FMediaLibraryView.dll Trojan Packed Analysis

Trojan Packed

Updated on 2024-07-07 (3 months ago)

Online Virus Checker	v.1.0.181.174
DB Version:	2024-07-07 00:00:24

Trojan.Win64.Packed.cl

Packing is a common tactic used by malware authors to make their malicious code more difficult to analyze and detect by antivirus and security programs. These techniques involve compressing, encrypting, or otherwise altering the malware's code to make it appear different from its original form. The goal is to hide the true nature of the malware from security tools.

File	FMediaLibraryView.dll
Checked	2024-07-06 21:43:21
MD5	9c95bb879b15e54eff514aa2b022f445
SHA1	9e9c943c3dd7178f1071ad775ab92e0bf22c0854
SHA256	ed94dad0e2dd00be12d8d8053006e38587c59f836937adba12b039c3c28f600b
SHA512	a635d932c3a903973c71f202427f9c795ad2f57b1ee6000d2bb8579c91d3cb4e2f8918e627dc190d22815411704f791ab5c36da530c5c0a57b9730de9298a490
Imphash	a96a5ebb1bb01ec4667a7500db07343e
File Size	8238616 bytes

Trojan.Win64.Packed.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Packed.cl without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

CompanyName	Wondershare
FileDescription	FMediaLibraryView
FileVersion	13, 3, 12, 7152
InternalName	FMediaLibraryView
LegalCopyright	Copyright (c) 2020-2024 Wondershare. All rights reserved.
OriginalFilename	FMediaLibraryView
ProductName	FMediaLibraryView
ProductVersion	13.3.12.7152
Translation	0x0804 0x04b0

Portable Executable Info

	a4c09c4859e5ebf0c25d5741e4dcf096 f3a8cd694b22d7e9f267a395d00d9ba9 c69a727219ccb2b2
Image Base:	0x180000000
Entry Point:	0x180e81058
Compilation:	2024-05-13 06:37:38
Checksum:	0x007e564e (Actual: 0x007e564e)
OS Version:	6.0
PEiD:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Sign:	The PE file does not contain a certificate table.
Sections:	13
Imports:	kernel32, Qt5Gui, Qt5Xml, FAutoReframe, FThirdPartyCloud, FFAutoHighlightMontage, FFLossless, WsAP-FilmoraX, Qt5Core, FExportView, FCommonView, FFSpeechService, FFCloudDisk, FFMediaLibrary, FMediaPlayerView, FCore, FFIPC, FFAppSettings, FFAppLicense, FFWidgets, FFVBLModel, FFFilmoraCore, FFCore, quazip1-qt5, USER32, MSVCP140, VCRUNTIME140, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-string-l1-1-0, api-ms-win-crt-stdio-l1-1-0, api-ms-win-crt-math-l1-1-0, api-ms-win-crt-heap-l1-1-0,
Exports:	1774
Resources:	12

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
	0x00001000	0x003ab4a9	0x00134000	5a128dd0a5f192dafac914c597f0c172	7.99
	0x003ad000	0x001be3cc	0x00071400	c3d28d05392e0ddd0e991a973cee7501	7.95
	0x0056c000	0x000199e0	0x00005a00	e423ebfab94bd1e83f0bad20164f4569	7.95
	0x00586000	0x00037368	0x00022800	b04f852f3c797df60178c6c9fb2df274	7.75
	0x005be000	0x0002ff40	0x0000da00	bf520a3a21fc55916dd72f9f5ca93e5a	7.95
	0x005ee000	0x0000c6d8	0x00004e00	5f5c734270a86cf7d170af531d06e31c	7.50
.edata	0x005fb000	0x0001fe00	0x0001fe00	b6a4173dc774f018cc542d71866adb89	5.66
.idata	0x0061b000	0x00001000	0x00000c00	b49f11f6824341354a0a2e70d0dc4303	4.66
.tls	0x0061c000	0x00001000	0x00000200	f1f66ad376a0ee6e48829000d1cbb256	0.28
.rsrc	0x0061d000	0x00030000	0x00030000	b1fe636c0eb048750c5af4af70f989cc	5.95
.themida	0x0064d000	0x00834000	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.boot	0x00e81000	0x005a5c00	0x005a5c00	37cc54f3c4692f18e2b71272d18ce0e3	7.95
.reloc	0x01427000	0x00001000	0x00000010	912e040113adc71a247b5129d8d1d633	2.47