rmcdvawz4m
SHA256 f6536c4caf9bac0fee1e8ffaafa5b13b6ad3e386a9a9f0b6613360e8c6d59919
MD5 c0efa3d3f1bd4c6706b32439391b33c8
SHA1 53835f14ed20a81d1481c898455e3a4829f20436
SHA512 6eee2d85f71410d203ec1394641ad1cf9bf15300706e2748887c6863e7eba4b293a93f850a8b154278fc3cbab32d86b62a96fbccb5d7aa0e541fe5afd24b64e7
SSDEEP 1572864:3FfANSvsSwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhli:3tk
TLSH
T112188E9EE2D3609CD12BD4F0436AF773BA34787C11206E7A26D9DA306E22F80575AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffplay.exe

File Explorer

ffplay.exe

.exe 83.4MB

ffplay.exe

IMPHASH 4a62e8b1eed920737e2866d86547fdab
SHA256 f6536c4caf9bac0fee1e8ffaafa5b13b6ad3e386a9a9f0b6613360e8c6d59919
MD5 c0efa3d3f1bd4c6706b32439391b33c8
SHA1 53835f14ed20a81d1481c898455e3a4829f20436
SHA512 6eee2d85f71410d203ec1394641ad1cf9bf15300706e2748887c6863e7eba4b293a93f850a8b154278fc3cbab32d86b62a96fbccb5d7aa0e541fe5afd24b64e7
SSDEEP 1572864:3FfANSvsSwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhli:3tk
TLSH
T112188E9EE2D3609CD12BD4F0436AF773BA34787C11206E7A26D9DA306E22F80575AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptGenRandom CryptGetHashParam CryptGetProvParam CryptReleaseContext CryptSetHashParam CryptSetProvParam CryptSignHashA DeregisterEventSource GetUserNameA InitializeSecurityDescriptor RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl SystemFunction036

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

crypt32

CertCloseStore CertDeleteCertificateFromStore CertEnumCRLsInStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore CertOpenSystemStoreW PFXImportCertStore

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateFontW CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesW ExtTextOutW GetDIBColorTable GetDIBits GetDeviceCaps GetDeviceGammaRamp GetICMProfileW GetObjectA GetPixelFormat GetStockObject GetTextExtentPoint32A GetTextExtentPoint32W GetTextFaceW GetTextMetricsW Rectangle SelectObject SetBkMode SetDeviceGammaRamp SetPixelFormat SetTextColor SwapBuffers

imm32

ImmAssociateContext ImmGetCandidateListW ImmGetCompositionStringW ImmGetContext ImmGetIMEFileNameA ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionStringW ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses if_indextoname if_nametoindex

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CancelIo CancelIoEx CloseHandle CompareStringA ConvertFiberToThread ConvertThreadToFiberEx CreateDirectoryW CreateEventA CreateEventW CreateFiberEx CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateSemaphoreA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFiber DeviceIoControl DuplicateHandle EnterCriticalSection EnumResourceNamesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileTime GetFileType GetFinalPathNameByHandleA GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocaleInfoA GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetVersion GetWindowsDirectoryA GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSRWLock IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExA MoveFileExW MulDiv MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleTextAttribute SetDllDirectoryA SetEnvironmentVariableA SetErrorMode SetEvent SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadErrorMode SetThreadExecutionState SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableCS SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile UnregisterWait VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpiW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _access _access _aligned_free _aligned_malloc _aligned_realloc _amsg_exit _assert _beginthreadex _cexit _chmod _close _close _commode _dup _dup2 _endthreadex _environ _errno _exit _fdopen _filelengthi64 _fileno _findclose _fileno _findfirst64 _findnext64 _fmode _fstat64 _ftime64 _fullpath _get_osfhandle _getmaxstdio _getpid _gmtime64 _hypot _i64toa _initterm _isctype _isatty _itoa _localtime64 _lock _locking _lseeki64 _ltoa _mbsrchr _mkdir _mkdir _mktime64 _nextafter _onexit _open _open_osfhandle _open _read _rmdir _rmdir _setjmp _setmaxstdio _setmode _setmode _sopen _stat64 _strdup _strdup _stricmp _strlwr _strnicmp _strrev _strtoi64 _strtoui64 _strupr _strtoui64 _time64 _timezone _ui64toa _ultoa _unlink _unlink _unlock _vscprintf _vsnprintf _vsnwprintf _waccess _wcsicmp _wcsnicmp _wfindfirst64 _wfindnext64 _wfopen _wfullpath _wgetenv _wcsdup _wmkdir _wopen _wrename _write _wrmdir _wsopen _wstat64 _wunlink abort acos asin atan atexit atof atoi bsearch calloc clock cosh div exit fclose feof ferror fflush fgetc fgetpos fgets fopen fopen_s fprintf fputc fputs fread free fseek fsetpos ftell fwrite getc getchar getenv getwc isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper iswctype _write isxdigit localeconv log10 longjmp malloc mbstowcs memchr memcmp memcpy memmove memset perror printf putc putwc qsort raise rand realloc rename rewind setlocale setvbuf signal sprintf srand sinh strcat strchr strcmp strcoll strcpy strcpy_s strcspn strerror strftime strlen strncat strncmp strncpy strncpy_s strpbrk strrchr strspn strstr strtok strtok_s strtol strtoul strxfrm tan tanh tolower toupper towlower towupper ungetc ungetwc vfprintf wcscat wcscmp wcscoll wcscpy wcscpy_s wcsftime wcslen wcsncmp wcsncpy wcsrchr wcsstr wcstombs wcstombs_s wcstoul wcsxfrm

