Static task
static1
Behavioral task
behavioral1
Sample
421a60bdd0af164f1814a9ec9e81b26dd1293d42810716abbc3ff9a00940d06c.exe
Resource
win7-20231129-en
General
-
Target
421a60bdd0af164f1814a9ec9e81b26dd1293d42810716abbc3ff9a00940d06c
-
Size
712KB
-
MD5
48fae9750a16665141dddf1e37ff5ebd
-
SHA1
dfea4e3dcbd4c3bcc42eded4281f5a987f810ae2
-
SHA256
421a60bdd0af164f1814a9ec9e81b26dd1293d42810716abbc3ff9a00940d06c
-
SHA512
b92086db6cdbe030024ebb5de71ed8aeda215e8bf2089f6fc08d090e24aa421666392fddd805fa9ca6d8f3868f442d91023210496554de0146053de0e9c83647
-
SSDEEP
12288:7elBshqcU7yw1at39qPXdoFNifaXQgEIOpb7xMZadjEgnRKwiC7ASASEe7KNZ7Jh:7+USAL2mZ7mzAWbeIYVgOBvWi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 421a60bdd0af164f1814a9ec9e81b26dd1293d42810716abbc3ff9a00940d06c
Files
-
421a60bdd0af164f1814a9ec9e81b26dd1293d42810716abbc3ff9a00940d06c.exe windows:6 windows x64 arch:x64
1aab47bec86cbe27f6f8fca9a5f734d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
qt5gui
??0QIcon@@QEAA@AEBVQString@@@Z
??1QIcon@@QEAA@XZ
?key@QKeyEvent@@QEBAHXZ
wsap-filmorax
ord10410
ord3798
ord8347
ord3815
ord8051
ord2896
ord6119
ord7045
ord2832
ord8078
ord817
ord8414
ord9054
ord3479
ord785
ord1074
ord4967
ord8498
ord2294
ord9694
ord2621
ord3433
ord1525
ord9444
ord4116
ord7684
ord10046
ord3771
ord3786
ord4406
ord3250
ord917
ord7594
ord9333
ord9614
ord2252
ord526
ord3959
ord3994
ord1194
ord760
ord9703
ord5555
ord3206
ord2949
ord1392
ord7529
ord4570
ord6894
ord985
ord9107
ord10472
ord9834
ord8194
ord7206
ord9160
ord3974
ord4782
ord3163
ord7671
ord3445
ord8377
ord3341
ord7250
ord2026
ord2169
ord3155
ord9807
ord6265
ord4795
ord1239
ord2698
ord6191
ord9806
ord5401
ord3568
ord6728
ord9819
ord500
ord9042
ord4193
ord1358
ord3806
ord98
ord626
ord8620
ord1521
ord9126
ord5333
ord8370
ord3098
ord6913
ord1676
ord4850
ord7270
ord1082
ord2959
fcore
?canRun@FApplication@@MEAA_NXZ
?run@FApplication@@QEAAHXZ
?unInitAppLog@FApplication@@MEAAXXZ
??0FApplication@@QEAA@AEAHPEAPEAD@Z
??1FApplication@@UEAA@XZ
?init@FApplication@@MEAAXXZ
?unInit@FApplication@@MEAAXXZ
?prepareRun@FApplication@@MEAAXXZ
?initDirInfo@FApplication@@MEAAXXZ
?initAppLog@FApplication@@MEAAXXZ
?clearCefCache@FApplication@@IEBA_NH@Z
?appProgramDataDir@FApplication@@IEAA?AVQString@@XZ
?getFilmoraProgramDataDir@@YA?AVQString@@XZ
?alreadyRun@FApplication@@MEAAXXZ
?initProductInfo@FApplication@@MEAAXXZ
?isMainApp@FApplication@@MEAA_NXZ
?needBugSplatProxy@FApplication@@MEAA_NXZ
?showSplashScreen@FApplication@@MEAAXXZ
?needInitSkin@FApplication@@MEAA_NXZ
?productName@FApplication@@UEAA?AVQString@@XZ
?runFinished@FApplication@@MEAAXXZ
qt5core
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?arguments@QCoreApplication@@SA?AVQStringList@@XZ
?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z
?connectSlotsByName@QMetaObject@@SAXPEAVQObject@@@Z
??1Connection@QMetaObject@@QEAA@XZ
??0QChar@@QEAA@UQLatin1Char@@@Z
??1QByteArray@@QEAA@XZ
?isEmpty@QString@@QEBA_NXZ
?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z
?toUtf8@QString@@QEGBA?AVQByteArray@@XZ
?compare@QString@@QEBAHAEBV1@W4CaseSensitivity@Qt@@@Z
?toInt@QString@@QEBAHPEA_NH@Z
??0QString@@QEAA@AEBVQByteArray@@@Z
??8QString@@QEBA_NPEBD@Z
?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z
?append@QListData@@QEAAPEAPEAXXZ
?objectName@QObject@@QEBA?AVQString@@XZ
?setObjectName@QObject@@QEAAXAEBVQString@@@Z
?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PEBV1@PEAPEAX01PEAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PEBHPEBU3@@Z
??1QVariant@@QEAA@XZ
?toLongLong@QVariant@@QEBA_JPEA_N@Z
??0QJsonValue@@QEAA@AEBVQString@@@Z
??0QJsonValue@@QEAA@PEBD@Z
??0QJsonValue@@QEAA@AEBVQJsonObject@@@Z
??1QJsonValue@@QEAA@XZ
??4QJsonValueRef@@QEAAAEAV0@AEBVQJsonValue@@@Z
?toVariant@QJsonValueRef@@QEBA?AVQVariant@@XZ
?toString@QJsonValueRef@@QEBA?AVQString@@XZ
?toArray@QJsonValueRef@@QEBA?AVQJsonArray@@XZ
?toObject@QJsonValueRef@@QEBA?AVQJsonObject@@XZ
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?isEmpty@QJsonArray@@QEBA_NXZ
??AQJsonArray@@QEAA?AVQJsonValueRef@@H@Z
??0QJsonDocument@@QEAA@XZ
?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z@Z
?fromJson@QJsonDocument@@SA?AV1@AEBVQByteArray@@PEAUQJsonParseError@@@Z
?toJson@QJsonDocument@@QEBA?AVQByteArray@@XZ
?object@QJsonDocument@@QEBA?AVQJsonObject@@XZ
?setObject@QJsonDocument@@QEAAXAEBVQJsonObject@@@Z
??0QJsonObject@@QEAA@XZ
??1QJsonObject@@QEAA@XZ
??AQJsonObject@@QEAA?AVQJsonValueRef@@AEBVQString@@@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
?shared_null@QListData@@2UData@1@B
?rehash@QHashData@@QEAAXH@Z
?willGrow@QHashData@@QEAA_NXZ
?detach_helper@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH@Z
?allocateNode@QHashData@@QEAAPEAXH@Z
?end@QListData@@QEBAPEAPEAXXZ
?begin@QListData@@QEBAPEAPEAXXZ
?at@QListData@@QEBAPEAPEAXH@Z
?size@QListData@@QEBAHXZ
?dispose@QListData@@SAXPEAUData@1@@Z
?dispose@QListData@@QEAAXXZ
?detach@QListData@@QEAAPEAUData@1@H@Z
??0QString@@QEAA@PEBD@Z
?fromUtf8@QString@@SA?AV1@PEBDH@Z
??YQString@@QEAAAEAV0@AEBV0@@Z
??4QString@@QEAAAEAV0@$$QEAV0@@Z
??4QString@@QEAAAEAV0@AEBV0@@Z
??1QString@@QEAA@XZ
??0QString@@QEAA@XZ
?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ
??0QString@@QEAA@AEBV0@@Z
?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?instance@QCoreApplication@@SAPEAV1@XZ
??1QJsonArray@@QEAA@XZ
?setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N@Z
