WhiteSoftFilmora[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

WhiteSoftFilmora.rar
Size

119KB
MD5

bb3da1952df99754b4b8eac453208773
SHA1

6f3aab3dbc168c336fe486e30b8c153130a233c2
SHA256

254de461de6d051de2a61e54f2d62801de5e4ec5f11973a4f472baef77d68d8e
SHA512

32b19fb0616f9d10013fc0f5578610f44a25078b21f7ac9967b74dbb8256cdf20c3ff0c13f0b0dc17191dcf6966e1d13df279a7d7061d8eeb1627a2d818bae2d
SSDEEP

3072:Kmg1krVFFp2uZP6VBbpDJnAL+jxjjjuLvYco2DYd:zg6BFFpxZuBfAqjxXL/2DK

Score

N/A

Malware Config

Signatures

Files

WhiteSoftFilmora.rar
.rar

Password: 1234
Wh1tesoft.exe
.exe windows x86

Password: 1234

d77125785d1206b9f7899297fb63c5da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetCommandLineW
AddAtomW
AreFileApisANSI
CreateFileW
GetCurrentThreadId
SetFileValidData
DeleteAtom
GetFileType
GetCurrentProcessId
InitializeCriticalSection
IsProcessorFeaturePresent
ConvertThreadToFiber
GetCurrentProcess
GetFileInformationByHandle
GetThreadIOPendingFlag
SetEndOfFile
SetLastError
GetConsoleWindow
GetModuleHandleA
GetProcAddress
HeapSize
GetLocaleInfoA
GetCommandLineA
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

ShowWindow

gdi32

GetObjectA
GetStockObject
SetBkMode
SetTextColor
CreateFontIndirectA
SelectObject
DeleteObject

comdlg32

GetOpenFileNameA
GetSaveFileNameA

advapi32

RegSetValueA
GetUserNameA
RegCloseKey
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyA

shell32

DuplicateIcon
SHQueryRecycleBinW
SHChangeNotify
ord18
ExtractAssociatedIconW

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1234

Password: 1234

d77125785d1206b9f7899297fb63c5da

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

Sections

.text Size: 64KB - Virtual size: 64KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 176KB - Virtual size: 179KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 64KB - Virtual size: 64KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 176KB - Virtual size: 179KB

.rsrc
Size: 2KB - Virtual size: 1KB