filmora-idco_setup_full1901[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

filmora-idco_setup_full1901.exe
Size

3.1MB
MD5

234d179bb75b96def8554d21e956e75a
SHA1

40aa61e3e26fab4a4ed47cabb8a2efbc7db23713
SHA256

b7a1b8de6cfbc68e0267be0b50633993c3b345d0b15bdc9c929717168fbc7277
SHA512

ee2a1f3f736cd7b1c917ca3d5ed081f83ff98fb1fabd6ee936fce35f366aaf81f7665b5d5f268ee9b349fa73b637a7d92b571d4638fc4032356848bc21c46a22
SSDEEP

49152:+tz+UY+7vdC+ksQtLEaD842HK5WuJ/T5PjWupMuof9NncPINTZyJSNyx8Jiz:+tz+K7F2sqH842K5WuTWtZkINQB

Score

1^/10

Malware Config

Signatures

Files

filmora-idco_setup_full1901.exe
.exe windows x86

12b776487a52460cdbaf3037dbd11120

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20/04/2022, 00:00

Not After

05/04/2025, 23:59

Subject

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20/04/2022, 00:00

Not After

05/04/2025, 23:59

Subject

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:11:61:ec:72:8f:1b:16:eb:f3:bf:59:f3:63:97:45:b3:ea:79:91:a7:16:9d:98:c3:82:b7:ba:27:46:f9:63
Signer

Actual PE Digest

2b:11:61:ec:72:8f:1b:16:eb:f3:bf:59:f3:63:97:45:b3:ea:79:91:a7:16:9d:98:c3:82:b7:ba:27:46:f9:63

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

15/12/2022, 05:39
Valid: true

Chain 1

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

19:f8:9f:41:ee:77:fd:66:96:49:ca:3a:cb:02:68:34:03:5c:93:42
Signer

Actual PE Digest

19:f8:9f:41:ee:77:fd:66:96:49:ca:3a:cb:02:68:34:03:5c:93:42

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

15/12/2022, 05:39
Valid: true

Chain 1

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

wldap32

ord211
ord27
ord60
ord45
ord143
ord46
ord41
ord22
ord217
ord50
ord26
ord301
ord33
ord79
ord35
ord32
ord200
ord30

crypt32

CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertFindExtension
CryptDecodeObjectEx
CryptQueryObject
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CryptStringToBinaryA

kernel32

lstrcmpiW
lstrcpynW
lstrcpyW
SetLastError
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
QueryPerformanceFrequency
SleepEx
QueryPerformanceCounter
VerifyVersionInfoA
GetEnvironmentVariableA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
MoveFileExA
GetFileSizeEx
CreateFileA
GetDriveTypeW
GetCurrentProcess
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetEnvironmentVariableW
SetErrorMode
CreateProcessW
GetExitCodeProcess
TerminateProcess
lstrcmpW
SetEndOfFile
TerminateThread
GetFileAttributesExW
CreateThread
SetFilePointerEx
SetFileAttributesW
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
GetLocalTime
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateTimerQueue
MoveFileExW
FindNextFileW
GetFileInformationByHandle
FileTimeToLocalFileTime
AreFileApisANSI
RtlUnwind
GetCommandLineA
LoadLibraryExW
ExitThread
IsProcessorFeaturePresent
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
FindClose
GetCPInfo
OutputDebugStringW
IsDebuggerPresent
GetStringTypeW
EncodePointer
GetExitCodeThread
GetCurrentThread
DuplicateHandle
ChangeTimerQueueTimer
GlobalAlloc
RegisterWaitForSingleObject
UnregisterWait
VerSetConditionMask
FormatMessageW
CreateTimerQueueTimer
LocalFree
UnhandledExceptionFilter
GetStartupInfoW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetModuleHandleExW
GetFullPathNameW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetStdHandle
GetThreadTimes
FreeLibraryAndExitThread
ReleaseSemaphore
InitializeSListHead
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
SetConsoleCtrlHandler
WriteConsoleW
SetEnvironmentVariableA
GetVersion
InterlockedCompareExchange
InterlockedExchangeAdd
DeleteFiber
ConvertFiberToThread
GlobalMemoryStatus
SetConsoleMode
ReadConsoleA
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
SystemTimeToFileTime
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
GetFileAttributesW
CreateDirectoryW
CreateMutexW
ReleaseMutex
MulDiv
ExitProcess
WideCharToMultiByte
lstrlenW
GlobalUnlock
GlobalLock
GetModuleHandleW
GetTickCount
ReadFile
GetFileSize
GetCurrentDirectoryW
GetACP
MultiByteToWideChar
DeleteFileW
CreateSemaphoreW
SetUnhandledExceptionFilter
FreeResource
OpenProcess
GetCurrentProcessId
GetModuleFileNameW
VirtualQuery
WriteFile
CreateFileW
lstrcatW
GetTempPathW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
Sleep
CreateEventW
GetNativeSystemInfo
GetVersionExW
LoadLibraryW
GetProcAddress
GetTimeZoneInformation
WaitForSingleObject
SetEvent
CloseHandle
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLCID
GetSystemDefaultLCID
GetCurrentThreadId
FindResourceExW
FindResourceW
LoadResource
LockResource
SetThreadAffinityMask

user32

wsprintfW
GetSystemMetrics
ScreenToClient
PtInRect
GetWindowRect
LoadIconW
IsWindow
GetClassNameW
PostQuitMessage
MessageBoxW
IsIconic
ShowWindow
DrawTextA
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
FindWindowW
GetLastActivePopup
CreatePopupMenu
AppendMenuW
GetCursorPos
TrackPopupMenu
BringWindowToTop
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA
UpdateWindow
IsWindowEnabled
SetRect
DrawTextW
CharPrevW
GetWindowRgn
UpdateLayeredWindow
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
EnableMenuItem
DestroyMenu
GetGUIThreadInfo
FillRect
ClientToScreen
GetCaretBlinkTime
InvalidateRgn
CreateAcceleratorTableW
MoveWindow
EqualRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetWindowRgn
AdjustWindowRectEx
GetPropW
SetPropW
GetMenu
EnableWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
IsRectEmpty
IntersectRect
GetSysColor
MapWindowPoints
GetClientRect
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
SetForegroundWindow
SetActiveWindow
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
CreateWindowExW
DestroyWindow
SetWindowPos
IsWindowVisible
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC

gdi32

SetBitmapBits
GetBitmapBits
GetTextExtentPointA
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetStretchBltMode
StretchBlt
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
SetTextColor
SetBkMode
CreateSolidBrush
CreatePatternBrush
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
CryptImportKey
CryptDecrypt
CryptSetHashParam
CryptSignHashW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegCloseKey
CryptAcquireContextW
RegEnumKeyExW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegDeleteValueW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptEncrypt
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptDestroyKey
RegQueryInfoKeyW

shell32

ShellExecuteExW
SHBrowseForFolderW
ShellExecuteW
Shell_NotifyIconW
DragQueryFileW
SHGetFolderPathW
ord165
CommandLineToArgvW
SHFileOperationW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
ReleaseStgMedium
OleLockRunning
CLSIDFromProgID
CLSIDFromString
OleDuplicateData
DoDragDrop
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantCopy
VariantInit
VariantChangeType
SysFreeString
VariantClear
SysAllocString

shlwapi

PathFileExistsW
wnsprintfW

gdiplus

GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

dbghelp

MiniDumpWriteDump

ws2_32

WSASetLastError
socket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
recv
WSACleanup
WSAGetLastError
send
closesocket
WSAStartup
gethostname
gethostbyname
freeaddrinfo
getaddrinfo
accept
listen
htonl
sendto
recvfrom
WSAEnumNetworkEvents
WSACloseEvent
inet_ntoa
ntohl
ioctlsocket
__WSAFDIsSet
select
WSACreateEvent
connect
WSAEventSelect

winhttp

WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpOpen
WinHttpConnect
WinHttpCloseHandle
WinHttpSendRequest

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 622KB - Virtual size: 621KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12b776487a52460cdbaf3037dbd11120

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

2b:11:61:ec:72:8f:1b:16:eb:f3:bf:59:f3:63:97:45:b3:ea:79:91:a7:16:9d:98:c3:82:b7:ba:27:46:f9:63Signer

Signature Validations

Verification

15/12/2022, 05:39 Valid: true

Chain 1

Chain 2

19:f8:9f:41:ee:77:fd:66:96:49:ca:3a:cb:02:68:34:03:5c:93:42Signer

Signature Validations

Verification

15/12/2022, 05:39 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

wldap32

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

imm32

dbghelp

ws2_32

winhttp

version

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 622KB - Virtual size: 621KB

.data Size: 43KB - Virtual size: 91KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 334KB - Virtual size: 334KB

.reloc Size: 113KB - Virtual size: 113KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

2b:11:61:ec:72:8f:1b:16:eb:f3:bf:59:f3:63:97:45:b3:ea:79:91:a7:16:9d:98:c3:82:b7:ba:27:46:f9:63
Signer

15/12/2022, 05:39
Valid: true

19:f8:9f:41:ee:77:fd:66:96:49:ca:3a:cb:02:68:34:03:5c:93:42
Signer

15/12/2022, 05:39
Valid: true

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 622KB - Virtual size: 621KB

.data
Size: 43KB - Virtual size: 91KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 334KB - Virtual size: 334KB

.reloc
Size: 113KB - Virtual size: 113KB