Overview
overview
4Static
static
PhotoWipe ...��.url
windows7-x64
1PhotoWipe ...��.url
windows10-2004-x64
1PhotoWipe ...pe.exe
windows7-x64
1PhotoWipe ...pe.exe
windows10-2004-x64
1PhotoWipe ...er.exe
windows7-x64
1PhotoWipe ...er.exe
windows10-2004-x64
1PhotoWipe ...se.rtf
windows7-x64
4PhotoWipe ...se.rtf
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
PhotoWipe 1.11/1001下载乐园.url
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PhotoWipe 1.11/1001下载乐园.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
PhotoWipe 1.11/PhotoWipe.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
PhotoWipe 1.11/PhotoWipe.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
PhotoWipe 1.11/inpainter.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
PhotoWipe 1.11/inpainter.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
PhotoWipe 1.11/license.rtf
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
PhotoWipe 1.11/license.rtf
Resource
win10v2004-20220812-en
General
-
Target
e576e1edec73c603399b2fac38d68ca720febdb5310ff31ffb8bdf46c10461b7
-
Size
571KB
-
MD5
5d4e0431cc1c4dee9fb93bb96ee228d0
-
SHA1
a449ae0d7e7b19a47bba0ae62e3f33d3d44ff97d
-
SHA256
e576e1edec73c603399b2fac38d68ca720febdb5310ff31ffb8bdf46c10461b7
-
SHA512
9a1af888c6d01d7b8b764bbdf06285659b1dca8e530e3b003166943569b36ba97a85852d3ada9fe5c4c0ea0945f43eae3f18e040deb3a7871d403348b09c7145
-
SSDEEP
12288:9P/l5uAIIUPV+PKql8lqGrmLYqU90P7OKUtl2Qz4H60raUWQkHSw4Wzf:9P/lNIIUiGqGXqe0P7M4IhHlMw
Malware Config
Signatures
Files
-
e576e1edec73c603399b2fac38d68ca720febdb5310ff31ffb8bdf46c10461b7.rar
-
PhotoWipe 1.11/1001下载乐园.url.url
-
PhotoWipe 1.11/PhotoWipe.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 408KB - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 401KB - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
PhotoWipe 1.11/inpainter.exe.exe windows x86
4a87670aee39adece5aaea838b228f2c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
PostMessageA
SendMessageA
SetWindowPos
DestroyWindow
ChangeDisplaySettingsA
CreateWindowExA
SetForegroundWindow
GetDC
SetWindowLongA
GetMessageA
DispatchMessageA
GetWindowLongA
PeekMessageA
ShowWindow
ShowCursor
DefWindowProcA
AdjustWindowRect
GetWindowRect
EnumDisplaySettingsA
gdi32
SetDIBitsToDevice
kernel32
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsAlloc
CreateEventA
GetSystemTime
Sleep
ReleaseMutex
WaitForSingleObject
SetEvent
TerminateThread
CreateThread
CreateMutexA
ExitThread
MapViewOfFile
GetLastError
OpenFileMappingA
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetProcAddress
GetModuleHandleA
ExitProcess
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
CloseHandle
HeapSize
LoadLibraryW
GetModuleFileNameA
WideCharToMultiByte
WriteFile
LoadLibraryA
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
HeapReAlloc
VirtualAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
SetStdHandle
CreateFileA
MultiByteToWideChar
GetLocaleInfoA
Sections
.text Size: 196KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
PhotoWipe 1.11/license.rtf.rtf
-
PhotoWipe 1.11/使用说明.txt
-
PhotoWipe 1.11/绿色软件.reg