Universal_Video_Downloader.exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

127.7sto launch

17telemetry events

9observed

68agent notes

Suspicious

40/100

5 points past the suspicious line at 35, 30 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+40

Static analysis

2 suspicious signature match(es)
Anti-debug API name(s) IsDebuggerPresent, OutputDebugString: ONE observation read by two static sources, not two findings - signature Suspicious_Anti_Debug_API matched them in the file and the Anti-debugging capability bucket read the same names from the import table; both charges kept. NtQueryInformationProcess matched in the file only.
3 high-risk capability bucket(s): Privilege escalation, Process injection, Anti-debugging
Malicious strings: injection / execution

Persistence

1 persistence mechanism(s): .NET Startup Hook DLL
3 point(s) are not charged here: .NET Startup Hook DLL is named in this file's strings and not established at run time, so the reference is published and not scored.

Model reading

Measured SUSPICIOUS40 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Other high-severity findings

HIGH APC injection primitive (QueueUserAPC)
HIGH Early-bird / QueueUserAPC on suspended process
HIGH Injection/execution API strings
HIGH Thread-context hijack injection (SetThreadContext)

Analysis layers

Static ran moved the score

Dynamic ran no points

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution121s

Guest hardware2 vCPU4095 MB RAM

Detection signatures

22 detected · 10 withheld as common

Severity	Detection	Evidence	Layer
HIGH	AMSI tamper pattern (LoadLibrary amsi + GetProcAddress) MITRE T1562.001	string amsi found in the sample's strings import kernel32.dll!GetProcAddress requires getprocaddress	static
HIGH	APC injection primitive (QueueUserAPC) MITRE T1055.004	import kernel32.dll!QueueUserAPC	static
HIGH	Early-bird / QueueUserAPC on suspended process MITRE T1055.004	import kernel32.dll!QueueUserAPC requires queueuserapc import kernel32.dll!ResumeThread requires resumethread	static
HIGH	Injection/execution API strings MITRE T1055	string amsi.dll matched string	static
HIGH	Thread-context hijack injection (SetThreadContext) MITRE T1055.003	import kernel32.dll!SetThreadContext requires setthreadcontext import kernel32.dll!GetThreadContext requires getthreadcontext	static
MED	Creates a suspended process then resumes (hollowing/hijack) MITRE T1055.012	import kernel32.dll!CreateProcessW requires createprocess import kernel32.dll!ResumeThread requires resumethread	static
MED	Exception-based anti-debug (SEH/VEH install) MITRE T1622	import kernel32.dll!AddVectoredExceptionHandler	static
MED	Opens/suspends remote threads MITRE T1055	import advapi32.dll!OpenThreadToken requires openthread import kernel32.dll!SuspendThread requires suspendthread	static
MED	TLS callback (pre-main execution) MITRE T1055	pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point	static
LOW	Adjusts token privileges (SeDebug / escalation) MITRE T1134 seen in 8% of benign software	import advapi32.dll!AdjustTokenPrivileges	static
LOW	Checks for WOW64 (bitness/anti-analysis) MITRE T1497 seen in 9% of benign software	import kernel32.dll!IsWow64Process	static
LOW	Checks system uptime (sandbox age check) MITRE T1497.001 seen in 12% of benign software	import kernel32.dll!GetTickCount64	static
LOW	Direct memory execution (VirtualProtect + memory copy) MITRE T1055 seen in 9% of benign software	import kernel32.dll!VirtualProtect requires virtualprotect import kernel32.dll!VirtualAlloc requires virtualalloc	static
LOW	Drops + executes from temp (GetTempPath + CreateProcess) MITRE T1204 seen in 7% of benign software	import kernel32.dll!GetTempPathW requires gettemppath import kernel32.dll!CreateProcessW requires createprocess	static
LOW	Duplicates a process handle (handle theft) MITRE T1134 seen in 10% of benign software	import kernel32.dll!DuplicateHandle	static
LOW	Executes via ShellExecute MITRE T1204 seen in 12% of benign software	import shell32.dll!ShellExecuteW	static
LOW	Opens a device via CreateFile (driver/raw IO) MITRE T1106 seen in 6% of benign software	import kernel32.dll!CreateFileA requires createfile string \\.\ found in the sample's strings	static
LOW	Process-injection capability MITRE T1055 seen in 5% of benign software	capability getthreadcontext capability: injection capability queueuserapc capability: injection capability setthreadcontext capability: injection	static
LOW	Reflective/manual DLL load pattern MITRE T1620 seen in 8% of benign software	import kernel32.dll!VirtualAlloc requires virtualalloc import kernel32.dll!GetProcAddress requires getprocaddress import kernel32.dll!LoadLibraryA requires loadlibrary import kernel32.dll!CreateThread requires createthread	static
LOW	Sleep-based sandbox evasion MITRE T1497.003	import kernel32.dll!SleepEx	static
LOW	Spawns child processes MITRE T1106 seen in 16% of benign software	import kernel32.dll!CreateProcessW	static
INFO	Stages in the temp directory (GetTempPath) MITRE T1074 seen in 15% of benign software	import kernel32.dll!GetTempPathW	static

Withheld: 10 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software

Anti-debugging capability fires on 65% of benign software

Dynamic API resolution (obfuscation) fires on 65% of benign software

Anti-debug: checks for a debugger fires on 60% of benign software

Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software

Anti-debug via OutputDebugString probe fires on 41% of benign software

Creates a named mutex (single-instance / infection marker) fires on 31% of benign software

Executes external code / commands fires on 30% of benign software

Queries system information (host recon) fires on 25% of benign software

Enumerates files recursively (staging/collection) fires on 21% of benign software

Persistence

1 mechanism

LOW

.NET Startup Hook DLL static

DLL Load Order · MITRE T1574

Auto-start methods established during detonation or referenced statically. The Persistence tab lists these against every method checked.

What the tests returned

9 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	none established at runtime
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)	none observed
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	not checked - the antivirus pass did not finish
Capability analysis of the file's code	not checked - the check ran past its time limit and was stopped
Anti-analysis / evasion checks	none above the reporting threshold - the anti-analysis calls this run did make are listed with their counts

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Instrument coverage

3 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	measured	Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
API call sequence	measured	Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else.
Explicit module loads	measured	Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

VMProtect(new)[DS]

Packed VMProtect(new)[DS] Unsigned

CompilerMicrosoft Visual C/C++(19.36.33523)[LTCG/C++]

LinkerMicrosoft Linker(14.36.33523)

Library.NET Core(Loader)

Identity

File

typeexecutable

size63.7 MB

file arch64-bit (x64)

subsystemConsole

entropy6.7217

date2024-04-16 04:15:47 UTC

version1.0.0.0

descriptionUniversal_Video_Downloader

productUniversal_Video_Downloader

original nameUniversal_Video_Downloader.dll

languageNEU

Antivirus engine

no result signature set 28161 - 3.6M signatures

The antivirus pass did not produce a result for this file, so neither a detection nor a clean answer was established. This narrows what the run covered; it says nothing about the file itself. Cause: the scan ran past its time limit and was stopped.

Signature set	Value
Set version	28161
Signatures in the set	3,642,894
Set published	22 Oct 2026 06:24 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

no model score

No model score exists for this file: the file is larger than the 32 MB the local model is allowed to read in one scan, so it got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.

Structural rules of thumb, not a model. 2 cheap static signals fired, for 15 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

unsigned executable
TLS callback

Packing

Not packed

This file's code is readable on disk - nothing is compressed or encrypted around it.

30/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed 3 signals

Non-standard section names: .CLR_UEF, Section, _RDATA
Embedded executable in resources
TLS callback present

Family configuration search

Not attempted

The sample is 63.7 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

Sample size	63.7 MB
Bound	16.0 MB
Limit reached	Sample size, before any parser was loaded.

Secrets & malicious strings

1 flagged string

Flagged string categories

injection / execution high 1 hit

Indicator	Found in	Evidence from the sample
amsi.dll	raw bytes	present in the file bytes only

Capabilities

8 behaviour buckets · 3 high-risk

Severity	Capability	MITRE	APIs
high	Privilege escalation Adjusts tokens / privileges	T1134, T1134.001	adjusttokenprivileges, openprocesstoken, setthreadtoken
high	Process injection Writes and runs code inside another process	T1055.004, T1055.012	getthreadcontext, queueuserapc, setthreadcontext
high	Anti-debugging Detects or obstructs a debugger	T1622	isdebuggerpresent, outputdebugstringa
med	Evasion / stalling Sleeps, times, or otherwise stalls analysis	T1497, T1497.003	getsystemtimeasfiletime, gettickcount, gettickcount64, queryperformancecounter, sleep, sleepex
med	Dynamic API resolution Resolves APIs at runtime (obfuscation)	T1129	getprocaddress, loadlibrarya, loadlibraryexa, loadlibraryw
med	Code execution Creates processes / runs commands or shellcode	T1106, T1203	createprocessw, createthread, shellexecutew
med	Ransomware behaviour Enumerates + encrypts files, deletes backups	T1083	findnextfilew
low	Discovery Enumerates the host, users, processes or network	T1082	getsysteminfo

Security mitigations

strong posture

ON ASLR (DynamicBase)

ON High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

ON Control Flow Guard

OFF SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Rich header (toolchain)

richhash 0d280991273d2526

Tool	Build	Uses
prodid_147	30729	22
Unknown	0	1
Cvtres 14.10	33218	18
Utc1900 (VS2017)	33218	28
Export 14.10	33218	91
Cvtres 14.10	30795	8
Utc1900 (VS2017)	30795	13
Import (linker)	0	522
Utc1900 (VS2017)	33523	21
prodid_265	33523	637
Alias	33523	1
Implib	33523	1
AliasObj 14.10	33523	1

Sections

10 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.textEP Executable code	0x1000	5.9 MB	5.9 MB	EXECUTEREAD	6.4473
.CLR_UEF Non-standard section	0x5e8000	512.0 B	221.0 B	EXECUTEREAD	3.0941
.rdata Read-only data	0x5e9000	1.5 MB	1.5 MB	READ	5.6079
.data Initialised data	0x765000	28.5 KB	121.1 KB expands	READWRITE	3.174
.pdata Exception unwind data	0x784000	211.5 KB	211.4 KB	READ	6.4874
.didat Delay-load imports	0x7b9000	512.0 B	56.0 B	READWRITE	0.4269
Section Non-standard section	0x7ba000	512.0 B	8.0 B	READWRITE	0.0
_RDATA Non-standard section	0x7bb000	77.5 KB	77.0 KB	READ	5.4887
.rsrc Resources	0x7cf000	1.3 MB	1.3 MB	READ	6.3676
.reloc Base relocations	0x913000	30.0 KB	30.0 KB	READ	5.4504

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

458 funcs / 17 DLLs · 19 suspicious

▸KERNEL32.dll197 funcs 15 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
RaiseException	0x005e90a8	-	-
FreeLibrary	0x005e90b0	-	-
RaiseFailFastException	0x005e90b8	-	-
GetExitCodeProcess	0x005e90c0	-	-
TerminateProcess	0x005e90c8	-	-
UnhandledExceptionFilter	0x005e90d0	-	-
SetUnhandledExceptionFilter	0x005e90d8	-	-
AddVectoredExceptionHandler	0x005e90e0	-	-
MultiByteToWideChar	0x005e90e8	-	-
GetTickCount	0x005e90f0	-	T1497
GetCurrentProcessId	0x005e90f8	-	-
FlushInstructionCache	0x005e9100	-	-
QueryPerformanceFrequency	0x005e9108	-	-
QueryPerformanceCounter	0x005e9110	-	T1497
RtlLookupFunctionEntry	0x005e9118	yes	-
LocateXStateFeature	0x005e9120	-	-
RtlDeleteFunctionTable	0x005e9128	yes	-
InterlockedPushEntrySList	0x005e9130	-	-
InterlockedFlushSList	0x005e9138	-	-
InitializeSListHead	0x005e9140	-	-
GetTickCount64	0x005e9148	-	-
DuplicateHandle	0x005e9150	-	-
QueueUserAPC	0x005e9158	-	T1055
WaitForSingleObjectEx	0x005e9160	-	-
SetThreadPriority	0x005e9168	-	-
GetThreadPriority	0x005e9170	-	-
ResumeThread	0x005e9178	-	-
GetCurrentThreadId	0x005e9180	-	-
TlsAlloc	0x005e9188	-	-
GetCurrentThread	0x005e9190	-	-
CreateThread	0x005e9198	-	-
GetModuleHandleW	0x005e91a0	-	-
WaitForMultipleObjectsEx	0x005e91a8	-	-
SignalObjectAndWait	0x005e91b0	-	-
RtlCaptureContext	0x005e91b8	yes	-
SetThreadStackGuarantee	0x005e91c0	-	-
VirtualQuery	0x005e91c8	-	-
WriteFile	0x005e91d0	-	-
GetStdHandle	0x005e91d8	-	-
GetConsoleOutputCP	0x005e91e0	-	-
MapViewOfFileEx	0x005e91e8	-	-
UnmapViewOfFile	0x005e91f0	-	-
GetStringTypeExW	0x005e91f8	-	-
SetEvent	0x005e9200	-	-
GetCurrentProcessorNumber	0x005e9208	-	-
GlobalMemoryStatusEx	0x005e9210	-	-
CreateIoCompletionPort	0x005e9218	-	-
PostQueuedCompletionStatus	0x005e9220	-	-
GetQueuedCompletionStatus	0x005e9228	-	-
InterlockedPopEntrySList	0x005e9230	-	-
GetCurrentProcessorNumberEx	0x005e9238	-	-
ExitProcess	0x005e9240	-	-
Sleep	0x005e9248	-	-
CreateMemoryResourceNotification	0x005e9250	-	-
GetProcessAffinityMask	0x005e9258	-	-
SetThreadIdealProcessorEx	0x005e9260	-	-
GetThreadIdealProcessorEx	0x005e9268	-	-
GetLargePageMinimum	0x005e9270	-	-
VirtualUnlock	0x005e9278	-	-
GetLogicalProcessorInformation	0x005e9280	-	-
SetThreadGroupAffinity	0x005e9288	-	-
SetThreadAffinityMask	0x005e9290	-	-
IsProcessInJob	0x005e9298	-	-
QueryInformationJobObject	0x005e92a0	-	-
K32GetProcessMemoryInfo	0x005e92a8	-	-
VirtualAlloc	0x005e92b0	-	T1055
VirtualFree	0x005e92b8	-	-
VirtualProtect	0x005e92c0	-	T1055
SleepEx	0x005e92c8	-	-
SwitchToThread	0x005e92d0	-	-
InitializeContext	0x005e92d8	-	-
SetXStateFeaturesMask	0x005e92e0	-	-
RtlRestoreContext	0x005e92e8	yes	-
CloseThreadpoolTimer	0x005e92f0	-	-
CreateThreadpoolTimer	0x005e92f8	-	-
SetThreadpoolTimer	0x005e9300	-	-
ReadFile	0x005e9308	-	-
GetFileSize	0x005e9310	-	-
GetEnvironmentVariableW	0x005e9318	-	-
SetEnvironmentVariableW	0x005e9320	-	-
CreateEventW	0x005e9328	-	-
ResetEvent	0x005e9330	-	-
CreateSemaphoreExW	0x005e9338	-	-
ReleaseSemaphore	0x005e9340	-	-
WaitForSingleObject	0x005e9348	-	-
ReleaseMutex	0x005e9350	-	-
GetThreadContext	0x005e9358	-	-
SuspendThread	0x005e9360	-	-
SetThreadContext	0x005e9368	-	T1055
GetEnabledXStateFeatures	0x005e9370	-	-
CopyContext	0x005e9378	-	-
WerRegisterRuntimeExceptionModule	0x005e9380	-	-
RtlInstallFunctionTableCallback	0x005e9388	yes	-
GetSystemDefaultLCID	0x005e9390	-	-
GetUserDefaultLCID	0x005e9398	-	-
RtlUnwind	0x005e93a0	yes	-
LoadLibraryExW	0x005e93a8	-	-
HeapAlloc	0x005e93b0	-	-
HeapFree	0x005e93b8	-	-
GetProcessHeap	0x005e93c0	-	-
HeapCreate	0x005e93c8	-	-
HeapDestroy	0x005e93d0	-	-
GetEnvironmentStringsW	0x005e93d8	-	-
FreeEnvironmentStringsW	0x005e93e0	-	-
FormatMessageW	0x005e93e8	-	-
GetACP	0x005e93f0	-	-
LCMapStringEx	0x005e93f8	-	-
LocalFree	0x005e9400	-	-
VerSetConditionMask	0x005e9408	-	-
VerifyVersionInfoW	0x005e9410	-	-
QueryThreadCycleTime	0x005e9418	-	-
VirtualAllocExNuma	0x005e9420	-	-
GetNumaProcessorNodeEx	0x005e9428	-	-
GetNumaHighestNodeNumber	0x005e9430	-	-
GetLogicalProcessorInformationEx	0x005e9438	-	-
GetThreadGroupAffinity	0x005e9440	-	-
GetSystemTimes	0x005e9448	-	-
GetProcessGroupAffinity	0x005e9450	-	-
CreateFileMappingW	0x005e9458	-	-
GetSystemTimeAsFileTime	0x005e9460	-	-
GetModuleFileNameW	0x005e9468	-	-
CreateProcessW	0x005e9470	-	T1106
GetCPInfo	0x005e9478	-	-
CreateFileW	0x005e9480	-	-
GetFileAttributesExW	0x005e9488	-	-
GetTempPathW	0x005e9490	-	-
GetCurrentDirectoryW	0x005e9498	-	-
GetFullPathNameW	0x005e94a0	-	-
LoadLibraryExA	0x005e94a8	-	-
OutputDebugStringA	0x005e94b0	-	T1622
OpenEventW	0x005e94b8	-	-
ExitThread	0x005e94c0	-	-
HeapReAlloc	0x005e94c8	-	-
CreateNamedPipeA	0x005e94d0	-	-
WaitForMultipleObjects	0x005e94d8	-	-
DisconnectNamedPipe	0x005e94e0	-	-
CreateFileA	0x005e94e8	-	-
CancelIoEx	0x005e94f0	-	-
GetOverlappedResult	0x005e94f8	-	-
ConnectNamedPipe	0x005e9500	-	-
FlushFileBuffers	0x005e9508	-	-
SetFilePointer	0x005e9510	-	-
MapViewOfFile	0x005e9518	-	-
GetActiveProcessorGroupCount	0x005e9520	-	-
GetSystemTime	0x005e9528	-	-
SetConsoleCtrlHandler	0x005e9530	-	-
GetLocaleInfoEx	0x005e9538	-	-
GetUserDefaultLocaleName	0x005e9540	-	-
RtlAddFunctionTable	0x005e9548	yes	-
LoadLibraryW	0x005e9550	-	T1129
CreateDirectoryW	0x005e9558	-	-
RemoveDirectoryW	0x005e9560	-	-
GetFileSizeEx	0x005e9568	-	-
FindFirstFileExW	0x005e9570	-	-
FindNextFileW	0x005e9578	-	T1083
FindClose	0x005e9580	-	-
LoadLibraryA	0x005e9588	-	T1129
IsWow64Process	0x005e9590	-	-
EncodePointer	0x005e9598	-	-
GetEnvironmentVariableA	0x005e95a0	-	-
DecodePointer	0x005e95a8	-	-
ReleaseSRWLockExclusive	0x005e95b0	-	-
CloseHandle	0x005e95b8	-	-
TlsSetValue	0x005e95c0	-	-
TlsGetValue	0x005e95c8	-	-
GetSystemInfo	0x005e95d0	-	-
GetCurrentProcess	0x005e95d8	-	-
OutputDebugStringW	0x005e95e0	-	T1622
IsDebuggerPresent	0x005e95e8	-	T1622
LeaveCriticalSection	0x005e95f0	-	-
EnterCriticalSection	0x005e95f8	-	-
DeleteCriticalSection	0x005e9600	-	-
InitializeCriticalSection	0x005e9608	-	-
GetCommandLineW	0x005e9610	-	-
GetProcAddress	0x005e9618	-	T1129
GetModuleHandleExW	0x005e9620	-	-
SetErrorMode	0x005e9628	-	-
FlushProcessWriteBuffers	0x005e9630	-	-
SetLastError	0x005e9638	-	-
GetLastError	0x005e9640	-	-
WideCharToMultiByte	0x005e9648	-	-
CreateMutexW	0x005e9650	-	T1027
DebugBreak	0x005e9658	-	-
InitializeCriticalSectionEx	0x005e9660	-	-
GetStringTypeW	0x005e9668	-	-
GetExitCodeThread	0x005e9670	-	-
TryAcquireSRWLockExclusive	0x005e9678	-	-
RtlPcToFileHeader	0x005e9680	yes	-
TlsFree	0x005e9688	-	-
InitializeCriticalSectionAndSpinCount	0x005e9690	-	-
AcquireSRWLockExclusive	0x005e9698	-	-
WakeAllConditionVariable	0x005e96a0	-	-
SleepConditionVariableSRW	0x005e96a8	-	-
RtlVirtualUnwind	0x005e96b0	yes	-
IsProcessorFeaturePresent	0x005e96b8	-	-
RtlUnwindEx	0x005e96c0	yes	-
CreateFileMappingA	0x005e96c8	-	-

▸ADVAPI32.dll20 funcs 3 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
RegGetValueW	0x005e9000	-	-
SetKernelObjectSecurity	0x005e9008	-	-
GetSidSubAuthorityCount	0x005e9010	-	-
GetSidSubAuthority	0x005e9018	-	-
GetTokenInformation	0x005e9020	-	-
DeregisterEventSource	0x005e9028	-	-
ReportEventW	0x005e9030	-	-
RegisterEventSourceW	0x005e9038	-	-
RegQueryValueExW	0x005e9040	-	-
RegOpenKeyExW	0x005e9048	-	-
RegCloseKey	0x005e9050	-	-
EventRegister	0x005e9058	-	-
AdjustTokenPrivileges	0x005e9060	-	T1134
OpenProcessToken	0x005e9068	-	T1134
LookupPrivilegeValueW	0x005e9070	-	T1134
SetThreadToken	0x005e9078	-	-
RevertToSelf	0x005e9080	-	-
OpenThreadToken	0x005e9088	-	-
EventWriteTransfer	0x005e9090	-	-
EventWrite	0x005e9098	-	-

▸ole32.dll20 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CoCreateGuid	0x005e9e30	-	-
CoTaskMemAlloc	0x005e9e38	-	-
CoInitializeEx	0x005e9e40	-	-
CoUninitialize	0x005e9e48	-	-
CoReleaseMarshalData	0x005e9e50	-	-
IIDFromString	0x005e9e58	-	-
CLSIDFromProgID	0x005e9e60	-	-
CoRegisterInitializeSpy	0x005e9e68	-	-
CoMarshalInterface	0x005e9e70	-	-
CoUnmarshalInterface	0x005e9e78	-	-
CoGetObjectContext	0x005e9e80	-	-
CoGetContextToken	0x005e9e88	-	-
CoGetClassObject	0x005e9e90	-	-
CoCreateFreeThreadedMarshaler	0x005e9e98	-	-
CreateStreamOnHGlobal	0x005e9ea0	-	-
StringFromGUID2	0x005e9ea8	-	-
CoGetMarshalSizeMax	0x005e9eb0	-	-
CoWaitForMultipleHandles	0x005e9eb8	-	-
CoRevokeInitializeSpy	0x005e9ec0	-	-
CoTaskMemFree	0x005e9ec8	-	-

▸OLEAUT32.dll28 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
QueryPathOfRegTypeLib	0x005e96d8	-	-
LoadTypeLibEx	0x005e96e0	-	-
SafeArrayGetVartype	0x005e96e8	-	-
VariantChangeType	0x005e96f0	-	-
VariantChangeTypeEx	0x005e96f8	-	-
VariantClear	0x005e9700	-	-
VariantInit	0x005e9708	-	-
VarCyFromDec	0x005e9710	-	-
SafeArrayAllocDescriptorEx	0x005e9718	-	-
GetRecordInfoFromTypeInfo	0x005e9720	-	-
SafeArraySetRecordInfo	0x005e9728	-	-
SafeArrayAllocData	0x005e9730	-	-
SafeArrayDestroy	0x005e9738	-	-
SysStringByteLen	0x005e9740	-	-
SysAllocStringByteLen	0x005e9748	-	-
SafeArrayCreateVector	0x005e9750	-	-
SafeArrayPutElement	0x005e9758	-	-
LoadRegTypeLib	0x005e9760	-	-
CreateErrorInfo	0x005e9768	-	-
SafeArrayGetDim	0x005e9770	-	-
SysAllocStringLen	0x005e9778	-	-
SysAllocString	0x005e9780	-	-
SysStringLen	0x005e9788	-	-
SetErrorInfo	0x005e9790	-	-
GetErrorInfo	0x005e9798	-	-
SysFreeString	0x005e97a0	-	-
SafeArrayGetElemsize	0x005e97a8	-	-
SafeArrayGetLBound	0x005e97b0	-	-

▸USER32.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
MessageBoxW	0x005e97d0	-	-
LoadStringW	0x005e97d8	-	-

▸SHELL32.dll1 func 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
ShellExecuteW	0x005e97c0	-	T1106

▸api-ms-win-crt-string-l1-1-0.dll36 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
strcat_s	0x005e9cd8	-	-
strcpy_s	0x005e9ce0	-	-
_strnicmp	0x005e9ce8	-	-
_wcsicmp	0x005e9cf0	-	-
wcsncpy_s	0x005e9cf8	-	-
wcsncmp	0x005e9d00	-	-
iswupper	0x005e9d08	-	-
towlower	0x005e9d10	-	-
isalpha	0x005e9d18	-	-
isdigit	0x005e9d20	-	-
wcstok_s	0x005e9d28	-	-
strncpy_s	0x005e9d30	-	-
strcspn	0x005e9d38	-	-
strncmp	0x005e9d40	-	-
strlen	0x005e9d48	-	-
isupper	0x005e9d50	-	-
strtok_s	0x005e9d58	-	-
isspace	0x005e9d60	-	-
_wcsdup	0x005e9d68	-	-
_strdup	0x005e9d70	-	-
_wcsnicmp	0x005e9d78	-	-
islower	0x005e9d80	-	-
wcscpy_s	0x005e9d88	-	-
strcmp	0x005e9d90	-	-
wcsnlen	0x005e9d98	-	-
__strncnt	0x005e9da0	-	-
strnlen	0x005e9da8	-	-
toupper	0x005e9db0	-	-
iswascii	0x005e9db8	-	-
towupper	0x005e9dc0	-	-
wcscat_s	0x005e9dc8	-	-
tolower	0x005e9dd0	-	-
_stricmp	0x005e9dd8	-	-
iswspace	0x005e9de0	-	-
strncat_s	0x005e9de8	-	-
wcsncat_s	0x005e9df0	-	-

▸api-ms-win-crt-stdio-l1-1-0.dll35 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_set_fmode	0x005e9bb8	-	-
fwrite	0x005e9bc0	-	-
__stdio_common_vsnwprintf_s	0x005e9bc8	-	-
__stdio_common_vswprintf	0x005e9bd0	-	-
__stdio_common_vfwprintf	0x005e9bd8	-	-
__stdio_common_vsprintf_s	0x005e9be0	-	-
fputwc	0x005e9be8	-	-
__p__commode	0x005e9bf0	-	-
_flushall	0x005e9bf8	-	-
fputws	0x005e9c00	-	-
_get_stream_buffer_pointers	0x005e9c08	-	-
_fseeki64	0x005e9c10	-	-
fread	0x005e9c18	-	-
fseek	0x005e9c20	-	-
fsetpos	0x005e9c28	-	-
ungetc	0x005e9c30	-	-
fgetpos	0x005e9c38	-	-
__acrt_iob_func	0x005e9c40	-	-
fflush	0x005e9c48	-	-
ftell	0x005e9c50	-	-
fgetc	0x005e9c58	-	-
fputc	0x005e9c60	-	-
_wfsopen	0x005e9c68	-	-
_fileno	0x005e9c70	-	-
_dup	0x005e9c78	-	-
setvbuf	0x005e9c80	-	-
_setmode	0x005e9c88	-	-
__stdio_common_vfprintf	0x005e9c90	-	-
fputs	0x005e9c98	-	-
__stdio_common_vsnprintf_s	0x005e9ca0	-	-
__stdio_common_vsscanf	0x005e9ca8	-	-
fgets	0x005e9cb0	-	-
_wfopen	0x005e9cb8	-	-
fclose	0x005e9cc0	-	-
fopen	0x005e9cc8	-	-

▸api-ms-win-crt-runtime-l1-1-0.dll25 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_beginthreadex	0x005e9ae8	-	-
terminate	0x005e9af0	-	-
_invalid_parameter_noinfo_noreturn	0x005e9af8	-	-
_controlfp_s	0x005e9b00	-	-
_invalid_parameter_noinfo	0x005e9b08	-	-
_register_thread_local_exe_atexit_callback	0x005e9b10	-	-
_c_exit	0x005e9b18	-	-
__p___wargv	0x005e9b20	-	-
__p___argc	0x005e9b28	-	-
_exit	0x005e9b30	-	-
_initterm_e	0x005e9b38	-	-
abort	0x005e9b40	-	-
exit	0x005e9b48	-	-
_initialize_onexit_table	0x005e9b50	-	-
_register_onexit_function	0x005e9b58	-	-
_crt_atexit	0x005e9b60	-	-
_cexit	0x005e9b68	-	-
_seh_filter_exe	0x005e9b70	-	-
_set_app_type	0x005e9b78	-	-
_wcserror_s	0x005e9b80	-	-
_configure_wide_argv	0x005e9b88	-	-
_initialize_wide_environment	0x005e9b90	-	-
_get_initial_wide_environment	0x005e9b98	-	-
_initterm	0x005e9ba0	-	-
_errno	0x005e9ba8	-	-

▸api-ms-win-crt-convert-l1-1-0.dll9 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
wcstoul	0x005e97e8	-	-
_wtoi	0x005e97f0	-	-
_wcstoui64	0x005e97f8	-	-
_atoi64	0x005e9800	-	-
_ltow_s	0x005e9808	-	-
strtoul	0x005e9810	-	-
atol	0x005e9818	-	-
_itow_s	0x005e9820	-	-
strtoull	0x005e9828	-	-

▸api-ms-win-crt-heap-l1-1-0.dll5 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
realloc	0x005e9870	-	-
calloc	0x005e9878	-	-
free	0x005e9880	-	-
malloc	0x005e9888	-	-
_set_new_mode	0x005e9890	-	-

▸api-ms-win-crt-utility-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
qsort	0x005e9e20	-	-

▸api-ms-win-crt-math-l1-1-0.dll62 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
coshf	0x005e98f0	-	-
expf	0x005e98f8	-	-
cosh	0x005e9900	-	-
cosf	0x005e9908	-	-
cos	0x005e9910	-	-
ceilf	0x005e9918	-	-
ceil	0x005e9920	-	-
atanf	0x005e9928	-	-
atan2f	0x005e9930	-	-
atan2	0x005e9938	-	-
log10	0x005e9940	-	-
asinf	0x005e9948	-	-
asin	0x005e9950	-	-
acosf	0x005e9958	-	-
acos	0x005e9960	-	-
_copysign	0x005e9968	-	-
_isnan	0x005e9970	-	-
_finite	0x005e9978	-	-
log2	0x005e9980	-	-
atanh	0x005e9988	-	-
acosh	0x005e9990	-	-
cbrt	0x005e9998	-	-
asinh	0x005e99a0	-	-
asinhf	0x005e99a8	-	-
atanhf	0x005e99b0	-	-
cbrtf	0x005e99b8	-	-
acoshf	0x005e99c0	-	-
modf	0x005e99c8	-	-
log2f	0x005e99d0	-	-
modff	0x005e99d8	-	-
floor	0x005e99e0	-	-
logf	0x005e99e8	-	-
floorf	0x005e99f0	-	-
log	0x005e99f8	-	-
fma	0x005e9a00	-	-
fmodf	0x005e9a08	-	-
pow	0x005e9a10	-	-
_fdopen	0x005e9a18	-	-
powf	0x005e9a20	-	-
sin	0x005e9a28	-	-
_copysignf	0x005e9a30	-	-
_isnanf	0x005e9a38	-	-
trunc	0x005e9a40	-	-
truncf	0x005e9a48	-	-
ilogb	0x005e9a50	-	-
ilogbf	0x005e9a58	-	-
fmaf	0x005e9a60	-	-
sinf	0x005e9a68	-	-
exp	0x005e9a70	-	-
sinh	0x005e9a78	-	-
log10f	0x005e9a80	-	-
frexp	0x005e9a88	-	-
sinhf	0x005e9a90	-	-
sqrt	0x005e9a98	-	-
sqrtf	0x005e9aa0	-	-
tan	0x005e9aa8	-	-
fmod	0x005e9ab0	-	-
tanf	0x005e9ab8	-	-
tanh	0x005e9ac0	-	-
atan	0x005e9ac8	-	-
tanhf	0x005e9ad0	-	-
__setusermatherr	0x005e9ad8	-	-

▸api-ms-win-crt-time-l1-1-0.dll3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_gmtime64_s	0x005e9e00	-	-
_time64	0x005e9e08	-	-
wcsftime	0x005e9e10	-	-

▸api-ms-win-crt-environment-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
getenv	0x005e9838	-	-

▸api-ms-win-crt-locale-l1-1-0.dll9 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__pctype_func	0x005e98a0	-	-
_lock_locales	0x005e98a8	-	-
_configthreadlocale	0x005e98b0	-	-
___lc_codepage_func	0x005e98b8	-	-
___mb_cur_max_func	0x005e98c0	-	-
setlocale	0x005e98c8	-	-
_unlock_locales	0x005e98d0	-	-
localeconv	0x005e98d8	-	-
___lc_locale_name_func	0x005e98e0	-	-

▸api-ms-win-crt-filesystem-l1-1-0.dll4 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_wremove	0x005e9848	-	-
_wrename	0x005e9850	-	-
_unlock_file	0x005e9858	-	-
_lock_file	0x005e9860	-	-

Binary metadata

what the headers declare about this build

Resource langs	NEU
Debug info	yes
TLS callbacks	yes

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Resources

Resource Hacker view

Manifest1RCData2Version Info1

▸Manifest1

1NEU

▸RCData2

CLRDEBUGINFONEU

MINIDUMP_EMBEDDED_AUXILIARY_PROVIDERNEU

▸Version Info1

1NEU

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Manifest 1 Download

Type	Manifest
Name / ID	1
Language	NEU
Size	490.0 B
RVA offset	0x91292c
Content signature	XML manifest
MD5	b7db84991f23a680df8e95af8946f9c9
Entropy	5.001

Application manifest

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

RCData CLRDEBUGINFO Download

Type	RCData
Name / ID	CLRDEBUGINFO
Language	NEU
Size	36.0 B
RVA offset	0x7cf17c
Content signature	RCData
MD5	f46e116e8e7909e87cc7e94bc40e158e
Entropy	4.26

RCData MINIDUMP_EMBEDDED_AUXILIARY_PROVIDER Download

Type	RCData
Name / ID	MINIDUMP_EMBEDDED_AUXILIARY_PROVIDER
Language	NEU
Size	1.3 MB
RVA offset	0x7cf1a0
Content signature	PE executable
MD5	b21bef0d650f6d70cba17dfab82efc13
Entropy	6.367

Version Info 1 Download

Type	Version Info
Name / ID	1
Language	NEU
Size	884.0 B
RVA offset	0x9125b8
Content signature	Version Info
MD5	79ede0c015fb579d3881857f8873e358
Entropy	3.234

Parsed version info

CompanyName	Universal_Video_Downloader
FileVersion	1.0.0.0
ProductName	Universal_Video_Downloader
InternalName	Universal_Video_Downloader.dll
LegalCopyright
ProductVersion	1.0.0
FileDescription	Universal_Video_Downloader
Assembly Version	1.0.0.0
OriginalFilename	Universal_Video_Downloader.dll

Similar samples

2 related samples

Ranked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.