ncrypt

NCryptDecrypt NCryptDeleteKey NCryptFreeObject NCryptGetProperty NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

ole32

CLSIDFromString CoCreateInstance CoGetMalloc CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateBindCtx OleLoadFromStream OleSaveToStream PropVariantClear StringFromGUID2

oleaut32

OleCreatePropertyFrame SysFreeString

setupapi

CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW SHGetFolderPathW SHGetSpecialFolderPathA ShellExecuteW

shlwapi

SHCreateStreamOnFileA

user32

AdjustWindowRectEx AttachThreadInput BeginPaint CallNextHookEx CallWindowProcW ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CopyIcon CopyImage CreateIconFromResource CreateIconIndirect CreateWindowExA CreateWindowExW DefWindowProcA DefWindowProcW DestroyCursor DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageA DispatchMessageW DrawIcon DrawTextW EmptyClipboard EndDialog EndPaint EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsW FillRect FindWindowW FlashWindowEx FrameRect GetAsyncKeyState GetClassInfoExW GetClientRect GetClipCursor GetClipboardData GetClipboardSequenceNumber GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDlgItem GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMessageExtraInfo GetMessageTime GetMessageW GetMonitorInfoW GetParent GetProcessWindowStation GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetUpdateRect GetUserObjectInformationW GetWindowLongPtrA GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IntersectRect InvalidateRect IsClipboardFormatAvailable IsIconic KillTimer LoadCursorA LoadCursorW LoadIconW MapVirtualKeyW MessageBoxA MessageBoxW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjects OpenClipboard PeekMessageA PeekMessageW PostMessageW PostThreadMessageW PtInRect RegisterClassExA RegisterClassExW RegisterClassW RegisterDeviceNotificationW RegisterRawInputDevices RegisterWindowMessageA ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageA SendMessageW SetActiveWindow SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetTimer SetWindowLongPtrA SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnhookWindowsHookEx UnregisterClassA UnregisterClassW UnregisterDeviceNotification ValidateRect

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

winmm

timeBeginPeriod timeEndPeriod waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInUnprepareHeader waveOutClose waveOutGetDevCapsW waveOutGetErrorTextW waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecvFrom WSAResetEvent WSASendTo WSASetLastError WSASocketA WSAStartup WSAStringToAddressA WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

FT_Activate_Size FT_Add_Default_Modules FT_Add_Module FT_Angle_Diff FT_Atan2 FT_Attach_File FT_Attach_Stream FT_Bitmap_Blend FT_Bitmap_Convert FT_Bitmap_Copy FT_Bitmap_Done FT_Bitmap_Embolden FT_Bitmap_Init FT_Bitmap_New FT_CeilFix FT_Cos FT_DivFix FT_Done_Face FT_Done_FreeType FT_Done_Glyph FT_Done_Library FT_Done_MM_Var FT_Done_Size FT_Error_String FT_Face_GetCharVariantIndex FT_Face_GetCharVariantIsDefault FT_Face_GetCharsOfVariant FT_Face_GetVariantSelectors FT_Face_GetVariantsOfChar FT_Face_Properties FT_FloorFix FT_Get_Advance FT_Get_Advances FT_Get_BDF_Charset_ID FT_Get_BDF_Property FT_Get_CMap_Format FT_Get_CMap_Language_ID FT_Get_Char_Index FT_Get_Charmap_Index FT_Get_Color_Glyph_ClipBox FT_Get_Color_Glyph_Layer FT_Get_Color_Glyph_Paint FT_Get_Colorline_Stops FT_Get_Default_Named_Instance FT_Get_First_Char FT_Get_Font_Format FT_Get_Glyph FT_Get_Glyph_Name FT_Get_Kerning FT_Get_MM_Blend_Coordinates FT_Get_MM_Var FT_Get_MM_WeightVector FT_Get_Module FT_Get_Multi_Master FT_Get_Name_Index FT_Get_Next_Char FT_Get_PS_Font_Info FT_Get_PS_Font_Private FT_Get_PS_Font_Value FT_Get_Paint FT_Get_Paint_Layers FT_Get_Postscript_Name FT_Get_Renderer FT_Get_Sfnt_LangTag FT_Get_Sfnt_Name FT_Get_Sfnt_Name_Count FT_Get_Sfnt_Table FT_Get_SubGlyph_Info FT_Get_Track_Kerning FT_Get_Transform FT_Get_TrueType_Engine_Type FT_Get_Var_Axis_Flags FT_Get_Var_Blend_Coordinates FT_Get_Var_Design_Coordinates FT_Get_X11_Font_Format FT_GlyphSlot_Own_Bitmap FT_Glyph_Copy FT_Glyph_Get_CBox FT_Glyph_Stroke FT_Glyph_StrokeBorder FT_Glyph_To_Bitmap FT_Glyph_Transform FT_Has_PS_Glyph_Names FT_Init_FreeType FT_Library_SetLcdFilter FT_Library_SetLcdFilterWeights FT_Library_SetLcdGeometry FT_Library_Version FT_List_Add FT_List_Finalize FT_List_Find FT_List_Insert FT_List_Iterate FT_List_Remove FT_List_Up FT_Load_Char FT_Load_Glyph FT_Load_Sfnt_Table FT_Matrix_Invert FT_Matrix_Multiply FT_MulDiv FT_MulFix FT_New_Face FT_New_Glyph FT_New_Library FT_New_Memory_Face FT_New_Size FT_Open_Face FT_Outline_Check FT_Outline_Copy FT_Outline_Decompose FT_Outline_Done FT_Outline_Embolden FT_Outline_EmboldenXY FT_Outline_GetInsideBorder FT_Outline_GetOutsideBorder FT_Outline_Get_Bitmap FT_Outline_Get_CBox FT_Outline_Get_Orientation FT_Outline_New FT_Outline_Render FT_Outline_Reverse FT_Outline_Transform FT_Outline_Translate FT_Palette_Data_Get FT_Palette_Select FT_Palette_Set_Foreground_Color FT_Property_Get FT_Property_Set FT_Reference_Face FT_Reference_Library FT_Remove_Module FT_Render_Glyph FT_Request_Size FT_RoundFix FT_Select_Charmap FT_Select_Size FT_Set_Char_Size FT_Set_Charmap FT_Set_Debug_Hook FT_Set_Default_Log_Handler FT_Set_Default_Properties FT_Set_Log_Handler FT_Set_MM_Blend_Coordinates FT_Set_MM_Design_Coordinates FT_Set_MM_WeightVector FT_Set_Named_Instance FT_Set_Pixel_Sizes FT_Set_Renderer FT_Set_Transform FT_Set_Var_Blend_Coordinates FT_Set_Var_Design_Coordinates FT_Sfnt_Table_Info FT_Sin FT_Stream_OpenBzip2 FT_Stream_OpenLZW FT_Stroker_BeginSubPath FT_Stroker_ConicTo FT_Stroker_CubicTo FT_Stroker_Done FT_Stroker_EndSubPath FT_Stroker_Export FT_Stroker_ExportBorder FT_Stroker_GetBorderCounts FT_Stroker_GetCounts FT_Stroker_LineTo FT_Stroker_New FT_Stroker_ParseOutline FT_Stroker_Rewind FT_Stroker_Set FT_Tan FT_Trace_Set_Default_Level FT_Trace_Set_Level FT_Vector_From_Polar FT_Vector_Length FT_Vector_Polarize FT_Vector_Rotate FT_Vector_Transform FT_Vector_Unit TT_New_Context TT_RunIns gme_ay_type gme_clear_playlist gme_delete gme_enable_accuracy gme_equalizer gme_free_info gme_gbs_type gme_gym_type gme_hes_type gme_identify_extension gme_identify_file gme_identify_header gme_ignore_silence gme_kss_type gme_load_custom gme_load_data gme_load_file gme_multi_channel gme_mute_voice gme_mute_voices gme_new_emu gme_new_emu_multi_channel gme_nsf_type gme_nsfe_type gme_open_data gme_open_file gme_play gme_sap_type gme_seek gme_seek_samples gme_set_autoload_playback_limit gme_set_equalizer gme_set_fade gme_set_stereo_depth gme_set_tempo gme_set_user_cleanup gme_set_user_data gme_spc_type gme_start_track gme_tell gme_tell_samples gme_track_count gme_track_ended gme_track_info gme_type gme_type_extension gme_type_list gme_type_multitrack gme_type_system gme_user_data gme_vgm_type gme_vgz_type gme_voice_count gme_voice_name gme_warning gme_wrong_file_type

Name

.text

Size

67.9MB

Virtual Size

67.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

940KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

24.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

271KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ffplay.exe

advapi32

bcrypt

crypt32

gdi32

imm32

iphlpapi

kernel32

msvcrt

ncrypt

ole32

oleaut32

setupapi

shell32

shlwapi

user32

version

avicap32

winmm

ws2_32

generic