General

Malware Config

Signatures

Files

• filmora_setup_full1081.exe

  .exe windows:6 windows x86 arch:x86

  f82f221937e6ca9e120ffb597da1ae7d

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  20-04-2022 00:00

  Not After

  05-04-2025 23:59

  Subject

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  20-04-2022 00:00

  Not After

  05-04-2025 23:59

  Subject

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  30:fc:eb:80:55:b5:04:ae:15:81:04:1b:9a:f9:66:7f:9a:b1:1b:06:98:62:7f:dc:15:44:92:01:af:38:31:70

  Signer

  Actual PE Digest

  30:fc:eb:80:55:b5:04:ae:15:81:04:1b:9a:f9:66:7f:9a:b1:1b:06:98:62:7f:dc:15:44:92:01:af:38:31:70

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  89:1c:62:7a:c1:e7:3e:76:79:ce:e2:93:13:0b:c4:7d:4e:9e:a2:0e

  Signer

  Actual PE Digest

  89:1c:62:7a:c1:e7:3e:76:79:ce:e2:93:13:0b:c4:7d:4e:9e:a2:0e

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  G:\devops_yanfa\workspace\p-4663c901377d457795e7a5c44ce670aa\src\bin\WAE_ESP.pdb

  Imports

  comctl32

  InitCommonControlsEx

  _TrackMouseEvent

  ord17

  wldap32

  ord46

  ord22

  ord211

  ord217

  ord143

  ord50

  ord26

  ord30

  ord200

  ord32

  ord35

  ord33

  ord79

  ord301

  ord27

  ord60

  ord41

  ord45

  crypt32

  CertAddCertificateContextToStore

  CryptQueryObject

  CryptDecodeObjectEx

  CertFindExtension

  CertFreeCertificateChain

  CertFreeCertificateChainEngine

  CertGetCertificateChain

  CertCreateCertificateChainEngine

  CertEnumCertificatesInStore

  CertOpenStore

  CryptStringToBinaryA

  CertFindCertificateInStore

  PFXImportCertStore

  CertCloseStore

  CertFreeCertificateContext

  kernel32

  ReleaseMutex

  CreateMutexW

  CreateDirectoryW

  GetFileAttributesW

  LocalFileTimeToFileTime

  SetFilePointer

  SetFileTime

  SystemTimeToFileTime

  LocalFree

  FormatMessageW

  VerSetConditionMask

  GetLocalTime

  lstrcmpiW

  lstrcpynW

  lstrcpyW

  SetLastError

  FreeLibrary

  GetSystemDirectoryA

  LoadLibraryA

  GetModuleHandleA

  QueryPerformanceFrequency

  SleepEx

  QueryPerformanceCounter

  VerifyVersionInfoA

  GetEnvironmentVariableA

  PeekNamedPipe

  WaitForMultipleObjects

  GetFileType

  GetStdHandle

  MoveFileExA

  GetFileSizeEx

  CreateFileA

  GetDriveTypeW

  GetCurrentProcess

  GetLogicalDriveStringsW

  GetDiskFreeSpaceExW

  GetEnvironmentVariableW

  SetErrorMode

  CreateProcessW

  LoadLibraryExW

  GetExitCodeProcess

  TerminateProcess

  lstrcmpW

  SetEndOfFile

  TerminateThread

  GetFileAttributesExW

  CreateThread

  SetFilePointerEx

  SetFileAttributesW

  EnterCriticalSection

  SetEnvironmentVariableA

  WriteConsoleW

  InitializeSListHead

  MulDiv

  GetThreadTimes

  GetFullPathNameW

  SetStdHandle

  ReadConsoleW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetModuleFileNameA

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  GetModuleHandleExW

  GetCurrentThread

  GetOEMCP

  IsValidCodePage

  EnumSystemLocalesW

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetTimeFormatW

  GetDateFormatW

  GetStartupInfoW

  UnhandledExceptionFilter

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  MoveFileExW

  SystemTimeToTzSpecificLocalTime

  FindClose

  FindNextFileW

  FindFirstFileExW

  FileTimeToSystemTime

  GetFileInformationByHandle

  FileTimeToLocalFileTime

  AreFileApisANSI

  RtlUnwind

  GetCommandLineA

  GetCPInfo

  ExitThread

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStringTypeW

  EncodePointer

  WideCharToMultiByte

  GlobalAlloc

  lstrlenW

  GlobalUnlock

  GlobalLock

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  GetSystemTimeAsFileTime

  CloseHandle

  SetEvent

  WaitForSingleObject

  GetTimeZoneInformation

  GetProcAddress

  GetCurrentThreadId

  FindResourceW

  LoadResource

  SizeofResource

  LockResource

  FindResourceExW

  HeapDestroy

  HeapSize

  HeapReAlloc

  HeapFree

  HeapAlloc

  GetProcessHeap

  GetSystemDefaultLCID

  GetModuleHandleW

  GetTickCount

  ReadFile

  GetFileSize

  GetCurrentDirectoryW

  ExitProcess

  GetACP

  OutputDebugStringW

  MultiByteToWideChar

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  DeleteFileW

  CreateSemaphoreW

  SetUnhandledExceptionFilter

  FreeResource

  OpenProcess

  GetCurrentProcessId

  GetModuleFileNameW

  VirtualQuery

  WriteFile

  CreateFileW

  lstrcatW

  GetTempPathW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  Sleep

  CreateEventW

  GetNativeSystemInfo

  GetVersionExW

  LoadLibraryW

  GetUserDefaultLCID

  user32

  DrawTextW

  CharPrevW

  AdjustWindowRectEx

  GetPropW

  SetPropW

  GetMenu

  EnableWindow

  GetWindowRgn

  GetClassInfoExW

  RegisterClassExW

  FillRect

  SetRect

  EqualRect

  SetWindowTextW

  GetWindowTextW

  GetWindowTextLengthW

  DestroyMenu

  IsWindowEnabled

  UpdateWindow

  wsprintfA

  DrawTextA

  GetKeyboardLayout

  GetKeyNameTextW

  MapVirtualKeyExW

  GetShellWindow

  SendMessageW

  ScreenToClient

  GetWindowRect

  SetWindowPos

  GetDC

  ReleaseDC

  GetSystemMetrics

  wsprintfW

  MessageBoxW

  CreatePopupMenu

  AppendMenuW

  TrackPopupMenu

  UpdateLayeredWindow

  GetGUIThreadInfo

  InvalidateRgn

  CreateAcceleratorTableW

  MoveWindow

  ClientToScreen

  GetCaretPos

  SetCaretPos

  GetWindowThreadProcessId

  FindWindowW

  GetLastActivePopup

  PtInRect

  LoadIconW

  IsWindow

  GetClassNameW

  PostQuitMessage

  GetCursorPos

  IsIconic

  ShowWindow

  BringWindowToTop

  SetForegroundWindow

  SetActiveWindow

  SetCursor

  InflateRect

  UnionRect

  OffsetRect

  LoadCursorW

  IsZoomed

  SetWindowRgn

  GetClientRect

  GetWindowLongW

  SetWindowLongW

  MonitorFromWindow

  GetMonitorInfoW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  PostMessageW

  CreateWindowExW

  DestroyWindow

  IsWindowVisible

  CharNextW

  SetFocus

  GetActiveWindow

  GetFocus

  GetKeyState

  SetCapture

  ReleaseCapture

  SetTimer

  KillTimer

  BeginPaint

  EndPaint

  GetUpdateRect

  InvalidateRect

  MapWindowPoints

  GetSysColor

  IntersectRect

  IsRectEmpty

  GetParent

  GetWindow

  LoadImageW

  DefWindowProcW

  ShowCaret

  HideCaret

  GetCaretBlinkTime

  CreateCaret

  CallWindowProcW

  RegisterClassW

  EnableMenuItem

  gdi32

  SetBitmapBits

  GetBitmapBits

  GetTextExtentPointA

  PtInRegion

  CreateRectRgn

  CreatePatternBrush

  GdiFlush

  TextOutW

  MoveToEx

  GetObjectA

  CreateDIBSection

  SetTextColor

  SetStretchBltMode

  StretchBlt

  SetBkMode

  SetBkColor

  ExtSelectClipRgn

  SelectClipRgn

  LineTo

  GetClipBox

  GetCharABCWidthsW

  CreateSolidBrush

  CreateRectRgnIndirect

  CreatePenIndirect

  CombineRgn

  SetWindowOrgEx

  GetObjectW

  GetTextMetricsW

  PlayEnhMetaFile

  GetEnhMetaFileHeader

  CreateEnhMetaFileW

  CloseEnhMetaFile

  SelectObject

  SaveDC

  RestoreDC

  Rectangle

  RemoveFontMemResourceEx

  AddFontMemResourceEx

  GetStockObject

  GetDeviceCaps

  DeleteDC

  CreatePen

  CreateFontIndirectW

  CreateDIBitmap

  CreateCompatibleDC

  CreateCompatibleBitmap

  BitBlt

  DeleteObject

  CreateRoundRectRgn

  GetTextExtentPoint32W

  advapi32

  RegCreateKeyExW

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  CryptAcquireContextW

  RegEnumKeyExW

  CheckTokenMembership

  FreeSid

  RevertToSelf

  AllocateAndInitializeSid

  RegDeleteValueW

  ImpersonateLoggedOnUser

  RegQueryInfoKeyW

  OpenProcessToken

  RegSetValueExW

  RegOpenKeyExW

  CryptImportKey

  CryptEncrypt

  CryptDestroyKey

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  RegCloseKey

  RegQueryValueExW

  CryptDestroyHash

  shell32

  ShellExecuteW

  Shell_NotifyIconW

  SHGetFolderLocation

  ShellExecuteExW

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetMalloc

  SHGetSpecialFolderLocation

  SHFileOperationW

  CommandLineToArgvW

  ord165

  DragQueryFileW

  SHGetFolderPathW

  ole32

  ReleaseStgMedium

  OleLockRunning

  CLSIDFromProgID

  CLSIDFromString

  CreateStreamOnHGlobal

  OleDuplicateData

  DoDragDrop

  CoCreateInstance

  CoUninitialize

  CoInitialize

  oleaut32

  SysAllocString

  VariantClear

  GetErrorInfo

  SysFreeString

  VariantChangeType

  VariantInit

  VariantCopy

  shlwapi

  wnsprintfW

  PathFileExistsW

  gdiplus

  GdipRotateWorldTransform

  GdipTranslateWorldTransform

  GdipDrawImageRectI

  GdipGetPropertyItem

  GdipGetPropertyItemSize

  GdipImageGetFrameCount

  GdipImageGetFrameDimensionsList

  GdipImageGetFrameDimensionsCount

  GdipGetImageHeight

  GdipGetImageWidth

  GdipSetStringFormatTrimming

  GdipImageSelectActiveFrame

  GdipSetStringFormatAlign

  GdipSetStringFormatFlags

  GdipCloneStringFormat

  GdipDeleteStringFormat

  GdipStringFormatGetGenericTypographic

  GdipMeasureString

  GdipDrawString

  GdipDeleteFont

  GdipCreateFontFromLogfontA

  GdipCreateFontFromDC

  GdipFillPath

  GdipFillRectangleI

  GdipDrawPath

  GdipDrawRectangleI

  GdipSetInterpolationMode

  GdipSetTextRenderingHint

  GdipSetSmoothingMode

  GdipDeleteGraphics

  GdipCreateFromHDC

  GdipDisposeImage

  GdipCloneImage

  GdipLoadImageFromStreamICM

  GdipLoadImageFromStream

  GdipSetPenMode

  GdipDeletePen

  GdipCreatePen1

  GdipCreateSolidFill

  GdipDeleteBrush

  GdipCloneBrush

  GdipAddPathArc

  GdipAddPathLine

  GdipDeletePath

  GdipCreatePath

  GdipFree

  GdipAlloc

  GdiplusShutdown

  GdiplusStartup

  GdipSetStringFormatLineAlign

  imm32

  ImmGetContext

  ImmSetCompositionWindow

  ImmReleaseContext

  dbghelp

  MiniDumpWriteDump

  psapi

  GetModuleFileNameExW

  ws2_32

  ntohl

  inet_ntoa

  inet_addr

  ioctlsocket

  __WSAFDIsSet

  select

  WSACreateEvent

  WSAEventSelect

  WSACloseEvent

  WSAEnumNetworkEvents

  recvfrom

  sendto

  htonl

  listen

  accept

  getaddrinfo

  freeaddrinfo

  WSASetLastError

  connect

  socket

  getpeername

  getsockopt

  htons

  bind

  ntohs

  getsockname

  setsockopt

  WSAIoctl

  recv

  WSACleanup

  WSAGetLastError

  send

  WSAStartup

  gethostname

  gethostbyname

  closesocket

  winhttp

  WinHttpQueryHeaders

  WinHttpOpen

  WinHttpCloseHandle

  WinHttpCrackUrl

  WinHttpAddRequestHeaders

  WinHttpConnect

  WinHttpSendRequest

  WinHttpSetTimeouts

  WinHttpOpenRequest

  WinHttpReceiveResponse

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  Sections

  .text

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 335KB - Virtual size: 334KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 21KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 17B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 358KB - Virtual size: 358KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 71KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