The Bella.dll (Bella Dynamic Link Library) File Analysis

Updated 4 days ago

Checked by Malware Check

Bella.dll

Technical Analysis

File Name	Bella.dll
File Type	Win32 DLL
Magic Bytes	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	98304:EOdkoamRF9ufYeWp3bpnQJmHcTxSobtOCuLBpEiwquBJ6h8y18vMM4G+g:EOaoHRMiLVQJyctSobtOPtiTquBJS89
Scanner Version	1.0.223.174
Database Version	2025-08-19 23:00:28 UTC

⚠

Suspicious File Detected

Detected by 29 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

41%

Detection Rate

6,382,592

File Size (bytes)

29/71

Engines Detected

2025-08-19

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	30c50c96f0b1f7072e549bf5355ef84f
SHA1	d1979d082808f3fbeb7b0d940b80197167a239cc
SHA256	f52cd10ec90571e3643fb8b7597949949570ba4719f285c1ca502f02a9262b67
SHA512	a89aab1955c6655eae4ce9ed5eaf3e42a7a3ae81cff025eed5127bc8dd3e103dd460afa766263f156ada187990ee9452824670cce966fe6a25c55ac4a21162c6
ImpHash	440e477e4ddac300294a582a4790d83a

Security Engines with Detections (29 of 71)

Lionic

Trojan.Win32.VMProtect.4!c Malicious

Elastic

malicious (high confidence) Malicious

CTX

dll.trojan.vmprotect Malicious

CAT-QuickHeal

Trojan.Ghanarava.17326907075ef84f Malicious

Skyhigh

BehavesLike.Win32.Generic.vc Malicious

McAfee

Artemis!30C50C96F0B1 Malicious

Cylance

Unsafe Malicious

Zillya

Trojan.VMProtect.Win32.100893 Malicious

CrowdStrike

win/malicious_confidence_70% (W) Malicious

Symantec

ML.Attribute.HighConfidence Malicious

ESET-NOD32

a variant of Win32/Packed.VMProtect.BC suspicious Malicious

APEX

Malicious Malicious

TrendMicro-HouseCall

TROJ_GEN.R002C0XKQ24 Malicious

Paloalto

generic.ml Malicious

Avast

Win32:MalwareX-gen [Trj] Malicious

Google

Detected Malicious

TrendMicro

TROJ_GEN.R002C0XKQ24 Malicious

McAfeeD

ti!F52CD10EC905 Malicious

SentinelOne

Static AI - Suspicious PE Malicious

Sophos

Mal/Generic-S Malicious

Ikarus

PUA.VMProtect Malicious

Varist

W32/ABApplication.LKZV-0661 Malicious

Antiy-AVL

Trojan[Packed]/Win32.VMProtect Malicious

VBA32

Malware-Cryptor.Inject.gen Malicious

MaxSecure

Trojan.Malware.303735399.susgen Malicious

Fortinet

PossibleThreat.PALLASNET.H Malicious

AVG

Win32:MalwareX-gen [Trj] Malicious

DeepInstinct

MALICIOUS Malicious

alibabacloud

VirTool:Win/Packed.VMProtect.BW Malicious

42 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Image Base	`0x10000000`
Entry Point	`0x108e1c74`
Compilation Time	2024-02-23 12:46:39
Checksum	0x00619aa7 (Actual: 0x00619aa7)
OS Version	5.0
PEiD Signatures	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	4 libraries KERNEL32, USER32, SHLWAPI, IPHLPAPI
Exports	3 functions
Resources	2 Resources
Sections	8 Sections

Version Information

▼

Comments	Www.ChinaPYG.CoM
CompanyName	飘云阁论坛官方出品
FileDescription	Bella Dynamic Link Library
FileVersion	3, 0, 1, 1003
InternalName	Bella.dll
LegalCopyright	Copyright (C) 2020
OriginalFilename	Bella.dll
ProductName	Bella Dynamic Link Library
ProductVersion	3, 0, 1, 1003
Translation	0x0804 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	134,989 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00022000`	19,333 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x00027000`	12,964 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`Baymax0`	`0x0002b000`	3,780,974 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`Baymax1`	`0x003c7000`	56 bytes	512 bytes	0.24 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3A9501CDAB4C826CB178C875BDCCA49A`
`Baymax2`	`0x003c8000`	6,378,400 bytes	6,378,496 bytes	7.89 (Packed/Encrypted)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`5CF0723CED491D066CDE1E8AB15C4ACF`
`.rsrc`	`0x009de000`	1,334 bytes	1,536 bytes	3.87 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2BBBCDB48C8DA038FBB1AE2298C7C107`
`.reloc`	`0x009df000`	536 bytes	1,024 bytes	2.52 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`574272AEBBED7B89F2A7594B87F49DF8`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 2 (1,174 bytes)

Resource Type	Count	Total Size	Percentage
RT_VERSION	1	828 bytes	70.5%
RT_MANIFEST	1	346 bytes	29.5%

Certificate Chain Analysis

▼

Certificate Information

Product	Bella Dynamic Link Library
Description	Bella Dynamic Link Library
File Version	3, 0, 1, 1003
Original Name	Bella.dll
Internal Name	Bella.dll
Copyright	Copyright (C) 2020

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

29 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1