The Serum2 vst3 (Serum 2 VST3 Plug In) Xfer Records File Malware Analysis

The Serum2.vst3 (Serum 2 VST3 Plug-In) File Analysis

Updated 1 month ago

Checked by Malware Check

Serum2.vst3

Hash Type	Value	Action
MD5	f89a68c86df12d78fa7a4898b504e974
SHA1	9c2dff356909cca75850b7f83745872a31e38020
SHA256	a2c061ad71ef740763399dff2bae80784a0a3c138a9541ac718aaf96aa0436e4
SHA512	b045e39ca65532adf3102f7e21ef129016440a77d10a626d7add6639ae14b7d2cea21445e7261fd532dd24d3edebd130e93c4f84896bd339145db1e93f96cf01
ImpHash	765313a30307c108b6e527f72eac001d

Hash Type

Value

Action

MD5

f89a68c86df12d78fa7a4898b504e974

SHA1

9c2dff356909cca75850b7f83745872a31e38020

SHA256

a2c061ad71ef740763399dff2bae80784a0a3c138a9541ac718aaf96aa0436e4

SHA512

b045e39ca65532adf3102f7e21ef129016440a77d10a626d7add6639ae14b7d2cea21445e7261fd532dd24d3edebd130e93c4f84896bd339145db1e93f96cf01

ImpHash

765313a30307c108b6e527f72eac001d

PE Analysis

Basic Information

▼

Image Base	`0x180000000`
Entry Point	`0x180988c60`
Compilation Time	2025-08-07 10:12:37
Checksum	0x00000000 (Actual: 0x0120cad7)
OS Version	6.0
PEiD Signatures	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
PDB Path	`C:\actions-runner\_work\Serum2\Serum2\win\x64\Release\Serum2.vst3\Contents\x86_64-win\Serum2.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	13 libraries
Exports	3 functions
Resources	3 Resources
Sections	10 Sections

Version Information

▼

CompanyName	Xfer Records
FileDescription	Serum 2 VST3 Plug-In
FileVersion	2.0.21
InternalName	Serum2
LegalCopyright	Xfer Records
OriginalFilename	Serum2.vst3
ProductName	Serum 2
ProductVersion	2.0.21
Translation	0x0409 0x04e4

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	10,324,646 bytes	10,324,992 bytes	6.44 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`6DE21DEBEC366E054ADAFECF4656B4CE`
`.rdata`	`0x009da000`	7,292,028 bytes	7,292,416 bytes	7.47 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1D024AD528BEA10964F4D0891734FCB9`
`.data`	`0x010cf000`	16,256,964 bytes	622,592 bytes	5.26 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`53C39AF5BCBD2F2468B1141800082FCF`
`.pdata`	`0x02050000`	392,436 bytes	392,704 bytes	6.63 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`51AD22A176ECF39FE58DB30B0E77EB07`
`.fptable`	`0x020b0000`	256 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.retplne`	`0x020b1000`	232 bytes	512 bytes	1.75 (Normal)	`0x00000000`	`9C7632480490ABD981F5BB1AE80CE834`
`.tls`	`0x020b2000`	37 bytes	512 bytes	0.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`60720AE4E3584C2F8FF87A0DF634444D`
`_RDATA`	`0x020b3000`	500 bytes	512 bytes	4.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9748C4710595C8C668ED6C45E82D444C`
`.rsrc`	`0x020b4000`	124,776 bytes	124,928 bytes	7.99 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F7FF07C9F34C41226E7EC11BCD9FB060`
`.reloc`	`0x020d3000`	112,740 bytes	113,152 bytes	5.45 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`B43B19FABAB49032F4C0523E0985BC5F`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 3 (124,497 bytes)

Resource Type	Count	Total Size	Percentage
DATA	1	123,486 bytes	99.2%
RT_VERSION	1	688 bytes	0.6%
RT_MANIFEST	1	323 bytes	0.3%

Certificate Chain Analysis

▼

Certificate Information

Product	Serum 2
Description	Serum 2 VST3 Plug-In
File Version	2.0.21
Original Name	Serum2.vst3
Internal Name	Serum2
Copyright	Xfer Records

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	Serum2.vst3
File Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Scanner Version	1.0.230.174
Database Version	2025-12-05 18:00:16 UTC

The Serum2.vst3 (Serum 2 VST3 Plug-In) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification