| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2025-Apr-15 14:03:27 |
| Debug artifacts |
ffmpeg.dll.pdb
|
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for VMWare presence:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA1
Uses constants related to SHA256 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .gxfg
Unusual section name found: .retplne |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/66 (Scanned on 2026-04-27 21:27:16) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 9 |
| TimeDateStamp | 2025-Apr-15 14:03:27 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x23f200 |
| SizeOfInitializedData | 0x8b400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000098F00 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | A.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | A.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3ad000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
AcquireSRWLockExclusive
CloseHandle CompareStringW CreateFileW CreateThread DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeSListHead InitializeSRWLock InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile |
|---|
| Ordinal | 1 |
|---|---|
| Address | 0x5abe0 |
| Ordinal | 2 |
|---|---|
| Address | 0x5ad40 |
| Ordinal | 3 |
|---|---|
| Address | 0x110ed0 |
| Ordinal | 4 |
|---|---|
| Address | 0x5ba60 |
| Ordinal | 5 |
|---|---|
| Address | 0x5b5b0 |
| Ordinal | 6 |
|---|---|
| Address | 0x5b750 |
| Ordinal | 7 |
|---|---|
| Address | 0x100e70 |
| Ordinal | 8 |
|---|---|
| Address | 0x5ef00 |
| Ordinal | 9 |
|---|---|
| Address | 0x112b00 |
| Ordinal | 10 |
|---|---|
| Address | 0x5efa0 |
| Ordinal | 11 |
|---|---|
| Address | 0x5efd0 |
| Ordinal | 12 |
|---|---|
| Address | 0x5fa60 |
| Ordinal | 13 |
|---|---|
| Address | 0x1179c0 |
| Ordinal | 14 |
|---|---|
| Address | 0x5a310 |
| Ordinal | 15 |
|---|---|
| Address | 0x1018e0 |
| Ordinal | 16 |
|---|---|
| Address | 0x45b10 |
| Ordinal | 17 |
|---|---|
| Address | 0x5f370 |
| Ordinal | 18 |
|---|---|
| Address | 0x5f990 |
| Ordinal | 19 |
|---|---|
| Address | 0x5f980 |
| Ordinal | 20 |
|---|---|
| Address | 0x45d40 |
| Ordinal | 21 |
|---|---|
| Address | 0x45b60 |
| Ordinal | 22 |
|---|---|
| Address | 0x460f0 |
| Ordinal | 23 |
|---|---|
| Address | 0x45bc0 |
| Ordinal | 24 |
|---|---|
| Address | 0x8a6f0 |
| Ordinal | 25 |
|---|---|
| Address | 0x45c90 |
| Ordinal | 26 |
|---|---|
| Address | 0x49db0 |
| Ordinal | 27 |
|---|---|
| Address | 0x5f610 |
| Ordinal | 28 |
|---|---|
| Address | 0x61730 |
| Ordinal | 29 |
|---|---|
| Address | 0xfe200 |
| Ordinal | 30 |
|---|---|
| Address | 0x5fc50 |
| Ordinal | 31 |
|---|---|
| Address | 0x477f0 |
| Ordinal | 32 |
|---|---|
| Address | 0xe4bc0 |
| Ordinal | 33 |
|---|---|
| Address | 0x5bb70 |
| Ordinal | 34 |
|---|---|
| Address | 0xdc190 |
| Ordinal | 35 |
|---|---|
| Address | 0x458d0 |
| Ordinal | 36 |
|---|---|
| Address | 0x42970 |
| Ordinal | 37 |
|---|---|
| Address | 0xd0850 |
| Ordinal | 38 |
|---|---|
| Address | 0x41c10 |
| Ordinal | 39 |
|---|---|
| Address | 0xcfb30 |
| Ordinal | 40 |
|---|---|
| Address | 0x45a80 |
| Ordinal | 41 |
|---|---|
| Address | 0xdc250 |
| Ordinal | 42 |
|---|---|
| Address | 0x41d20 |
| Ordinal | 43 |
|---|---|
| Address | 0x42fa0 |
| Ordinal | 44 |
|---|---|
| Address | 0x42320 |
| Ordinal | 45 |
|---|---|
| Address | 0x43410 |
| Ordinal | 46 |
|---|---|
| Address | 0x474c0 |
| Ordinal | 47 |
|---|---|
| Address | 0x49650 |
| Ordinal | 48 |
|---|---|
| Address | 0x4af70 |
| Ordinal | 49 |
|---|---|
| Address | 0x47b20 |
| Ordinal | 50 |
|---|---|
| Address | 0x49080 |
| Ordinal | 51 |
|---|---|
| Address | 0x481e0 |
| Ordinal | 52 |
|---|---|
| Address | 0x48110 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Apr-15 14:03:27 |
| Version | 0.0 |
| SizeofData | 39 |
| AddressOfRawData | 0x2aca38 |
| PointerToRawData | 0x2ab038 |
| Referenced File | ffmpeg.dll.pdb |
| StartAddressOfRawData | 0x1803a7000 |
|---|---|
| EndAddressOfRawData | 0x1803a7008 |
| AddressOfIndex | 0x1802bc0f0 |
| AddressOfCallbacks | 0x1802af0b8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1802ba040 |
| GuardCFCheckFunctionPointer | 6445264920 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
No comments yet.