| SHA256: | 72d03dbf8355c8c9c49e60f0722852acaffda3f39aabce23254e6a9d6ed5fc8c |
| Dateiname: | yatqa-setup_3.7.2.exe |
| Erkennungsrate: | 34 / 62 |
| Analyse-Datum: | 2017-05-20 00:47:10 UTC ( vor 1 Jahr, 11 Monate ) |
| Antivirus | Ergebnis | Aktualisierung |
|---|---|---|
| AhnLab-V3 | Malware/Win32.Generic.C1112931 | 20170519 |
| Antiy-AVL | Trojan[Downloader]/Script.AGeneric | 20170519 |
| Arcabit | HEUR.VBA.Trojan.d | 20170520 |
| Avast | Win32:Malware-gen | 20170519 |
| AVG | Win32/DH{gVE1CQM?} | 20170519 |
| Avira (no cloud) | JS/Dldr.Agent.gqrxn | 20170519 |
| AVware | BehavesLike.Win32.Malware.eah (mx-v) | 20170519 |
| Baidu | Win32.Trojan.WisdomEyes.16070401.9500.9804 | 20170503 |
| CrowdStrike Falcon (ML) | malicious_confidence_100% (D) | 20170130 |
| Cyren | PP97M/Script.gen | 20170520 |
| DrWeb | Trojan.DownLoader22.9658 | 20170520 |
| Endgame | malicious (high confidence) | 20170515 |
| ESET-NOD32 | Win32/Delf.NBX | 20170519 |
| F-Prot | PP97M/Script.gen | 20170520 |
| F-Secure | Trojan:W97M/MaliciousMacro.GEN | 20170520 |
| Fortinet | WM/Agent.8315!tr | 20170520 |
| K7AntiVirus | Riskware ( 0040eff71 ) | 20170519 |
| K7GW | Riskware ( 0040eff71 ) | 20170518 |
| Kaspersky | HEUR:Trojan.Win32.Generic | 20170519 |
| Malwarebytes | Spyware.KeyLogger | 20170520 |
| McAfee | GenericRXAP-KE!BC65E9709E7D | 20170520 |
| McAfee-GW-Edition | BehavesLike.Win32.Dropper.vc | 20170520 |
| NANO-Antivirus | Trojan.Ole2.Vbs-heuristic.druvzi | 20170519 |
| Panda | Trj/Genetic.gen | 20170519 |
| Qihoo-360 | HEUR/QVM41.1.41CF.Malware.Gen | 20170520 |
| SentinelOne (Static ML) | static engine - malicious | 20170516 |
| Sophos AV | ElReceptor Keyboard Hook (PUA) | 20170519 |
| Symantec | ML.Attribute.HighConfidence | 20170519 |
| TrendMicro | TROJ_SYMMI_GA250982.UVPM | 20170520 |
| TrendMicro-HouseCall | TROJ_SYMMI_GA250982.UVPM | 20170519 |
| VIPRE | BehavesLike.Win32.Malware.eah (mx-v) | 20170519 |
| Webroot | W32.Malware.gen | 20170520 |
| Zillya | Trojan.Delf.Win32.76144 | 20170518 |
| ZoneAlarm by Check Point | HEUR:Trojan.Win32.Generic | 20170519 |
| Ad-Aware | 20170520 | |
| AegisLab | 20170519 | |
| Alibaba | 20170519 | |
| ALYac | 20170519 | |
| BitDefender | 20170519 | |
| Bkav | 20170519 | |
| CAT-QuickHeal | 20170519 | |
| ClamAV | 20170519 | |
| CMC | 20170519 | |
| Comodo | 20170519 | |
| Emsisoft | 20170520 | |
| GData | 20170520 | |
| Ikarus | 20170519 | |
| Sophos ML | 20170519 | |
| Jiangmin | 20170519 | |
| Kingsoft | 20170520 | |
| Microsoft | 20170520 | |
| eScan | 20170519 | |
| nProtect | 20170519 | |
| Palo Alto Networks (Known Signatures) | 20170520 | |
| Rising | 20170518 | |
| SUPERAntiSpyware | 20170520 | |
| Symantec Mobile Insight | 20170518 | |
| Tencent | 20170520 | |
| TheHacker | 20170516 | |
| TotalDefense | 20170519 | |
| Trustlook | 20170520 | |
| VBA32 | 20170519 | |
| ViRobot | 20170519 | |
| WhiteArmor | 20170517 | |
| Yandex | 20170518 | |
| Zoner | 20170520 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Product Synaptics Pointing Device Driver
File version 1.0.0.4
Description Synaptics Pointing Device Driver
Packers identified
F-PROT NSIS
PEiD BobSoft Mini Delphi -> BoB / BobSoft
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 1992-06-19 22:22:17
Entry Point 0x0009AB80
Number of sections 8
PE sections
PE imports
Number of PE resources by type
RT_STRING 24
RT_BITMAP 11
RT_RCDATA 8
RT_GROUP_CURSOR 7
RT_CURSOR 7
RT_ICON 2
RT_DIALOG 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 56
TURKISH DEFAULT 6
PE resources
ExifTool file metadata
SubsystemVersion
4.0
InitializedDataSize
1472000
ImageVersion
0.0
ProductName
Synaptics Pointing Device Driver
FileVersionNumber
1.0.0.4
UninitializedDataSize
0
LanguageCode
Turkish
FileFlagsMask
0x003f
CharacterSet
Windows, Turkish
LinkerVersion
2.25
FileTypeExtension
exe
MIMEType
application/octet-stream
FileVersion
1.0.0.4
TimeStamp
1992:06:19 23:22:17+01:00
FileType
Win32 EXE
PEType
PE32
ProductVersion
1.0.0.0
FileDescription
Synaptics Pointing Device Driver
OSVersion
4.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
Synaptics
CodeSize
629760
FileSubtype
0
ProductVersionNumber
1.0.0.4
EntryPoint
0x9ab80
ObjectFileType
Executable application
File identification
MD5 bc65e9709e7da66d1abb1a76f0fcb6c0
SHA1 af302d1e0f548494bb12371252da51bcdf9931bb
SHA256 72d03dbf8355c8c9c49e60f0722852acaffda3f39aabce23254e6a9d6ed5fc8c
ssdeep
49152:KnsHyjtk2MYC5GDAngNCgUlBk56VI+0+9OmwynT:Knsmtk2aYNBUPkYVId+9ORYT
File size
2.0 MB ( 2102784 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable Borland Delphi 7 (96.4%) Win32 Executable Delphi generic (2.0%) Win32 Executable (generic) (0.6%) Win16/32 Executable Delphi generic (0.3%) Generic Win/DOS Executable (0.2%) |
Tags
nsis
peexe
bobsoft
VirusTotal metadata
First submission
2017-05-20 00:47:10 UTC ( vor 1 Jahr, 11 Monate )
Last submission
2017-05-20 00:47:10 UTC ( vor 1 Jahr, 11 Monate )
| Dateinamen |
yatqa-setup_3.7.2.exe yatqa-setup_3.7.2.exe |
Behaviour characterization
Zemana
dll-injection
Keine Kommentare.
Bisher hat kein Mitglied der VirusTotal-Community einen Kommentar zu diesem Punkt verfasst, seien Sie der Erste!
Sie sind nicht angemeldet. Nur registrierte Nutzer können Kommentare hinterlassen, melden Sie sich an und sagen Sie etwas dazu!
Keine Bewertungen.
Niemand hat diesen Punkt bisher bewertet, seien Sie der Erste!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.