The AuroraSDKStudio dll File Malware Analysis

Technical Analysis

File Name	AuroraSDKStudio.dll
File Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
Scanner Version	1.0.221.174
Database Version	2025-07-25 14:00:29 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	4b13dadd0bb7bf532ad08c5d150c0e9d
SHA1	6ec8de7ce3fdb6649e3b446d079671f95e38e57a
SHA256	bfab7656840e39bf177f86aef751bf914daac231e79939d37efe7d1b549e1aef
SHA512	e3e4c26f7e2924bbd60f6b2a889e7139d45cf3b7898af4e96a189410c8d62924fa95f205f5a8433123f0a4f18f7079e04ab8f566d81905ffe924a8936b02a232
ImpHash	6ed8c8ab9dcd2bca2857407942a244d8

PE Analysis

Basic Information

▼

Image Base	`0x180000000`
Entry Point	`0x180d1aca4`
Compilation Time	2022-11-22 09:20:38
Checksum	0x00000000 (Actual: 0x01334fcf)
OS Version	6.0
PEiD Signatures	`PE32+ executable (DLL) (console) x86-64, for MS Windows`
PDB Path	`E:\gitlab-runner\builds\xjPHrH7B\0\multi-media\aurorastudio\package_release\output\AuroraSDKStudio.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	20 libraries
Exports	80 functions
Resources	1 Resources
Sections	11 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	14,177,738 bytes	14,177,792 bytes	6.52 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CD21BEBE16807C97A83A29BD32B0E2C1`
`.rdata`	`0x00d87000`	4,355,558 bytes	4,355,584 bytes	6.44 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3A0C115CCC02FF5B44FD8B0B80919395`
`.data`	`0x011af000`	8,822,952 bytes	1,142,272 bytes	6.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`07163E8F96A7DC71D6B79998B84BFB50`
`.pdata`	`0x01a1a000`	348,684 bytes	349,184 bytes	6.72 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`367359F4894C49EB3990845C2CCE01A5`
`.debug_l`	`0x01a70000`	114 bytes	512 bytes	1.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`297F20FB303F7675ED0FC3FE89F7086B`
`.debug_i`	`0x01a71000`	46 bytes	512 bytes	0.33 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`12830DE6295A91BF72DDBB0EB82A359F`
`.debug_a`	`0x01a72000`	20 bytes	512 bytes	0.30 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`DA4B92350E5F31B69649F21DC92020C9`
`.debug_a`	`0x01a73000`	48 bytes	512 bytes	0.18 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`7C59DA4F236DE85304FD02F01F1817EF`
`.debug_s`	`0x01a74000`	138 bytes	512 bytes	2.08 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`AF6398E3E4A300741FA57630A08DE299`
`.rsrc`	`0x01a75000`	480 bytes	512 bytes	4.73 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3D2835E8B6B06A02693F849C21D83C65`
`.reloc`	`0x01a76000`	64,480 bytes	64,512 bytes	5.50 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`B31A79D99E23C9844034F346793C4E19`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 1 (381 bytes)

Resource Type	Count	Total Size	Percentage
RT_MANIFEST	1	381 bytes	100%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The AuroraSDKStudio.dll File Analysis