Static task
static1
General
-
Target
Wondershare Helper Compact.exe
-
Size
11KB
-
MD5
45fbd7b4a57994922d58541202713336
-
SHA1
42b51b345f16133defdd8495468abba2ba8184e1
-
SHA256
0c3169530c3209fa9aa5dcad6c28cb6b7ddef63dba8c784ac603d9293fd3a053
-
SHA512
465c763ac13a7f47c3d32e9433a1aa26e30d8aa19d5f9cfbafb4348256807a98ead9c3d2b96f915d19731f617ceac992bd6b2e8ebaa81d976c326a1abc82db93
-
SSDEEP
192:+bexAmUjQPHfo0g7gXp+3NPC/aaXTRwAEDEeR:+KxAmKYHfoRgwdyXq
Malware Config
Signatures
Files
-
Wondershare Helper Compact.exe.exe windows x64
3789e70fbcb199b6bf031e51b6bd85ff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
CloseHandle
GetCommandLineW
LocalFree
GetCurrentProcess
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
DecodePointer
OpenEventW
EncodePointer
user32
GetWindowThreadProcessId
GetWindow
wsprintfW
PostThreadMessageW
IsWindowVisible
EnumWindows
advapi32
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
shell32
CommandLineToArgvW
msvcr120
_onexit
wprintf
wcstol
wcscpy_s
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__C_specific_handler
_wcmdln
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_wcsicmp
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