609fb47b5292def2afdf4b8a378fe278a4cb35f2f378f305556c7dbd0b77af54

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2023-Jun-21 12:38:28
Detected languages English - United States
Debug artifacts C:\workspace\Build\msvc\x64\__bin\Release\intel_gfx_api-x64_full.pdb
CompanyName Intel Corporation
FileDescription Intel® Media SDK API factory
FileVersion 23.06.21.8762a262
InternalName intel_gfx_api
LegalCopyright Copyright© 2003-2014 Intel Corporation
LegalTrademarks Intel Corporation
ProductName Intel® Media SDK
ProductVersion 21.0.1.35

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegEnumKeyExW
  • RegOpenKeyExW
  • RegEnumValueW
  • RegQueryValueExW
  • RegCloseKey
  • RegGetValueW
  • RegQueryInfoKeyW
Info The PE is digitally signed. Signer: Intel Corporation
Issuer: Sectigo Public Code Signing CA R36
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 805f0fd1abc8da4ac03da203ca3d615c 🔍
SHA1 285a9afa2b4efad0f93ef46894ee6cc53ab688a6 🔍
SHA256 609fb47b5292def2afdf4b8a378fe278a4cb35f2f378f305556c7dbd0b77af54 🔍
SHA3 58c99fe69444ebe0994ae056b6ead02071dbfe79055fc8b4ab4d707e597136cb 🔍
SSDeep 12288:8USqQqN0ajvM6W+1MBbkQ5h8lRVWwVHV3M3:8pJqN0QMCMBbz38lvWwVHV3e 🔍
Imports Hash 602536a1190a2ac986069102eff8e2c9 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2023-Jun-21 12:38:28
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x6a800
SizeOfInitializedData 0x1fe00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000009630 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.2
ImageVersion 0.0
SubsystemVersion 6.2
Win32VersionValue 0
SizeOfImage 0x8f000
SizeOfHeaders 0x400
Checksum 0xa283d
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0292193791ee9b406e408c5790a2543a 🔍
SHA1 f6425764952b00a0f78cecbc2a6ac386b261129a 🔍
SHA256 d98cf0a12f1ab2699b70d8ee0a42ec184d99324c84c2286b4b353783aba9d20f 🔍
SHA3 77dd618d1cbe3673ce3293bae0a648354ea896cfd50f6e4a5d2bdb226d357b36 🔍
VirtualSize 0x6a800
VirtualAddress 0x1000
SizeOfRawData 0x6a800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48015

.rdata

MD5 1ae3cd90672bec36c9681f81bf3e69ae 🔍
SHA1 82ed655200743892d279b4784af46bf851fc1ac9 🔍
SHA256 f8715c6fae508fc28a37bdbe9fe0bc0088fda4306593fc35f3046cf9f07d32e2 🔍
SHA3 d80ead6bd86c998ef1a72c55a1397ef2551123604475f780ea3e4ac53d1fdcc9 🔍
VirtualSize 0x1661e
VirtualAddress 0x6c000
SizeOfRawData 0x16800
PointerToRawData 0x6ac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.21136

.data

MD5 ff55fe90fb5f971666512e189c1a9ad2 🔍
SHA1 63c01c50485fb7acb889c35299dbbb6a1c56dc7e 🔍
SHA256 5bf0b2b842ac4850e86dc7c499597c7285c77d7c0c255f06ab011c676c45e0d0 🔍
SHA3 b7167ea175cce6940216d77818a997291d7ea3dd43ace552d7afc2ba4ec14480 🔍
VirtualSize 0x2950
VirtualAddress 0x83000
SizeOfRawData 0x1000
PointerToRawData 0x81400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.85663

.pdata

MD5 666c41f2f26a4ccbf041d302ed1118e9 🔍
SHA1 d51ef1bbd7ffd4f5ee954486ccfb1981cdc2e2f3 🔍
SHA256 ab7ac71e879c666e8a4c8f37bfc8bbc8db15ac423cae96ad23997d410694305f 🔍
SHA3 2ef97c7be2534294189a46284786f646ce3df23867cbdeab3555b9efe804a74f 🔍
VirtualSize 0x5b74
VirtualAddress 0x86000
SizeOfRawData 0x5c00
PointerToRawData 0x82400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.85851

_RDATA

MD5 dc37c5da953a5bd7599be170392ef2fa 🔍
SHA1 bb1fe3c733d14e45c69575f9517f34dd4129e2d1 🔍
SHA256 9939ce2b9c7620da001f0fa617f9d6b7ff332f5fb05a6c2e19ea60e4c2b03fab 🔍
SHA3 72901e329facf15d2c91b6516d4e60d6905235887761d577393db67616c04af2 🔍
VirtualSize 0x100
VirtualAddress 0x8c000
SizeOfRawData 0x200
PointerToRawData 0x88000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.9723