?shared_null@QHashData@@2U1@B
??1QJsonDocument@@QEAA@XZ
ffcefview
?SetPromptsEnable@FFCefview@@QEAAX_N@Z
??1FFCefview@@UEAA@XZ
??0FFCefview@@QEAA@PEAVQWidget@@@Z
?sigWebCallBack@FFCefview@@QEAAXAEBVQString@@@Z
?SetAutoTryAgain@FFCefview@@QEAAX_N@Z
?navigateToRequest@FFCefview@@QEAAXAEBVQString@@AEBVQVariant@@_N@Z
?runJavaScript@FFCefview@@QEAAXAEBVQString@@@Z
?GetCefWindow@FFCefview@@QEAAPEAVQWidget@@XZ
?GetWebRequestHeader@FFWebRequestHelper@@SA?AVQVariant@@XZ
?metaObject@FFCefview@@UEBAPEBUQMetaObject@@XZ
?onInvokeMethodLocalPageNotify@FFCefview@@MEAA?AVQString@@HHAEBV?$QList@VQVariant@@@@@Z
?staticMetaObject@FFCefview@@2UQMetaObject@@B
?qt_metacast@FFCefview@@UEAAPEAXPEBD@Z
?qt_metacall@FFCefview@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?onLoadStart@FFCefview@@EEAAXXZ
?resizeEvent@FFCefview@@MEAAXPEAVQResizeEvent@@@Z
?onInvokeMethodNotify@FFCefview@@MEAAXHHAEBVQString@@AEBV?$QList@VQVariant@@@@@Z
ffqcefview
?SetUserAngent@QCefView@@SAXVQString@@@Z
?sigBrowserCreated@QCefView@@QEAAXXZ
?sigLoadFinished@QCefView@@QEAAX_NVQString@@@Z
?browserStopLoad@QCefView@@QEAAXXZ
?changeEvent@QCefView@@MEAAXPEAVQEvent@@@Z
?eventFilter@QCefView@@MEAA_NPEAVQObject@@PEAVQEvent@@@Z
?onBrowserCreated@QCefView@@MEAAXXZ
?onLoadEnd@QCefView@@MEAAXH@Z
?onQCefQueryRequest@QCefView@@MEAAXAEBVQCefQuery@@@Z
?onQCefUrlRequest@QCefView@@MEAAXAEBVQString@@@Z
?staticMetaObject@QCefView@@2UQMetaObject@@B
?onLoadError@QCefView@@MEAAXHAEBVQString@@0@Z
?onLoadUrlChanged@QCefView@@MEAAXVQString@@@Z
?onLoadingStateChanged@QCefView@@MEAAX_N00@Z
ffapplicense
releaseLicense
getLicense
ffwidgets
?SetTitleName@FFTopLevelWindowTitleBar@@QEAAXVQString@@_N@Z
?staticMetaObject@FFFramelessDialog@@2UQMetaObject@@B
?qt_metacall@FFFramelessDialog@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@FFFramelessDialog@@UEAAPEAXPEBD@Z
?SetContentWidget@FFFramelessDialog@@QEAAXPEAVQWidget@@@Z
??0FFFramelessDialog@@IEAA@PEAVQWidget@@_N1@Z
??1FFFramelessDialog@@MEAA@XZ
?SetResizeble@FFTopLevelWindowTitleBar@@QEAAX_N@Z
?instance@?$FFSingleton@VFFSkinStyle@@@@SAPEAVFFSkinStyle@@XZ
?SetSkinKind@FFSkinStyle@@QEAA_NAEBW4FFSkinKind@ffskintype@@@Z
?SetButtons@FFTopLevelWindowTitleBar@@QEAAXH@Z
?FormatResourceFile@FFSkinStyle@@QEAA?AVQString@@AEBV2@@Z
?DoModal@FFFramelessDialog@@UEAAHXZ
?GetCheckedButton@FFDialog@@MEAAPEAVQAbstractButton@@XZ
?IsMaximized@FFFramelessDialog@@MEAA_NXZ
?ProgressEnterKeyPressEvent@FFDialog@@MEAA_NXZ
?SetBorderRadius@FFFramelessDialog@@UEAAX_N@Z
?TranslateText@FFFramelessDialog@@UEAAXXZ
?changeEvent@FFFramelessDialog@@MEAAXPEAVQEvent@@@Z
?paintEvent@FFDialog@@MEAAXPEAVQPaintEvent@@@Z
?resizeEvent@FFDialog@@MEAAXPEAVQResizeEvent@@@Z
