VT Community Sign in ▼ Languages ▼
VirusTotal's website has changed, we need new translations, do you feel like helping the community?
Sign in to VT Community

Safety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.

email
password
Keep me logged in
Forgot your password? Create an account
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
Yahoo_ID_Fucker_v1.0.exe
Submission date:
2009-07-10 20:48:27 (UTC)
Current status:
finished
Result:
32 /41 (78.0%)
VT Community

not reviewed
 Safety score: - 
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.07.10 Backdoor.Rbot!IK
AhnLab-V3 5.0.0.2 2009.07.10 Win32/IRCBot.worm.Gen
AntiVir 7.9.0.204 2009.07.10 Worm/Rbot.328262
Antiy-AVL 2.0.3.1 2009.07.10 -
Authentium 5.1.2.4 2009.07.10 W32/Ircbot.1!Generic
Avast 4.8.1335.0 2009.07.09 Win32:SdBot-gen44
AVG 8.5.0.387 2009.07.10 Worm/Generic_r.AV
BitDefender 7.2 2009.07.10 Generic.Malware.G!FWX!!g.2F82B6C3
CAT-QuickHeal 10.00 2009.07.10 Backdoor.Rbot.gen
ClamAV 0.94.1 2009.07.10 Exploit.DCOM.Gen
Comodo 1607 2009.07.10 Backdoor.Win32.EggDrop.V
DrWeb 5.0.0.12182 2009.07.10 Win32.HLLW.MyBot.based
eSafe 7.0.17.0 2009.07.09 -
eTrust-Vet 31.6.6608 2009.07.10 Win32/Rbot!generic
F-Prot 4.4.4.56 2009.07.10 W32/Ircbot.1!Generic
F-Secure 8.0.14470.0 2009.07.10 Backdoor.Win32.Rbot.gen
Fortinet 3.120.0.0 2009.07.10 -
GData 19 2009.07.10 Generic.Malware.G!FWX!!g.2F82B6C3
Ikarus T3.1.1.64.0 2009.07.10 Backdoor.Rbot
Jiangmin 11.0.706 2009.07.09 Backdoor/Agobot.Gen.d
K7AntiVirus 7.10.789 2009.07.10 -
Kaspersky 7.0.0.125 2009.07.10 Backdoor.Win32.Rbot.gen
McAfee 5672 2009.07.10 W32/Sdbot.worm.gen.g
McAfee+Artemis 5672 2009.07.10 W32/Sdbot.worm.gen.g
McAfee-GW-Edition 6.8.5 2009.07.10 Heuristic.BehavesLike.Win32.Downloader.K
Microsoft 1.4803 2009.07.10 Backdoor:Win32/Rbot.gen
NOD32 4232 2009.07.10 a variant of Win32/Rbot
Norman 6.01.09 2009.07.10 W32/Spybot.gen
nProtect 2009.1.8.0 2009.07.10 -
Panda 10.0.0.14 2009.07.10 W32/Gaobot.gen.worm
PCTools 4.4.2.0 2009.07.10 -
Prevx 3.0 2009.07.10 -
Rising 21.37.44.00 2009.07.10 Backdoor.Win32.Rbot.GEN
Sophos 4.43.0 2009.07.10 W32/Rbot-Gen
Sunbelt 3.2.1858.2 2009.07.10 Trojan.Win32.Ircbot!cobra (v)
Symantec 1.4.4.12 2009.07.10 W32.Spybot.Worm
TheHacker 6.3.4.3.363 2009.07.08 W32/SdBot.worm.gen
TrendMicro 8.950.0.1094 2009.07.10 WORM_RBOT.GEN-1
VBA32 3.12.10.8 2009.07.10 -
ViRobot 2009.7.10.1829 2009.07.10 -
VirusBuster 4.6.5.0 2009.07.10 Worm.RBot.Gen.14
Additional information
MD5   : 9ded1ab827623f9b0a357bb39e0f8a73
SHA1  : 5ea276ae53015344a5d3ca45c417c169a9ed1f2b
SHA256: d09853706ebd7484aacb9ccca915fa5a790bcf7e0fef72d28a1780ea6d1666ab
ssdeep: 24576:hnIT5bk80AMLiv2qFxmnI1aXeJJ3M9ASnQFi:QIjqFcnI16ef4dQ0
File size : 808224 bytes
First seen: 2009-07-10 20:48:27
Last seen : 2009-07-10 21:46:28
Magic: Null
PEiD: Armadillo v1.71
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x24FF4
timedatestamp....: 0x4A508D55 (Sun Jul 05 11:24:05 2009)
machinetype......: 0x14C (Intel I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x2C131, 0x2C200, 6.17, 075e3f6c6a66058ea84fd9c2541bea84
.rdata, 0x2E000, 0x1542, 0x1600, 6.23, 92ceaf1a8cf3bdd6bf6ce8c161d9d2d5
.data, 0x30000, 0x13CF9C, 0x14000, 5.11, 92db0639b73b0bf99b63955368ea9a1f

[[ 2 import(s) ]]
kernel32.dll: GlobalUnlock, SetEnvironmentVariableA, CompareStringW, CompareStringA, SetEndOfFile, FlushFileBuffers, SetStdHandle, GetStringTypeW, GetStringTypeA, RtlUnwind, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, GetModuleFileNameA, Sleep, MultiByteToWideChar, ReadFile, WriteFile, TransactNamedPipe, CloseHandle, CreateFileA, SetFilePointer, GetFileSize, GetTickCount, GetLastError, CopyFileA, WideCharToMultiByte, GetProcAddress, LoadLibraryA, CreateThread, ExitThread, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GetLocalTime, GetSystemDirectoryA, DeleteFileA, QueryPerformanceCounter, QueryPerformanceFrequency, ExitProcess, CreateProcessA, FindClose, FindNextFileA, FindFirstFileA, FreeLibrary, GetEnvironmentVariableW, HeapFree, HeapAlloc, GetProcessHeap, FileTimeToSystemTime, FileTimeToLocalFileTime, VirtualQueryEx, ReadProcessMemory, GetSystemInfo, OpenProcess, GetTimeFormatA, GetDateFormatA, GetFileAttributesA, GetModuleHandleA, FormatMessageA, GlobalLock, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, SetFileTime, GetFileTime, ExpandEnvironmentStringsA, SetFileAttributesA, GetTempPathA, GetComputerNameA, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, WaitForSingleObject, CreateMutexA, MoveFileA, TerminateThread, GetExitCodeProcess, PeekNamedPipe, DuplicateHandle, CreatePipe, SetConsoleCtrlHandler, GetLocaleInfoA, GetVersionExA, GetLogicalDrives, WaitForMultipleObjects, GenerateConsoleCtrlEvent, GlobalMemoryStatus, HeapReAlloc, GetTimeZoneInformation, GetSystemTime, GetStartupInfoA, GetCommandLineA, GetVersion, GetCPInfo, GetACP, GetOEMCP, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, LCMapStringA, LCMapStringW, UnhandledExceptionFilter
ws2_32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -

VT Community

This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team
Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?
You can add basic styles to your comments using the following accepted bbcode tags:

[b]text[/b] -- bold
[i]text[/i] -- italics
[u]text[/u] -- underline
[s]text[/s] -- strikethrough
[code]text[/code] - preformatted text

You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.
Goodware
Malware
Spam attachment/link

P2P download
Propagating via IM
Network worm

Drive-by-download






ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.