The iZAudioRestore dll (Audio Restore (Core)) iZotope, Inc File Malware Analysis

The iZAudioRestore.dll (Audio Restore (Core)) File Analysis

Updated 2 days ago

Checked by Malware Check

iZAudioRestore.dll

Hash Type	Value	Action
MD5	ed48227dc6b9d864a143860aabf7a6a0
SHA1	e1006e30d3b46fc3653670b87c9288345442bdd6
SHA256	ca28db0c93c75fb5c010e1ec2a49f52bd823665db41a4d1a5ff35a0e9c3837a3
SHA512	d8b7375cad136a92c646f1e30a1777fab2ff3f1af83b514e5a98e759303b11ba9b688d62c7688faa99798cb84f7a68386dbc034ae446896e4be9892b00fb2ed2
ImpHash	758166a67af3f26c40fb965e9c353305

Hash Type

Value

Action

MD5

ed48227dc6b9d864a143860aabf7a6a0

SHA1

e1006e30d3b46fc3653670b87c9288345442bdd6

SHA256

ca28db0c93c75fb5c010e1ec2a49f52bd823665db41a4d1a5ff35a0e9c3837a3

SHA512

d8b7375cad136a92c646f1e30a1777fab2ff3f1af83b514e5a98e759303b11ba9b688d62c7688faa99798cb84f7a68386dbc034ae446896e4be9892b00fb2ed2

ImpHash

758166a67af3f26c40fb965e9c353305

PE Analysis

Basic Information

▼

Icon	Hash: 4cd5656b53cfa876b5b2e26cfa7dd4dc Fuzzy: ad3cb105473d654786b5e8141ebf4135 dHash: eebebbb3ab8afaba
Image Base	`0x10000000`
Entry Point	`0x100db402`
Compilation Time	2009-02-25 20:09:02
Checksum	0x002664fe (Actual: 0x002664fe)
OS Version	4.0
PEiD Signatures	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
PDB Path	`d:\iZotope\iZotope_Neptune\AudioRestore\plugin\build\win_vc80\Win32\Release FLStudio CRTStatic DLL_AudioRestorePlugin\iZAudioRestore.pdb`
Digital Signature	Chain verification from CN=Image Line, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Image Line, L=sint-martens-latem, ST=ovl, C=BE (serial:57418046931039877738068153967357359482, sha1:33ea3f06c4a1786a872e34596bf4f9330aed0faf) failed: The path could not be validated because intermediate certificate 1 expired 2020-02-07 23:59:59Z
Imports	10 libraries gdiplus, KERNEL32, USER32, GDI32, comdlg32, ADVAPI32, SHELL32, ole32, COMCTL32, WININET
Exports	1 functions
Resources	25 Resources
Sections	6 Sections

Version Information

▼

CompanyName	iZotope, Inc.
FileDescription	Audio Restore (Core)
FileVersion	1,0,1,667
InternalName	AudioRestore
LegalCopyright	Copyright © 2008 iZotope, Inc.
OriginalFilename	PluginHooks.dll
ProductName	Audio Restore
ProductVersion	1,0,1,667
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	1,398,799 bytes	1,400,832 bytes	6.74 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F29435F404B23135CCBF0ABE2ECFF40D`
`.rdata`	`0x00157000`	229,528 bytes	233,472 bytes	5.42 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8793AF2B2700497CD20AF6A5A8F9FB5B`
`.data`	`0x00190000`	63,020 bytes	53,248 bytes	5.41 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A88D64B96D579D657992074873C60C1C`
`_RDATA`	`0x001a0000`	4 bytes	4,096 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`620F0B67A91F7F74151BC5BE745B7110`
`.rsrc`	`0x001a1000`	715,244 bytes	716,800 bytes	7.42 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A081290F8A81A136452BA33F48255EC6`
`.reloc`	`0x00250000`	64,484 bytes	65,536 bytes	4.83 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`0B3D80998FCE4F869E96ECD20E519854`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 25 (713,798 bytes)

Resource Type	Count	Total Size	Percentage
IZRESEMBED	1	528,192 bytes	74%
RT_BITMAP	1	166,202 bytes	23.3%
RT_ICON	4	4,640 bytes	0.7%
RT_DIALOG	16	13,848 bytes	1.9%
RT_GROUP_ICON	1	62 bytes	0%
RT_VERSION	1	768 bytes	0.1%
RT_MANIFEST	1	86 bytes	0%

Certificate Chain Analysis

▼

Certificate Information

Product	Audio Restore
Description	Audio Restore (Core)
File Version	1,0,1,667
Original Name	PluginHooks.dll
Verification Status	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Signers	Image Line; VeriSign Class 3 Code Signing 2010 CA; VeriSign
Internal Name	AudioRestore
Copyright	Copyright © 2008 iZotope, Inc.

Certificate Chain Summary

Image Line #1 Primary

Validity Period: 2013-05-17 00:00:00 → 2015-05-17 23:59:59

Signature Algorithm: sha1RSA

Serial Number: 2B 32 50 47 A6 10 0E 8D F6 FC 89 1F 0D C6 75 7A

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

Chain verification from CN=Image Line, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Image Line, L=sint-martens-latem, ST=ovl, C=BE (serial:57418046931039877738068153967357359482, sha1:33ea3f06c4a1786a872e34596bf4f9330aed0faf) failed: The path could not be validated because intermediate certificate 1 expired 2020-02-07 23:59:59Z

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	iZAudioRestore.dll
File Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.222.174
Database Version	2025-08-08 20:00:30 UTC

The iZAudioRestore.dll (Audio Restore (Core)) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification