Wondershare Recoverit[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Wondershare Recoverit.exe
Size

13.9MB
MD5

dec665d1395fe20a67f0fc74982d0b5b
SHA1

3fc7b4740a87382038400a1cb0f52fd70c23e42a
SHA256

df63533e80d2f04ef0c3ff36eb8a35fdebd985a5938dd6120cbeb3c8d35de454
SHA512

5343a003738112b6ec1b1628b8c85e4bf3d670f18942ea5d5fa88b9e9bfb0c4dccaa280ae649eccc014358a5b5ac5a4a3046b1cb2d3a2b651a2c77018f62e532
SSDEEP

393216:u64eVEjxaFwUOOGvBML9ZHHOC/hdmR0Xd7PV:Oe00OZrBed/hdRXd7PV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Wondershare Recoverit.exe

Files

Wondershare Recoverit.exe
.exe windows x64

b45408465410e69c955a96d2259342cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA
RtlAddFunctionTable

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xcpad
Size: - Virtual size: 1.3MB

.rsrc
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