Relation	Sample	Verdict	Why it matched
related	SACGUI.exe	Suspicious	identical export table (exphash)
related	Rewind.Launcher.exe	Suspicious	identical export table (exphash)

Threat classification

Signature family candidates

Family	Agreeing rules	Matched rules	Disposition
Tiger RAT	1	TigerRAT_pe_yaraify	Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.
COD3NYM DOTNET Singlefilehost Bundled App	1	COD3NYM_DOTNET_Singlefilehost_Bundled_App	Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.

Capability detection

not completed

The capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.

Signature matches

9 findings · 5 file properties · 2 scored

Rule	What it matched	Corpus	Weight
Suspicious_Anti_Debug_API	Anti-debugging API names referenced 3 of 4 strings matched $a IsDebuggerPresent at 0x760458 · 2 hits $c NtQueryInformationProcess at 0x11c181b · 2 hits $d OutputDebugString at 0x76046c · 6 hits	Built-in ruleset this platform ships, and the only one the score reads	SCORED 5 Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
Embedded_PE_In_Overlay	A second MZ/PE header appears inside the file body 1 of 1 string matched $mz MZ at 0x0 · 513 hits	Built-in ruleset this platform ships, and the only one the score reads	SCORED 5 Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
COD3NYM_DOTNET_Singlefilehost_Bundled_App FILE rule dated 2024-01-02	Detects single file host .NET bundled apps. 1 of 2 strings matched $ singlefilehost.exe at 0x75f29a $ singlefilehost.pdb at 0x6e50a9	Tier 2 - community rule feed may confirm a family name, never establish one on its own	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it. Names COD3NYM DOTNET Singlefilehost Bundled App, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
TigerRAT_pe_yaraify rule dated 2026-08-21	YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits 1 of 1 string matched $c0 \x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed at 0x5997f2 · 4 hits	Tier 1 - curated family set licence-gated and benign-tested; may name a malware family	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it. Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
RooterStrings RooterFamily rule dated 2014-07-10	Rooter Identifying Strings 3 of 5 strings matched $group1 seed\x00 at 0xc2c26f · 7 hits $group2 prot\x00 at 0x282ad28 $group5 nown\x00 at 0x69c575 · 73 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
Rooter Family rule dated 2014-07-10	Rooter matched on its condition alone - the rule declares no strings	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
Njrat RAT	Njrat 11 of 17 strings matched $string1 FromBase64String at 0x106aa39 · 10 hits $string2 Base64String at 0x106aa3d · 21 hits $string3 Connected at 0x1062ad5 · 32 hits $string4 Receive at 0x6b5b00 · 276 hits $string5 Send at 0x6b26b3 · 440 hits $string6 DownloadData at 0x1ea7635 · 17 hits $string7 DeleteSubKey at 0xaeb487 · 6 hits $string8 get_MachineName at 0xaebd80 · 4 hits and 3 more	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
win_exe_njRAT rule dated 2013-07-15	No description 13 of 16 strings matched $magic MZ at 0x0 $string_setA_1 FromBase64String at 0x106aa39 · 10 hits $string_setA_2 Base64String at 0x106aa3d · 21 hits $string_setA_3 Connected at 0x1062ad5 · 32 hits $string_setA_4 Receive at 0x6b5b00 · 276 hits $string_setA_5 DeleteSubKey at 0xaeb487 · 6 hits $string_setA_6 get_MachineName at 0xaebd80 · 4 hits $string_setA_7 get_UserName at 0x11c3acd · 10 hits and 5 more	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
possible_includes_base64_packed_functions	Detects possible includes and packed functions 2 of 2 strings matched $f atOb at 0xaee876 · 4 hits $fff This at 0x4e · 1000000 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.

File properties - not findings

IsPE64IsConsoleHasOverlayHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

Extracted strings

showing 200 of 2279

!This program cannot be run in DOS mode.
Rich
.text
`.CLR_UEF
`.rdata
@.data
.pdata
@.didat
Section
_RDATA
@.rsrc
@.reloc
VWATAVAWH
@pRCC
l$ VWATAVAWH
t$ AWH
@USVWATAUAVAWH
UWATAVAWH
EH;Ehs
USVWATAUAVAWH
UWATAVAWI
t$ UWATAVAWH
@USVH
@USVWATAVAWH
@UVATH
ATAVH
|$ ATAVAWH
UVWATAWH
\$ VATAWH
|$ ATAUAVH
@UWATAVAWH
FLL9}ht
t$ AVH
ATAUAVAWH
AH;Ahu
L$ VWATAVAWH
USVWATAWH
UVWATAVH
TOORt
TOOR
@VWATAUAWH
L$ ATAVAWH
{ ATAVAWH
5s%s
l$ AVL
@USWATAUAVAWH
USVWATAVAWH
USWH
VWATAUAVH
RLCH
HESt
UATAVH
USWATAUAVAWH
USVWH
u(toE
ATAVAWH
USVWATAUAWH
@SWATAVAWH
=.ip
SWATAVAWH
M+BPA
\$ UVWATAWH
z%u#H
s.ff
\$ UVATAVAWH
|$ UATAWH
@SVWATAVH
VWATH
@UATAVAWH
WATAUAWH
USVWATAUH
VWATAUAWH
oufH
@USVWATAVH
UWATAUAVH
@UVATAVAWH
@SUATAVH
@USVWH
T$HMc
ureH
t$ UWATAUAWH
file
.dll
KERNEL32.DLL
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
api-ms-
NotSupported_CollectibleBoundNonCollectible
NotSupported_CollectibleAssemblyResolve
DefaultDomain
System.Private.CoreLib.dll
cejl
RefEmit_InMemoryManifestModule
ArgumentNull_AssemblyNameName
InvalidAssemblyName
MVID mismatch between loaded assembly '%s' (MVID = %s) and an assembly with the same simple name embedded in the native image '%s' (MVID = %s)
MVID mismatch between loaded assembly '%s' (MVID = %s) and version of assembly '%s' expected by assembly '%s' (MVID = %s)
Default
Microsoft.DiaSymReader.Native.amd64.dll
NATIVE_DLL_SEARCH_DIRECTORIES
TRUSTED_PLATFORM_ASSEMBLIES
PLATFORM_RESOURCE_ROOTS
APP_PATHS
DEFAULT_STACK_SIZE
USE_ENTRYPOINT_FILTER
FaultRep.dll
g.NET Stack overflow create dump
StatusBreakpoint
Unhandled exception.
ArgumentNull_Generic
NULL
System.GC.Name
InvalidOperation_CantInstantiateFunctionPointer
InvalidOperation_CantInstantiateAbstractClass
InvalidOperation_TypeCannotBeBoxed
NotSupported_ByRefLike
<null>
Failed to load JIT compiler
Failed to load alternative JIT compiler
Verify_TypeLayout '%s' failed to verify type layout
Verify_FieldOffset '%s.%s' Field offset %d!=%d(actual) || baseOffset %d!=%d(actual)
(NULL)
Verify_VirtualFunctionOverride Decl Method '%s' on type '%s' is '%s'(actual) instead of expected '%s'(from compiler)
VERIFY_IL_BODY Method '%s' type '%s' does not match IL body expected DEBUGINFO MethodData {%d} {%p} RuntimeMethodData {%d} {%p} Types {%d} {%p} RuntimeTypes {%d} {%p}
Arg_MissingFieldException
dynamicClass
Arg_InvalidUTF8String
Failed to setup new thread during reverse P/Invoke
@WriteBarrier
NotSupported_MaxWaitHandles_STA
)kernel32
.NET Tiered Compilation Worker
!!%d
FNPTR
(null)
VALUETYPE
(fnptr)
(dynamicClass)
System.Threading.ThreadPool.MinThreads
System.Threading.ThreadPool.MaxThreads
ntdll.dll
api-ms-win-core-synch-l1-1-0.dll
.NET ThreadPool Worker
.NET ThreadPool Wait
.NET ThreadPool Gate
The CLR ThreadPool detected work queue starvation!
%s.%u
ArgumentNull_String
Format_StringZeroLength
Arg_InvalidHandle
ArgumentNull_FileName
Argument_EmptyFileName
NotSupported_DebuggerAttached
InvalidOperation_AssemblyNotEditable
InvalidOperation_EditFailed
%s#%d
Arg_OleAutDateInvalid
Arg_OleAutDateScale
Arg_DlgtTargMeth
Argument_NeedNonGenericType
delegate
Arg_MustBeDelegate
method
Arg_DlgtNullInst
InvalidProgram_NonStaticMethod
InvalidProgram_GenericMethod
InvalidProgram_NonBlittableTypes
NotSupported_UnmanagedCallersOnlyTarget
Argument_DuplicateTypeName
Argument_BadConstantValue
ArgumentNull_Type
<In Memory Module>
Arg_InvalidSwitchName
Argument_InvalidFlag
ThreadState_AlreadyStarted
NullReference_This
ThreadState_Dead_Priority
ThreadState_SetPriorityFailed
ArgumentOutOfRange_NeedNonNegOrNegative1
millisecondsTimeout
ThreadState_Dead_State
ThreadState_NotStarted
System.Threading.ThreadPool.DisableStarvationDetection
System.Threading.ThreadPool.DebugBreakOnWorkerStarvation
System.Threading.ThreadPool.EnableWorkerTracking
System.Threading.ThreadPool.UnfairSemaphoreSpinLimit
System.Threading.ThreadPool.HillClimbing.Disable
System.Threading.ThreadPool.HillClimbing.WavePeriod
System.Threading.ThreadPool.HillClimbing.TargetSignalToNoiseRatio
System.Threading.ThreadPool.HillClimbing.ErrorSmoothingFactor
System.Threading.ThreadPool.HillClimbing.WaveMagnitudeMultiplier
System.Threading.ThreadPool.HillClimbing.MaxWaveMagnitude
System.Threading.ThreadPool.HillClimbing.WaveHistorySize
System.Threading.ThreadPool.HillClimbing.Bias
System.Threading.ThreadPool.HillClimbing.MaxChangePerSecond
System.Threading.ThreadPool.HillClimbing.MaxChangePerSample
System.Threading.ThreadPool.HillClimbing.MaxSampleErrorPercent
System.Threading.ThreadPool.HillClimbing.SampleIntervalLow
System.Threading.ThreadPool.HillClimbing.SampleIntervalHigh
System.Threading.ThreadPool.HillClimbing.GainExponent

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)

AddressBytesMnemonicOperands

0x140597bd04883ec28subrsp, 0x28

0x140597bd4e8e3030000call0x140597fbc

0x140597bd94883c428addrsp, 0x28

0x140597bdde96afeffffjmp0x140597a4c

0x140597be2ccint3

0x140597be3ccint3

0x140597be448895c2410movqword ptr [rsp + 0x10], rbx

0x140597be94889742418movqword ptr [rsp + 0x18], rsi

0x140597bee57pushrdi

0x140597bef4883ec10subrsp, 0x10

0x140597bf333c0xoreax, eax

0x140597bf533c9xorecx, ecx

0x140597bf70fa2cpuid

0x140597bf9448bc1movr8d, ecx

0x140597bfc4533dbxorr11d, r11d

0x140597bff448bd2movr10d, edx

0x140597c024181f06e74656cxorr8d, 0x6c65746e

0x140597c094181f2696e6549xorr10d, 0x49656e69

0x140597c10448bcbmovr9d, ebx

0x140597c138bf0movesi, eax

0x140597c1533c9xorecx, ecx

0x140597c17418d4301leaeax, [r11 + 1]

0x140597c1b450bd0orr10d, r8d

0x140597c1e0fa2cpuid

0x140597c204181f147656e75xorr9d, 0x756e6547

0x140597c27890424movdword ptr [rsp], eax

0x140597c2a450bd1orr10d, r9d

0x140597c2d895c2404movdword ptr [rsp + 4], ebx

0x140597c318bf9movedi, ecx

0x140597c33894c2408movdword ptr [rsp + 8], ecx

0x140597c378954240cmovdword ptr [rsp + 0xc], edx

0x140597c3b755bjne0x140597c98

0x140597c3d48830d53d41c00fforqword ptr [rip + 0x1cd453], 0xffffffffffffffff

0x140597c4525f03fff0fandeax, 0xfff3ff0

0x140597c4a48c7053bd41c0000800000movqword ptr [rip + 0x1cd43b], 0x8000

0x140597c553dc0060100cmpeax, 0x106c0

0x140597c5a7428je0x140597c84

0x140597c5c3d60060200cmpeax, 0x20660

0x140597c617421je0x140597c84

0x140597c633d70060200cmpeax, 0x20670

0x140597c68741aje0x140597c84

0x140597c6a05b0f9fcffaddeax, 0xfffcf9b0

0x140597c6f83f820cmpeax, 0x20

0x140597c727724ja0x140597c98

0x140597c7448b90100010001000000movabsrcx, 0x100010001

0x140597c7e480fa3c1btrcx, rax

0x140597c827314jae0x140597c98

0x140597c84448b058d4b1d00movr8d, dword ptr [rip + 0x1d4b8d]

0x140597c8b4183c801orr8d, 1

0x140597c8f448905824b1d00movdword ptr [rip + 0x1d4b82], r8d

0x140597c96eb07jmp0x140597c9f

0x140597c98448b05794b1d00movr8d, dword ptr [rip + 0x1d4b79]

0x140597c9fb807000000moveax, 7

0x140597ca4448d48fblear9d, [rax - 5]

0x140597ca83bf0cmpesi, eax

0x140597caa7c26jl0x140597cd2

0x140597cac33c9xorecx, ecx

0x140597cae0fa2cpuid

0x140597cb0890424movdword ptr [rsp], eax

0x140597cb3448bdbmovr11d, ebx

callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample

Fingerprint	192:PGlF7J8zfusaWP+0xM8Wh0vFAUJgPeQQSEIjXW9N:P07uMsJCPeQHDzW9N
Imports read	458 functions from 17 libraries (458 distinct)
Comparable	yes
Compared against	91 stored samples

Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

12 frames · screen recording · 121s

1 / 12

0:00 · 1/12

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 121s

2 process(es) observed

LaunchedC:\Users\user\Desktop\Universal_Video_Downloader.exe

Privilegestandard

Telemetry sources: Kernel ETW (22 of 241 events) agent poll: 5Process audit: 2In-process monitor: 4

Evasion / anti-analysis checks

2 checks

MED

Anti-debug API imports static-api

MITRE T1622 · getthreadcontext, isdebuggerpresent

MED

YARA: Suspicious_Anti_Debug_API Signature

MITRE T1497

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Anti-analysis API trace

2 APIs · 2 processes hooked

Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

API	Signal	Calls	Sleep	Scored
GetTickCount	timing	1	-	no corroborates, never convicts on its own - ordinary software calls this
Sleep	sleep	100	800 ms total · 8 ms max	no under the floor a stall has to cross (30s in total or 10s at once)

Call order 4 events sampled

SleepSleepGetTickCountSleep

How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

No module load worth listing. In-process hooks were placed in 2 processes and recorded no explicit module load, so this is an observation rather than a gap. Modules brought in by the sample's own import table are never seen here.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 680 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

2 read

2 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

2processes

2file operations

Universal_Video_Downloader.exe

2 processes

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

File operations1

1Mechanisms found

90Methods checked

1ATT&CK techniques

LOWHighest severity

Persistence mechanisms

1 found

Method	Family	ATT&CK	Evidence	Severity
.NET Startup Hook DLL	DLL Load Order	T1574	Static hint	LOW

Runtime evidence means the mechanism was established during detonation. A static hint means the sample only references the technique.

Detection coverage

1 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 1 / 12

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 named
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 2 write 0 modify 1 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

3 file · 0 registry · sample scope

Files (3) Registry (0)

File operation times: 3 timed

Operation	Target	Process
create	C:\Users\user\Desktop\VIDEO same pathkernel tracepoll	Universal_Video_Downloader.exe pid 5880	2026-10-22 15:27:53.703
create	C:\Users\user\Desktop\setting.txt same pathkernel tracepoll	Universal_Video_Downloader.exe pid 5880	2026-10-22 15:27:53.703
modify	C:\Users\user\Desktop\setting.txt same pathpoll	-	2026-10-22 15:27:53.703

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Earlier analysis of these bytes

2 earlier runs

Earlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.

Run	Analysed	Module	Verdict	Score
#2898	2026-10-22 15:26	File Analysis	Suspicious40	40/100
#2897	2026-10-22 15:10	File Analysis	Suspicious40	40/100

1 reported a hit 16 answered no 1 could not answer 5 had nothing to check

1Sources with a hit

18Sources queriedof 23 available

470.6kFeed records

1Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	3,003 records 5 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 3 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,153 records 5 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,680 records 5 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer

Source	Checks	Result	Detail	Feed
URLhaus	IP / domain / URL	feed unavailable	5 observed indicators, none listed	no records ingested
blocklist.de	IP / domain / URL	clean	5 observed indicators, none listed	27.6k records 5 minutes ago
CINS Army	IP / domain / URL	clean	5 observed indicators, none listed	15k records 5 minutes ago
Emerging Threats	IP / domain / URL	clean	5 observed indicators, none listed	482 records 5 minutes ago
Feodo Tracker	IP / domain / URL	clean	5 observed indicators, none listed	5 records 5 minutes ago
IPsum	IP / domain / URL	clean	5 observed indicators, none listed	19.7k records 5 minutes ago
Phishing.Database	IP / domain / URL	clean	5 observed indicators, none listed	391.5k records 3 hours ago
ThreatFox	IP / domain / URL	clean	5 observed indicators, none listed	1,153 records 5 minutes ago

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 9 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

1 of 2 listed

Source	Checks	Result	Detail	Feed
Signature rules	Sample content	9 matches	Suspicious_Anti_Debug_API, Embedded_PE_In_Overlay, COD3NYM_DOTNET_Sin…	110 records 6 minutes ago
Sigma rules	Behavior log	clean	-	2,275 records 5 hours ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	2 process image paths, none masqueraded	245 records 6 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 5 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 5 minutes ago
LOLRMM	Names and domains	clean	3 name/domain indicators checked, no remote-management tooling	360 records 5 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 3 suspicious 0 info

File indicators

Severity	Type	Indicator	Description
suspicious	sample_sha256	845483eca953ba83d33c67dd041a9145aa98e2982bee70e6f636bc855ebf4d0b	Submitted sample (SHA256)
suspicious	sample_md5	5aa5aaf6a3b01150abfdf59082454ca6	Submitted sample (MD5)
suspicious	imphash	354308318ae54a65b5d9ec5f6c43fd91	Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

Artifacts

5 files

Type	Name	Size	What it is	SHA-256	Download
Extracted file	embedded_pe_0c2cfec8e4b9	1.3 MB	PEno detection	0c2cfec8e4b9f5be08646331d4aa2316049d71441597a137f575cd67a5cc2110	ZIP
Extracted file	embedded_pe_70c772f8c300	12.5 KB	PEno detection	70c772f8c30041fcde06cbdd67cec110f4fe15c20aee15de5debb1ab208fbe49	ZIP
Extracted file	embedded_pe_b6f98b5d073d	1.0 MB	PEno detection	b6f98b5d073d7f53a2d1d239e530ed5bc18a8260649daa8204f0dde220ba5f7b	ZIP
Extracted file	embedded_pe_600c7ebc9899	1.2 MB	PEno detection	600c7ebc98997dffe0db1068358ac2e25b3f1700a6ed8d5090ac4844f3124650	ZIP
Extracted file	embedded_pe_c30804096c1f	7.5 KB	PEno detection	c30804096c1f3aef12018b2a36cf31e70b3261bb648f6a7f15fef3c436f8c71e	ZIP

Export & download

/s/2899

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

3 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

Submitted	Environment	Verdict	Score
2026-10-22 15:04 Shown below	Windows 10 22H2	Suspicious	40/100
2026-10-22 15:00	Windows 10 22H2	Suspicious	40/100
2026-10-22 14:55	Windows 10 22H2	Suspicious	40/100

Universal_Video_Downloader.exePE analysis report - Suspicious

Run integrity

Why this verdict

Model reading

Analysis layers

Sample

Run conditions

Detection signatures

Persistence

What the tests returned

Arguing against malice

How much weight this carries

Instrument coverage

Structure

Sections & resources

Signatures & packing

Strings

Code

Antivirus engine

Local ML assessment

Family configuration search

Secrets & malicious strings

Flagged string categories

Capabilities

Security mitigations

Rich header (toolchain)

Sections

Imports

Binary metadata

Code signing

Resources

Resources

Similar samples

Threat classification

Capability detection

Signature matches

Extracted strings

Disassembly

Nothing in this view

Import fingerprint

Screen recording

Behavior summary

Evasion / anti-analysis checks

Anti-analysis API trace

Command lines, unwrapped

Network activity

Process tree

Universal_Video_Downloader.exe

Attributed activity

Not attributed to any process

Persistence mechanisms

Detection coverage

File activity summary

Dropped payload analysis

File & registry ops

Earlier analysis of these bytes

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

AI analysis

File indicators

Sigma detections

Generated rules

No generated rules

Extracted files

Artifacts

Export & download

AI analysis report

Public analyses of this file