| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Aug-16 14:01:05 |
| Detected languages |
English - United States
|
| CompanyName | Spotify AB |
| FileDescription | Spotify Music Player |
| FileVersion | 1.70.368.0 |
| InternalName | Spotify.exe |
| LegalCopyright | Copyright (C) 2023 Spotify AB |
| OriginalFilename | Spotify.exe |
| ProductName | Spotify |
| ProductVersion | 1.70.368.0 |
| Comments | Music streaming application |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2025-Aug-16 14:01:05 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1a200 |
| SizeOfInitializedData | 0x10c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000009FCC (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x31000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| bcrypt.dll |
BCryptOpenAlgorithmProvider
BCryptGenRandom BCryptCloseAlgorithmProvider |
|---|---|
| KERNEL32.dll |
SetUnhandledExceptionFilter
WriteConsoleW CreateFileW HeapReAlloc Sleep CloseHandle GetCurrentProcessId HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA |
| USER32.dll |
DefWindowProcW
CreateWindowExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW RegisterClassW SetLayeredWindowAttributes TranslateMessage GetDesktopWindow PostQuitMessage GetClientRect |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.70.368.0 |
| ProductVersion | 1.70.368.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Spotify AB |
| FileDescription | Spotify Music Player |
| FileVersion (#2) | 1.70.368.0 |
| InternalName | Spotify.exe |
| LegalCopyright | Copyright (C) 2023 Spotify AB |
| OriginalFilename | Spotify.exe |
| ProductName | Spotify |
| ProductVersion (#2) | 1.70.368.0 |
| Comments | Music streaming application |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Aug-16 14:01:05 |
| Version | 0.0 |
| SizeofData | 1048 |
| AddressOfRawData | 0x24ae8 |
| PointerToRawData | 0x230e8 |
| StartAddressOfRawData | 0x140024f48 |
|---|---|
| EndAddressOfRawData | 0x140024f50 |
| AddressOfIndex | 0x140029658 |
| AddressOfCallbacks | 0x14001c3a0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140028040 |
| XOR Key | 0x8de52ff5 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33140) | 147 |
| C objects (33140) | 13 |
| ASM objects (33140) | 6 |
| Unmarked objects (#2) | 2 |
| C objects (VS 2015-2022 runtime 33030) | 17 |
| ASM objects (VS 2015-2022 runtime 33030) | 17 |
| C++ objects (VS 2015-2022 runtime 33030) | 57 |
| Imports (33140) | 9 |
| Total imports | 153 |
| C++ objects (LTCG) (33145) | 4 |
| Resource objects (33145) | 1 |
| 151 | 1 |
| Linker (33145) | 1 |
No comments yet.