Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2024-Mar-29 17:25:43 |
Detected languages |
English - United States
|
TLS Callbacks | 1 callback(s) detected. |
Debug artifacts |
C:\ci\gitlab\builds\openfin\rvm\rvm\openfinrvm\Release-Production\OpenFinRVM.pdb
|
CompanyName | OpenFin Inc. |
FileDescription | OpenFin RVM |
FileVersion | 13.0.1.2 |
InternalName | OpenFinRVM.exe |
LegalCopyright | Copyright (C) 2019 |
OriginalFilename | OpenFinRVM.exe |
ProductName | RVM |
ProductVersion | 13.0.1.2 |
Info | Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0 |
Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses known Mersenne Twister constants Microsoft's Cryptography API |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Info | The PE is digitally signed. |
Signer: OpenFin Inc.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x118 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 6 |
TimeDateStamp | 2024-Mar-29 17:25:43 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Magic | PE32 |
---|---|
LinkerVersion | 12.0 |
SizeOfCode | 0x349800 |
SizeOfInitializedData | 0x275a00 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x00269D90 (Section: .text) |
BaseOfCode | 0x1000 |
BaseOfData | 0x34b000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 6.0 |
ImageVersion | 0.0 |
SubsystemVersion | 6.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x5c4000 |
SizeOfHeaders | 0x400 |
Checksum | 0x5bdcaa |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
KERNEL32.dll |
QueryPerformanceFrequency
K32GetModuleFileNameExW ReadProcessMemory GetExitCodeProcess GlobalLock GlobalAlloc GlobalUnlock GlobalFree ConnectNamedPipe CreateNamedPipeW CreateMutexW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection LocalFree GetLastError GetSystemTimeAsFileTime GetFileAttributesW GetEnvironmentVariableA GetModuleHandleW LoadLibraryW RaiseException GetProcAddress LocalAlloc DecodePointer DuplicateHandle ExpandEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar FormatMessageW lstrlenW K32GetProcessImageFileNameW OpenProcess LoadLibraryA GetFileTime GetShortPathNameW Sleep GetModuleFileNameW SetFilePointer SystemTimeToFileTime SetFileTime WriteFile ReadFile GetCurrentDirectoryW LocalFileTimeToFileTime GetFileSize UnmapViewOfFile GetTickCount FileTimeToSystemTime GetFileInformationByHandle QueryPerformanceCounter SystemTimeToTzSpecificLocalTime GetProcessTimes FindResourceW LoadResource SizeofResource LockResource CreateProcessW WaitForSingleObject CreateEventW WaitForMultipleObjects Process32FirstW Process32NextW CreateToolhelp32Snapshot GetProcessId SetHandleInformation CreatePipe TerminateProcess K32EnumProcesses MulDiv GetStringTypeW GetCurrentThread GetExitCodeThread EncodePointer GetModuleHandleA ReleaseMutex ReleaseSemaphore TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA RtlUnwind GetCommandLineW IsProcessorFeaturePresent GetCPInfo IsDebuggerPresent CreateTimerQueue InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait HeapReAlloc ExitThread LoadLibraryExW UnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetStartupInfoW CreateSemaphoreW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize IsValidCodePage GetACP GetOEMCP GetStdHandle GetFileType GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode OutputDebugStringW GetThreadTimes FreeLibrary FreeLibraryAndExitThread InitializeSListHead UnregisterWaitEx GetVersionExW VirtualAlloc VirtualFree VirtualProtect ReadConsoleW SetStdHandle WriteConsoleW SetEnvironmentVariableW SetEndOfFile SetEnvironmentVariableA GetEnvironmentVariableW SetCurrentDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesExW RemoveDirectoryW SetFileAttributesW DeviceIoControl GetWindowsDirectoryW CreateDirectoryExW CopyFileW MoveFileExW GetLongPathNameW GetStringTypeExW GetCurrentThreadId GetLocalTime GetTempPathW InitializeCriticalSectionEx CreateFileW CreateDirectoryW GetCurrentProcess SetUnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap ResetEvent SetEvent GetCurrentProcessId WaitForSingleObjectEx CloseHandle OpenEventA CreateEventA |
---|---|
USER32.dll |
SetWindowTextW
EnableWindow SetDlgItemTextW SetWindowPos SendDlgItemMessageW EndDialog GetDlgItem GetClientRect DialogBoxParamW ScreenToClient IsWindowVisible GetSysColorBrush ShowWindow GetWindowTextW EnumWindows PostThreadMessageW MonitorFromRect SendMessageW FlashWindowEx WaitForInputIdle PostMessageW ReplyMessage SendMessageTimeoutW InSendMessage LoadImageW PostQuitMessage SetForegroundWindow FindWindowW wsprintfW GetDesktopWindow UpdateLayeredWindow RegisterWindowMessageW RegisterClassExW GetWindowLongW SetWindowLongW IsWindow CreateWindowExW DefWindowProcW UnregisterClassW SetTimer KillTimer GetMessageW TranslateMessage DispatchMessageW MessageBoxW GetWindowRect LoadStringW SetCursor MonitorFromPoint SetCapture GetDC GetCapture LoadIconW TrackMouseEvent LoadCursorW GetCursorPos GetWindowPlacement GetMonitorInfoW SetClassLongW ReleaseDC ReleaseCapture DestroyWindow |
dbghelp.dll |
MiniDumpWriteDump
|
SHLWAPI.dll |
PathFileExistsW
PathCreateFromUrlW UrlCreateFromPathW PathIsRelativeW SHStrDupW |
CRYPT32.dll |
CryptMsgClose
CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam |
WININET.dll |
InternetCloseHandle
InternetErrorDlg InternetGetLastResponseInfoW InternetGetConnectedState InternetCrackUrlW InternetOpenW InternetQueryOptionW InternetQueryDataAvailable InternetReadFile InternetConnectW HttpSendRequestW InternetSetOptionW InternetSetStatusCallbackW HttpQueryInfoW HttpOpenRequestW |
VERSION.dll |
GetFileVersionInfoSizeW
VerQueryValueW GetFileVersionInfoW |
COMCTL32.dll |
#17
#345 |
GDI32.dll |
SelectObject
RemoveFontResourceW AddFontResourceW CreateFontIndirectW GetDeviceCaps SetTextColor SetBkMode DeleteDC CreateDIBSection DeleteObject CreateCompatibleDC |
ADVAPI32.dll |
RegDeleteKeyW
CryptAcquireContextW CryptGenRandom CryptAcquireContextA CryptReleaseContext RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW OpenProcessToken GetSidSubAuthority GetUserNameW GetSidSubAuthorityCount GetTokenInformation LookupAccountNameW ConvertSidToStringSidW RegCreateKeyExW RegQueryValueExW RegQueryInfoKeyW RegGetValueW RegDeleteTreeW RegDeleteKeyExW RegDeleteValueW |
SHELL32.dll |
SHGetPropertyStoreForWindow
SHGetFolderPathW ShellExecuteW Shell_NotifyIconW CommandLineToArgvW |
ole32.dll |
CoCreateInstance
CoUninitialize CoInitialize CreateStreamOnHGlobal CoTaskMemFree |
urlmon.dll |
IsValidURL
|
gdiplus.dll |
GdipDrawCachedBitmap
GdipFillRectangleI GdipCloneImage GdipCreateStringFormat GdipCreatePath GdipCreatePen1 GdipDeleteStringFormat GdipAddPathPieI GdipDrawRectangleI GdipSetLineBlend GdipSetPathGradientCenterPointI GdipGetImageHeight GdipGetImageWidth GdipMeasureString GdipCreateFromHDC GdipDeleteGraphics GdipCreateFontFamilyFromName GdipResetClip GdipDrawString GdipGetGenericFontFamilySansSerif GdipDeleteRegion GdipDeletePath GdipCreateRegionPath GdipCreateCachedBitmap GdipCreateBitmapFromFile GdipDisposeImage GdipAlloc GdipCreateSolidFill GdipDeleteFont GdipSetPathGradientPresetBlend GdipCreateLineBrushFromRectI GdipDeletePen GdipSetClipRegion GdipFree GdipDeleteBrush GdipDeleteCachedBitmap GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipResetPath GdipClosePathFigure GdipDeleteFontFamily GdipSetSmoothingMode GdipGraphicsClear GdipDrawImageRectI GdipGetImageGraphicsContext GdipCreateFont GdipFillPath GdipCreatePathGradientFromPath GdipCreateBitmapFromScan0 GdipCloneBrush GdipAddPathArcI |
OpenFinRVM |
OPENFINRVM |
Set file location for auto-download |
Download remote files |
Launch external processes |
Read from the registry |
End external processes |
Get information about other apps' windows |
Get information about another app's window |
Access system audio |
Read the clipboard |
Write to the clipboard |
Play videos |
Access location data |
Send system notifications |
Use hardware-specific audio functions |
Modify how the mouse works |
Run in full screen mode |
Open links in external applications |
Save and restore external application windows |
Open the default web browser |
Write to the clipboard |
View file location for auto-download |
Set file download location |
Register custom protocol handlers |
Unregister custom protocol handlers |
View custom protocol handlers |
Access USB devices |
Access human interface devices (HID) |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 13.0.1.2 |
ProductVersion | 13.0.1.2 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | English - United States |
CompanyName | OpenFin Inc. |
FileDescription | OpenFin RVM |
FileVersion (#2) | 13.0.1.2 |
InternalName | OpenFinRVM.exe |
LegalCopyright | Copyright (C) 2019 |
OriginalFilename | OpenFinRVM.exe |
ProductName | RVM |
ProductVersion (#2) | 13.0.1.2 |
Resource LangID | English - United States |
---|
Characteristics |
0
|
---|---|
TimeDateStamp | 2024-Mar-29 17:25:43 |
Version | 0.0 |
SizeofData | 105 |
AddressOfRawData | 0x3c92b8 |
PointerToRawData | 0x3c7eb8 |
Referenced File | C:\ci\gitlab\builds\openfin\rvm\rvm\openfinrvm\Release-Production\OpenFinRVM.pdb |
Characteristics |
0
|
---|---|
TimeDateStamp | 2024-Mar-29 17:25:43 |
Version | 0.0 |
SizeofData | 20 |
AddressOfRawData | 0x3c9324 |
PointerToRawData | 0x3c7f24 |
StartAddressOfRawData | 0x85a000 |
---|---|
EndAddressOfRawData | 0x85a001 |
AddressOfIndex | 0x852d14 |
AddressOfCallbacks | 0x74ca24 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_ALIGN_1BYTES
|
Callbacks |
0x00665D60
|
Size | 0x48 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x829768 |
SEHandlerTable | 0x7dbde0 |
SEHandlerCount | 3252 |
XOR Key | 0x7142ece7 |
---|---|
Unmarked objects | 0 |
C++ objects (20806) | 2 |
ASM objects (VS2013 build 21005) | 46 |
C++ objects (VS2013 build 21005) | 146 |
C objects (VS2013 build 21005) | 258 |
C++ objects (VS2013 UPD5 build 40629) | 35 |
209 (65501) | 1 |
C objects (65501) | 2 |
208 (65501) | 1 |
Imports (65501) | 29 |
Total imports | 411 |
C++ objects (VS2013 UPD4 build 31101) | 29 |
229 (VS2013 UPD5 build 40629) | 295 |
Resource objects (VS2013 build 21005) | 1 |
151 | 1 |
Linker (VS2013 UPD5 build 40629) | 1 |