?showEvent@FFFramelessDialog@@MEAAXPEAVQShowEvent@@@Z
?resize@FFDialog@@QEAAXHH@Z
?GetSkinKind@FFSkinStyle@@QEAA?AW4FFSkinKind@ffskintype@@XZ
?keyPressEvent@FFDialog@@MEAAXPEAVQKeyEvent@@@Z
ffvblmodel
?uninitVblLog@IFFVBLLoggerManager@@SAXXZ
?initVblLog@IFFVBLLoggerManager@@SAXAEBVQString@@W4ChannelType@1@H@Z
ffcore
?metaObject@FFCommunicatorClient@@UEBAPEBUQMetaObject@@XZ
?log_@FFBaseLogger@FFBaseLog@@AEAAXAEBUlog_data@2@_N@Z
?name@FFBaseLogger@FFBaseLog@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?setLanguageType@FFLocale@@QEBAXW4FFLanguageType@1@@Z
?languageSimpleName@FFLocale@@QEBA?AVQString@@XZ
?qt_metacall@FFCommunicatorClient@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?SendMsg@FFCommunicatorClient@@QEAAHVQString@@VQStringList@@_N@Z
?ConnectToServer@FFCommunicatorClient@@QEAAXAEBVQString@@@Z
??1FFCommunicatorClient@@UEAA@XZ
??0FFCommunicatorClient@@QEAA@PEAVQObject@@@Z
?sigRecveMsg@FFCommunicatorClient@@QEAAXVQString@@@Z
??0FFCommunicatorMsg@@QEAA@AEBV0@@Z
??1FFCommunicatorMsg@@QEAA@XZ
?buildListFromString@FFCommunicatorMsg@@SA?AV?$QList@VFFCommunicatorMsg@@@@AEBVQString@@@Z
?firstContent@FFCommunicatorMsg@@QEBA?AVQString@@XZ
?contains@FFCommunicatorMsg@@QEBA_NAEBVQString@@@Z
?qt_metacast@FFApplication@@UEAAPEAXPEBD@Z
?qt_metacall@FFApplication@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?metaObject@FFApplication@@UEBAPEBUQMetaObject@@XZ
?slash@FFDir@@SA?AVQString@@AEBV2@@Z
?getInstance@IFFAppInfo@@SAPEAV1@XZ
?loadProxyInfo@FFNetworkProxyInfo@@QEAAXXZ
?instance@?$FFLazySingleton@VFFNetworkProxyInfo@@@@SAPEAVFFNetworkProxyInfo@@XZ
?qt_metacast@FFCommunicatorClient@@UEAAPEAXPEBD@Z
?staticMetaObject@FFCommunicatorClient@@2UQMetaObject@@B
?initHighDPI@FFApplication@@SAXH@Z
?defaultLogger@FFBaseLog@@YAPEAVFFBaseLogger@1@XZ
?instance@?$FFSingleton@VFFLocale@@@@SAPEAVFFLocale@@XZ
?should_log_@FFBaseLogger@FFBaseLog@@AEAA_NW4LogLevel@2@@Z
kernel32
GetCurrentThreadId
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
CloseHandle
EnterCriticalSection
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
LocalFree
WideCharToMultiByte
GetCommandLineW
msvcp140
_Xtime_get_ticks
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
__C_specific_handler
memset
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_terminate
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_initialize_onexit_table
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_seh_filter_dll
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_c_exit
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf
_set_fmode
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
shell32
CommandLineToArgvW
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE