Static task
static1
Behavioral task
behavioral1
Sample
Wondershare Filmora 12 License.exe
Resource
win10v2004-20230915-es
General
-
Target
Wondershare Filmora 12 License.exe
-
Size
838KB
-
MD5
5560bdda88b90827215d187b9b6b3f46
-
SHA1
799c650f0e0971d96019ef772ba37a8aa5b25784
-
SHA256
40e374e5c98b01418e638e50cbae8ce4d2a4fbe00831e2be9a5abf2d8fba478b
-
SHA512
3ba64aa47fc7ae1f62da76a685a97e1a7d5c2088fcafb99e28973af12444ef468dd502fd7859f934fc511fb5251ea5c0270472cf5a6bc28530e83865dd86eef8
-
SSDEEP
12288:UVIlE+PycGgq6astN6811B15heuWHbL/tvPp4hSkfm8GlhV+FNjovV:UVIa+PyzgJastT18HhGfxGlhViNjo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Wondershare Filmora 12 License.exe
Files
-
Wondershare Filmora 12 License.exe.exe windows:4 windows x86
f9217b1abf3f80009941dce372136df1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
comctl32
CreatePropertySheetPageW
InitCommonControls
PropertySheetW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
kernel32
AddAtomA
CloseHandle
CreateProcessW
CreateSemaphoreA
ExitProcess
FindAtomA
FormatMessageA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetExitCodeProcess
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
ReleaseSemaphore
SetEnvironmentVariableW
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_access
_close
_fstat
_open
_read
_unlink
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_errno
_filbuf
_flsbuf
_getdrives
_iob
_isctype
_onexit
_pctype
_setmode
_wfopen
abort
atexit
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fwrite
getenv
iswctype
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strrchr
strstr
strtol
swprintf
time
tolower
toupper
ungetc
wcscat
wcscmp
wcscpy
wcslen
ole32
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantInit
user32
CallWindowProcW
CheckDlgButton
CheckRadioButton
CreateDialogParamW
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnableWindow
EndDialog
EnumThreadWindows
GetDlgItem
GetDlgItemTextW
GetMessageW
GetParent
GetWindowLongW
IsDlgButtonChecked
LoadCursorW
LoadIconW
LoadStringW
MessageBoxW
PostMessageW
RegisterClassExW
SendMessageA
SendMessageW
SetDlgItemTextW
SetFocus
SetParent
SetWindowLongA
SetWindowLongW
SetWindowPos
ShowWindow
TranslateMessage
UnregisterClassW
ws2_32
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
closesocket
connect
gethostbyname
gethostname
getpeername
getservbyname
getsockname
htons
inet_addr
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
Sections
.text Size: 394KB - Virtual size: 394KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 19KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE