Filmora[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Filmora.exe
Size

27KB
MD5

bc6c07a2eaf77e9f2f3eb08d471789f7
SHA1

136db5446c17b38aeaacf7c099b78d3205fee4b1
SHA256

1e1c8df89e4c08e201f09988623d2caf679d20f72e678c662978b278b9b050ba
SHA512

a4bed30e01eb95a4ae62b4e1ea630519d351f374471bd8e60ae496c91e0d91d268c15b77c2eda888926d8e6d79aef5d0b507b6f010371be0a887a1b1971b4513
SSDEEP

384:9/VHmYmD1/OJtg0wmwOvOSSaosiho21MbDgf2hCwDGBs1UDgf2hw:Ip/u6tAvOSSao3hjMbUf2h1DGBXUf2hw

Score

1^/10

Malware Config

Signatures

Files

Filmora.exe
.exe windows x64

e6da7cf901e6d11749549ac5a6650e7d

Code Sign

0a:9f:96:aa:bf:b5:da:c0:f2:9f:56:5d:33:ff:1a:f6
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/02/2020, 00:00

Not After

11/04/2022, 12:00

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:bc:d7:f9:30:84:77:c3:84:6b:c9:54:78:fa:65:68
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/02/2020, 00:00

Not After

11/04/2022, 12:00

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:4a:d1:33:de:ce:6a:0e:a3:32:1c:97:ae:96:23:b6:29:72:40:80:74:de:38:0f:f4:19:b7:87:e1:f1:71:1f
Signer

Actual PE Digest

4b:4a:d1:33:de:ce:6a:0e:a3:32:1c:97:ae:96:23:b6:29:72:40:80:74:de:38:0f:f4:19:b7:87:e1:f1:71:1f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

17/11/2020, 14:57
Valid: true

Chain 1

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

d5:2d:34:97:e7:91:c6:e7:8d:58:4e:78:18:d6:0a:f7:94:f8:5a:c3
Signer

Actual PE Digest

d5:2d:34:97:e7:91:c6:e7:8d:58:4e:78:18:d6:0a:f7:94:f8:5a:c3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

17/11/2020, 14:57
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

qt5core

?toNativeSeparators@QDir@@SA?AVQString@@AEBV2@@Z
?startDetached@QProcess@@SA_NAEBVQString@@@Z
??1QProcess@@UEAA@XZ
??0QProcess@@QEAA@PEAVQObject@@@Z
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
??1QCoreApplication@@UEAA@XZ
??0QCoreApplication@@QEAA@AEAHPEAPEADH@Z
?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z
?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z
??1QString@@QEAA@XZ
??0QChar@@QEAA@UQLatin1Char@@@Z

msvcp120

?_Winerror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z

msvcr120

_XcptFilter
__crtSetUnhandledExceptionFilter
_purecall
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memmove
_CxxThrowException
__CxxFrameHandler3
memcpy
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
??_V@YAXPEAX@Z
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ

kernel32

DecodePointer
WideCharToMultiByte
LocalFree
GetCommandLineW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
EncodePointer

shell32

CommandLineToArgvW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6da7cf901e6d11749549ac5a6650e7d

Code Sign

0a:9f:96:aa:bf:b5:da:c0:f2:9f:56:5d:33:ff:1a:f6Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

07:bc:d7:f9:30:84:77:c3:84:6b:c9:54:78:fa:65:68Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

4b:4a:d1:33:de:ce:6a:0e:a3:32:1c:97:ae:96:23:b6:29:72:40:80:74:de:38:0f:f4:19:b7:87:e1:f1:71:1fSigner

Signature Validations

Verification

17/11/2020, 14:57 Valid: true

Chain 1

d5:2d:34:97:e7:91:c6:e7:8d:58:4e:78:18:d6:0a:f7:94:f8:5a:c3Signer

Signature Validations

Verification

17/11/2020, 14:57 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

qt5core

msvcp120

msvcr120

kernel32

shell32

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 432B

.pdata Size: 512B - Virtual size: 444B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 108B

0a:9f:96:aa:bf:b5:da:c0:f2:9f:56:5d:33:ff:1a:f6
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

07:bc:d7:f9:30:84:77:c3:84:6b:c9:54:78:fa:65:68
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

4b:4a:d1:33:de:ce:6a:0e:a3:32:1c:97:ae:96:23:b6:29:72:40:80:74:de:38:0f:f4:19:b7:87:e1:f1:71:1f
Signer

17/11/2020, 14:57
Valid: true

d5:2d:34:97:e7:91:c6:e7:8d:58:4e:78:18:d6:0a:f7:94:f8:5a:c3
Signer

17/11/2020, 14:57
Valid: false

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 432B

.pdata
Size: 512B - Virtual size: 444B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 108B