.rsrc

MD5 be0688435b1645b4f74d9e31a799f48c 🔍
SHA1 fa500fb230bf9f90dbfd110b18a6b9602b3f0298 🔍
SHA256 eea9d61126ae6ed7aea5334707908a648d35d3523618cda16b2c3a5366e0f5d8 🔍
SHA3 882cd98a49ac9ce066ab1e30011ba216f7e63165c3c32c02ff5616cbf23eae78 🔍
VirtualSize 0x3a0
VirtualAddress 0x8d000
SizeOfRawData 0x400
PointerToRawData 0x88200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.11262

.reloc

MD5 76e6ac5e9bc06319757e8c8fef53c53c 🔍
SHA1 1ce11d2ea4f2489983fb28e996909a8cf23c80c4 🔍
SHA256 9dec1720c804422677c1076e5abd7183bd2a6e3c7dace02173f53e36e8af6f0a 🔍
SHA3 37ae0eb0d7ba18aa9047c98e27d5a8829c229a89a944235e29b1bd82296a9708 🔍
VirtualSize 0x960
VirtualAddress 0x8e000
SizeOfRawData 0xa00
PointerToRawData 0x88600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.29789

Imports

KERNEL32.dll FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleW
GetLastError
OutputDebugStringA
WriteConsoleW
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
GetProcAddress
SwitchToThread
GetFileAttributesW
MultiByteToWideChar
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
HeapFree
HeapAlloc
GetCurrentThread
GetStdHandle
GetFileType
CloseHandle
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
SetConsoleCtrlHandler
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
CreateFileW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
SetEndOfFile
ReadFile
ReadConsoleW
OutputDebugStringW
RtlUnwind
ADVAPI32.dll RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegQueryInfoKeyW

Delayed Imports

DisposeMediaSession

Ordinal 1
Address 0x8c20

InitialiseMediaSession

Ordinal 2
Address 0x8b50

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x340
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.48611
MD5 b0fd3082d33dc30be711f15b63efd6d1 🔍
SHA1 e3ffc560532a0b3054ff86d0875d39100cff1b4d 🔍
SHA256 515888bd2d06c708c8e436daad5bd2916fd5852b8e2f1917b8c972c9bd8a491a 🔍
SHA3 80136f78852f41ce3aa3b078358a2c0654616035a15a8a2c55fe77a5ef65e792 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 23.6.21.536
ProductVersion 21.0.1.35
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
CompanyName Intel Corporation
FileDescription Intel® Media SDK API factory
FileVersion (#2) 23.06.21.8762a262
InternalName intel_gfx_api
LegalCopyright Copyright© 2003-2014 Intel Corporation
LegalTrademarks Intel Corporation
ProductName Intel® Media SDK
ProductVersion (#2) 21.0.1.35
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2023-Jun-21 12:38:28
Version 0.0
SizeofData 93
AddressOfRawData 0x79edc
PointerToRawData 0x78adc
Referenced File C:\workspace\Build\msvc\x64\__bin\Release\intel_gfx_api-x64_full.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2023-Jun-21 12:38:28
Version 0.0
SizeofData 20
AddressOfRawData 0x79f3c
PointerToRawData 0x78b3c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2023-Jun-21 12:38:28
Version 0.0
SizeofData 816
AddressOfRawData 0x79f50
PointerToRawData 0x78b50

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2023-Jun-21 12:38:28
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180083008
GuardCFCheckFunctionPointer 6442894096
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x14351fdc
Unmarked objects 0
ASM objects (VS2017 v14.15 compiler 26715) 5
C++ objects (VS2017 v14.15 compiler 26715) 149
C++ objects (VS 2015/2017/2019 runtime 29118) 38
C objects (VS 2015/2017/2019 runtime 29118) 16
ASM objects (VS 2015/2017/2019 runtime 29118) 9
C objects (VS2017 v14.15 compiler 26715) 11
Imports (VS2017 v14.15 compiler 26715) 5
Total imports 96
C++ objects (LTCG) (VS2019 Update 8 (16.8.0-1) compiler 29333) 14
Exports (VS2019 Update 8 (16.8.0-1) compiler 29333) 1
Resource objects (VS2019 Update 8 (16.8.0-1) compiler 29333) 1
Linker (VS2019 Update 8 (16.8.0-1) compiler 29333) 1

Errors

Leave a comment

No comments yet.