The VLC media player (VLC media player) VideoLAN File Malware Analysis

Hash Type	Value	Action
MD5	25556ea1df965ccad41e65db9e255866
SHA1	674b8f7b2f60f4a43ccba17c4608d3f6a15e4b79
SHA256	f77971b5d75d97a322a2c2a4a3fd3269c4a32388c8ad7ae80b7dcc7cefe321d6
SHA512	f1a21315cd260e370241529e0d50031c2c195d0b4120b3055fa252ad7533899aa6f03c367158a514ae2213eafab53ebea4754877e40bf41c77a8357587ebb45f
ImpHash	dce96bc6319a78e5eaf9315128c98209

Basic Information

▼

Image Base	`0x140000000`
Entry Point	`0x1400013d0`
Compilation Time	2060-11-11 05:00:16
Checksum	0x002af735 (Actual: 0x002ba314)
OS Version	4.0
PEiD Signatures	`PE32+ executable (DLL) (console) x86-64, for MS Windows`
Digital Signature	The expected hash does not match the digest in SpcInfo
Imports	6 libraries ADVAPI32, KERNEL32, msvcrt, SHELL32, USER32, WS2_32
Exports	764 functions
Resources	2 Resources
Sections	14 Sections

Digital Signatures

▼

DigiCert Assured ID Root CA	DigiCert Inc (US)
DigiCert Assured ID Root CA	DigiCert Inc (US)
DigiCert SHA2 Assured ID Code Signing CA	VideoLAN (FR)
DigiCert Assured ID Root CA	DigiCert Inc (US)
DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA	DigiCert (US)

Version Information

▼

CompanyName	VideoLAN
ProductName	VLC media player
ProductVersion	3,0,18,0
FileVersion	3.0.18
FileDescription	VLC media player
LegalCopyright	Copyright © 1996-2022 VideoLAN and VLC Authors
LegalTrademarks	VLC media player, VideoLAN and x264 are registered trademarks from VideoLAN
Translation	0x0409 0x04e4

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	1,490,920 bytes	1,490,944 bytes	6.41 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_64BYTES`	`4CD5B8155C0A2AFF2BA18E1B6793B8E9`
`.data`	`0x0016d000`	18,136 bytes	18,432 bytes	4.57 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_64BYTES`	`072D6D61D210A2EF6090E1030DE65D9B`
`.rdata`	`0x00172000`	1,144,752 bytes	1,144,832 bytes	7.09 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_32BYTES`	`38013FF0D4F07451080D13181A12BCA6`
`.buildid`	`0x0028a000`	53 bytes	512 bytes	0.57 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`C309C6A0E4B2462057A691FA0AC2F367`
`.pdata`	`0x0028b000`	43,860 bytes	44,032 bytes	6.10 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`14A223F8997D1C75D37F4CF1A97836E1`
`.xdata`	`0x00296000`	43,368 bytes	43,520 bytes	4.40 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`5A96C084B1806C8534979F9A9BF7F5FD`
`.bss`	`0x002a1000`	18,784 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x002a6000`	21,880 bytes	22,016 bytes	5.82 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`35B7D87582999ABBE05C1C29B03514BE`
`.idata`	`0x002ac000`	10,908 bytes	11,264 bytes	4.55 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`CB09DC81544925B66ED274DC27B6F1BD`
`.CRT`	`0x002af000`	88 bytes	512 bytes	0.24 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`2D12877EB7256D34C7F7F6B6486E2FEF`
`.tls`	`0x002b0000`	104 bytes	512 bytes	0.31 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`AFE61E906C7B5966C893BBA61A88451A`
`.rsrc`	`0x002b1000`	1,608 bytes	2,048 bytes	3.68 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`1F1A347049D1B8C25D97E028B916AC9E`
`.reloc`	`0x002b2000`	5,948 bytes	6,144 bytes	5.40 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`4E060D9C966EA4B3DD11D12A64B35FED`
`/4`	`0x002b4000`	24 bytes	512 bytes	0.42 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`A18B71916B5A01FD2922BDBC36741DD4`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 2 (1,441 bytes)

Resource Type	Count	Total Size	Percentage
RT_VERSION	1	844 bytes	58.6%
RT_MANIFEST	1	597 bytes	41.4%

Certificate Chain Analysis

▼

Certificate #1

Subject	DigiCert Assured ID Root CA DigiCert Inc US
Issuer	DigiCert Assured ID Root CA
Serial Number	`17154717934120587862167794914071425081`

Certificate #2

Subject	DigiCert SHA2 Assured ID Code Signing CA DigiCert Inc US
Issuer	DigiCert Assured ID Root CA
Serial Number	`5364131601516814570659357524942475272`

Certificate #3

Subject	VideoLAN VideoLAN FR
Issuer	DigiCert SHA2 Assured ID Code Signing CA
Serial Number	`5356740797042686197271446732452264212`

Certificate #4

Subject	DigiCert Trusted Root G4 DigiCert Inc US
Issuer	DigiCert Assured ID Root CA
Serial Number	`19414496059604725969669510860671817818`

Certificate #5

Subject	DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA DigiCert, Inc. US
Issuer	DigiCert Trusted Root G4
Serial Number	`9586110043380832440035821245782711899`

Certificate #6

Subject	DigiCert Timestamp 2022 - 2 DigiCert US
Issuer	DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
Serial Number	`16352681515936560713148055516499426650`

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	VLC media player
File Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
Scanner Version	1.0.138.174
Database Version	2023-09-12 20:01:59 UTC

The VLC media player (VLC media player) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification

PE Analysis