× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 17ab62b586ea18143354896183b1cd1b394a765bd3b6b6bf29d3ec54d6a02d95
File name: Salt-Minion-2017.7.2-Py2-AMD64-Setup.exe
Detection ratio: 2 / 68
Analysis date: 2017-12-02 15:46:18 UTC ( 1 month, 2 weeks ago )
Antivirus Result Update
Rising Trojan.Script.VBS.Downloader.l (CLOUD) 20171202
Zoner Trojan.Instsrv 20171202
Ad-Aware 20171202
AegisLab 20171202
AhnLab-V3 20171202
Alibaba 20171201
ALYac 20171202
Antiy-AVL 20171202
Arcabit 20171202
Avast 20171202
Avast-Mobile 20171202
AVG 20171202
Avira (no cloud) 20171202
AVware 20171202
Baidu 20171201
BitDefender 20171202
Bkav 20171201
CAT-QuickHeal 20171202
ClamAV 20171202
CMC 20171202
Comodo 20171202
CrowdStrike Falcon (ML) 20171016
Cybereason 20171103
Cylance 20171202
Cyren 20171202
DrWeb 20171202
eGambit 20171202
Emsisoft 20171202
Endgame 20171130
ESET-NOD32 20171202
F-Prot 20171202
F-Secure 20171202
Fortinet 20171202
GData 20171202
Ikarus 20171202
Sophos ML 20170914
Jiangmin 20171202
K7AntiVirus 20171202
K7GW 20171202
Kaspersky 20171202
Kingsoft 20171202
Malwarebytes 20171202
MAX 20171202
McAfee 20171202
McAfee-GW-Edition 20171202
Microsoft 20171202
eScan 20171202
NANO-Antivirus 20171202
nProtect 20171201
Palo Alto Networks (Known Signatures) 20171202
Panda 20171202
Qihoo-360 20171202
SentinelOne (Static ML) 20171113
Sophos AV 20171202
SUPERAntiSpyware 20171202
Symantec 20171202
Symantec Mobile Insight 20171201
Tencent 20171202
TheHacker 20171130
TotalDefense 20171202
TrendMicro 20171202
TrendMicro-HouseCall 20171202
Trustlook 20171202
VBA32 20171201
VIPRE 20171202
ViRobot 20171202
Webroot 20171202
WhiteArmor 20171104
Yandex 20171201
Zillya 20171201
ZoneAlarm by Check Point 20171202
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Signature verification Signed file, verified signature
Signing date 4:07 PM 10/4/2017
Signers
[+] Salt Stack, Inc.
Status Valid
Issuer DigiCert EV Code Signing CA (SHA2)
Valid from 1:00 AM 2/26/2016
Valid to 1:00 PM 3/1/2019
Valid usage Code Signing
Algorithm sha256RSA
Thumbprint E477E6824B2C6CBB854FD4CE8FB9D4E5A2BCC2BB
Serial number 0C E6 70 38 E3 83 D7 42 7C E3 B9 9B 0A A7 06 9F
[+] DigiCert EV Code Signing CA (SHA2)
Status Valid
Issuer DigiCert High Assurance EV Root CA
Valid from 1:00 PM 4/18/2012
Valid to 1:00 PM 4/18/2027
Valid usage Code Signing
Algorithm sha256RSA
Thumbprint 60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3
Serial number 03 F1 B4 E1 5F 3A 82 F1 14 96 78 B3 D7 D8 47 5C
[+] DigiCert
Status Valid
Issuer DigiCert High Assurance EV Root CA
Valid from 1:00 AM 11/10/2006
Valid to 1:00 AM 11/10/2031
Valid usage Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing
Algorithm sha1RSA
Thumbprint 5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
Serial number 02 AC 5C 26 6A 0B 40 9B 8F 0B 79 F2 AE 46 25 77
Counter signers
[+] DigiCert Timestamp Responder
Status Valid
Issuer DigiCert Assured ID CA-1
Valid from 1:00 AM 10/22/2014
Valid to 1:00 AM 10/22/2024
Valid usage Timestamp Signing
Algorithm sha1RSA
Thumbrint 614D271D9102E30169822487FDE5DE00A352B01D
Serial number 03 01 9A 02 3A FF 58 B1 6B D6 D5 EA E6 17 F0 66
[+] DigiCert Assured ID CA-1
Status Valid
Issuer DigiCert Assured ID Root CA
Valid from 1:00 AM 11/10/2006
Valid to 1:00 AM 11/10/2021
Valid usage Server Auth, Client Auth, Code Signing, Email Protection, Timestamp Signing
Algorithm sha1RSA
Thumbrint 19A09B5A36F4DD99727DF783C17A51231A56C117
Serial number 06 FD F9 03 96 03 AD EA 00 0A EB 3F 27 BB BA 1B
[+] DigiCert
Status Valid
Issuer DigiCert Assured ID Root CA
Valid from 1:00 AM 11/10/2006
Valid to 1:00 AM 11/10/2031
Valid usage Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing
Algorithm sha1RSA
Thumbrint 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
Serial number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Packers identified
F-PROT NSIS, appended, UTF-8, Unicode, CAB
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2014-10-07 04:40:23
Entry Point 0x000030E2
Number of sections 5
PE sections
Overlays
MD5 b9e66e99f77a49378fc3613550e888cf
File type data
Offset 177152
Size 37368624
Entropy 8.00
PE imports
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegEnumValueA
ImageList_Create
Ord(17)
ImageList_Destroy
ImageList_AddMasked
GetDeviceCaps
SelectObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetBkColor
DeleteObject
SetTextColor
GetLastError
lstrlenA
GetFileAttributesA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
CopyFileA
GetTickCount
SetFileTime
GlobalUnlock
LoadLibraryA
DeleteFileA
GetModuleFileNameA
GetShortPathNameA
GetCurrentProcess
LoadLibraryExA
CompareFileTime
GetPrivateProfileStringA
WritePrivateProfileStringA
GetFileSize
lstrcatA
CreateDirectoryA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
SetErrorMode
MultiByteToWideChar
GetCommandLineA
GlobalLock
SetFileAttributesA
SetFilePointer
GetTempPathA
CreateThread
lstrcmpiA
GetModuleHandleA
lstrcmpA
ReadFile
lstrcpyA
FindFirstFileA
CloseHandle
GetTempFileNameA
lstrcpynA
FindNextFileA
RemoveDirectoryA
GetSystemDirectoryA
GetDiskFreeSpaceA
GetProcAddress
SetEnvironmentVariableA
GetFullPathNameA
FreeLibrary
MoveFileA
CreateProcessA
WriteFile
GlobalAlloc
SearchPathA
FindClose
Sleep
CreateFileA
ExitProcess
GetVersion
SetCurrentDirectoryA
MulDiv
SHGetFileInfoA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA
SHFileOperationA
CharPrevA
GetMessagePos
EndPaint
ReleaseDC
EndDialog
BeginPaint
ShowWindow
DefWindowProcA
GetClassInfoA
SetClassLongA
LoadBitmapA
SetWindowPos
GetSystemMetrics
IsWindow
AppendMenuA
PostQuitMessage
GetWindowRect
DispatchMessageA
ScreenToClient
SetDlgItemTextA
MessageBoxIndirectA
LoadImageA
GetDlgItemTextA
PeekMessageA
SetWindowLongA
IsWindowEnabled
GetSysColor
CheckDlgButton
GetDC
SystemParametersInfoA
CreatePopupMenu
wsprintfA
DialogBoxParamA
SetClipboardData
IsWindowVisible
SendMessageA
DrawTextA
GetClientRect
SetTimer
GetDlgItem
SetForegroundWindow
CreateDialogParamA
EnableMenuItem
RegisterClassA
SendMessageTimeoutA
InvalidateRect
GetWindowLongA
FindWindowExA
CreateWindowExA
LoadCursorA
TrackPopupMenu
SetWindowTextA
FillRect
OpenClipboard
CharNextA
CallWindowProcA
GetSystemMenu
EmptyClipboard
EnableWindow
CloseClipboard
DestroyWindow
ExitWindowsEx
SetCursor
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
CoTaskMemFree
OleUninitialize
CoCreateInstance
OleInitialize
Number of PE resources by type
RT_ICON 7
RT_DIALOG 4
RT_GROUP_ICON 1
RT_MANIFEST 1
Number of PE resources by language
ENGLISH US 13
PE resources
ExifTool file metadata
MIMEType
application/octet-stream

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

FileTypeExtension
exe

TimeStamp
2014:10:07 05:40:23+01:00

FileType
Win32 EXE

PEType
PE32

CodeSize
24064

LinkerVersion
6.0

EntryPoint
0x30e2

InitializedDataSize
162816

SubsystemVersion
4.0

ImageVersion
6.0

OSVersion
4.0

UninitializedDataSize
1024

File identification
MD5 133458d2e65e3ebbf65db9aec340a0aa
SHA1 5f5b66e305d4129d24f9472d912a44a026872fcd
SHA256 17ab62b586ea18143354896183b1cd1b394a765bd3b6b6bf29d3ec54d6a02d95
ssdeep
786432:NeDusF6HwVs4ex0UH1rt0SSgxPD0pHUNXOUbnHr2wVq7q5OeD:NeasFm6UH1rtDjPD0p0NXO6Hr2T2YeD

authentihash a05747c1bc9a1708751c2ca995afb50c9b876dd070afe16aead2081c14159973
imphash e160ef8e55bb9d162da4e266afd9eef3
File size 35.8 MB ( 37545776 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID NSIS - Nullsoft Scriptable Install System (90.8%)
InstallShield setup (4.6%)
Win64 Executable (generic) (2.9%)
Win32 Dynamic Link Library (generic) (0.7%)
Win32 Executable (generic) (0.4%)
Tags
nsis peexe signed overlay

VirusTotal metadata
First submission 2017-10-10 00:06:53 UTC ( 3 months, 1 week ago )
Last submission 2017-10-10 00:06:53 UTC ( 3 months, 1 week ago )
File names Salt-Minion-2017.7.2-Py2-AMD64-Setup.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!