× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 1d75b0c430862639c84d9442d188872aafdacb40c11fdec4575fa29869121b1d
File name: c0583721fcca0a82015bbd22987fd7ba75a195e859cacb1194281fcb51fb6830.tmp
Detection ratio: 0 / 63
Analysis date: 2018-11-16 14:03:39 UTC ( 6 months ago )
Antivirus Result Update
Ad-Aware 20181116
AegisLab 20181116
AhnLab-V3 20181116
Alibaba 20180921
ALYac 20181116
Antiy-AVL 20181116
Arcabit 20181116
Avast 20181116
Avast-Mobile 20181116
AVG 20181116
Avira (no cloud) 20181116
AVware 20180925
Babable 20180918
Baidu 20181116
BitDefender 20181116
Bkav 20181116
CAT-QuickHeal 20181115
ClamAV 20181116
CMC 20181116
Comodo 20181116
CrowdStrike Falcon (ML) 20181022
Cybereason 20180225
Cylance 20181116
Cyren 20181116
DrWeb 20181116
eGambit 20181116
Emsisoft 20181116
Endgame 20181108
ESET-NOD32 20181116
F-Prot 20181116
F-Secure 20181116
Fortinet 20181116
GData 20181116
Ikarus 20181116
Sophos ML 20181108
Jiangmin 20181116
K7AntiVirus 20181116
K7GW 20181116
Kaspersky 20181116
Kingsoft 20181116
Malwarebytes 20181116
MAX 20181116
McAfee 20181116
McAfee-GW-Edition 20181116
Microsoft 20181116
eScan 20181116
NANO-Antivirus 20181116
Palo Alto Networks (Known Signatures) 20181116
Panda 20181116
Qihoo-360 20181116
Rising 20181116
SentinelOne (Static ML) 20181011
Sophos AV 20181116
SUPERAntiSpyware 20181114
Symantec 20181116
Symantec Mobile Insight 20181108
TACHYON 20181116
Tencent 20181116
TheHacker 20181113
TotalDefense 20181116
TrendMicro 20181116
TrendMicro-HouseCall 20181116
Trustlook 20181116
VBA32 20181116
ViRobot 20181116
Webroot 20181116
Yandex 20181115
Zillya 20181115
ZoneAlarm by Check Point 20181116
Zoner 20181116
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
File version 51.1052.0.0
Description Setup/Uninstall
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2014-07-09 07:58:14
Entry Point 0x000FF004
Number of sections 8
PE sections
PE imports
RegCreateKeyExW
GetTokenInformation
RegFlushKey
RegCloseKey
OpenProcessToken
RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
GetUserNameW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
AllocateAndInitializeSid
RegDeleteKeyW
FreeSid
EqualSid
RegQueryValueExW
ImageList_BeginDrag
ImageList_GetImageCount
ImageList_SetBkColor
FlatSB_SetScrollInfo
InitCommonControls
ImageList_SetImageCount
FlatSB_GetScrollInfo
ImageList_GetDragImage
FlatSB_SetScrollProp
ImageList_Create
ImageList_DragMove
ImageList_DrawEx
ImageList_SetIconSize
ImageList_Write
ImageList_Read
ImageList_Destroy
_TrackMouseEvent
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_GetBkColor
FlatSB_SetScrollPos
ImageList_DragEnter
ImageList_Add
InitializeFlatSB
FlatSB_GetScrollPos
ImageList_DragShowNolock
ImageList_Remove
ImageList_EndDrag
GetSaveFileNameW
GetOpenFileNameW
GetDIBColorTable
GetTextMetricsW
GetWindowOrgEx
PatBlt
GetClipBox
EnumFontsW
GetRgnBox
SaveDC
GetCurrentPositionEx
Arc
GetPaletteEntries
MaskBlt
SetStretchBltMode
GetPixel
Rectangle
BitBlt
GetDeviceCaps
ExcludeClipRect
LineTo
DeleteDC
RestoreDC
SetBkMode
GetSystemPaletteEntries
CreateBitmap
SetPixel
CreateSolidBrush
CreateFontIndirectW
DeleteObject
IntersectClipRect
CreateHalftonePalette
CreateDIBSection
RealizePalette
SetTextColor
GetTextExtentPointW
ExtFloodFill
GetBrushOrgEx
MoveToEx
ExtTextOutW
GetObjectW
FrameRgn
GetTextExtentPoint32W
RectVisible
CreatePalette
GetStockObject
CreateDIBitmap
SetViewportOrgEx
SelectPalette
UnrealizeObject
GetDIBits
SetBrushOrgEx
GetDCOrgEx
RoundRect
StretchBlt
GetBitmapBits
CreateCompatibleDC
Chord
SetROP2
CreateRectRgn
SelectObject
Pie
SetDIBColorTable
CreateCompatibleBitmap
RemoveFontResourceW
CreateBrushIndirect
SetWindowOrgEx
Polyline
SetBkColor
LineDDA
Ellipse
CreatePenIndirect
AddFontResourceW
SetThreadLocale
GetStdHandle
GetDriveTypeW
ReleaseMutex
FileTimeToSystemTime
GetOverlappedResult
WaitForSingleObject
SignalObjectAndWait
GetFileAttributesW
GetLocalTime
DeleteCriticalSection
GetCurrentProcess
LocalAlloc
SetErrorMode
GetLogicalDrives
GetLocaleInfoW
WideCharToMultiByte
GetDiskFreeSpaceW
InterlockedExchange
WriteFile
GetSystemTimeAsFileTime
SetEvent
LocalFree
FormatMessageW
ResumeThread
GetExitCodeProcess
InitializeCriticalSection
LoadResource
FindClose
TlsGetValue
MoveFileW
SetFileAttributesW
GetCurrentThread
GetEnvironmentVariableW
SetLastError
DeviceIoControl
InterlockedDecrement
GlobalFindAtomW
GetUserDefaultLangID
GetModuleFileNameW
ExitProcess
InterlockedExchangeAdd
UnhandledExceptionFilter
LoadLibraryExW
MultiByteToWideChar
EnumCalendarInfoW
WriteProfileStringW
GetPrivateProfileStringW
GetFullPathNameW
GlobalAddAtomW
CreateThread
MoveFileExW
GetSystemDirectoryW
GetExitCodeThread
SetNamedPipeHandleState
CreateMutexW
MulDiv
ExitThread
WaitForMultipleObjectsEx
TerminateProcess
SetCurrentDirectoryW
VirtualQuery
LocalFileTimeToFileTime
VirtualQueryEx
SetEndOfFile
GetVersion
InterlockedIncrement
EnterCriticalSection
LoadLibraryW
GetVersionExW
FreeLibrary
QueryPerformanceCounter
GetTickCount
IsBadWritePtr
FlushFileBuffers
RtlUnwind
CopyFileW
GetStartupInfoA
GetWindowsDirectoryW
GetFileSize
OpenProcess
GetDateFormatW
CreateDirectoryW
DeleteFileW
GetProcAddress
CreateNamedPipeW
GetComputerNameW
GetProfileStringW
CompareStringW
lstrcpyW
RemoveDirectoryW
FindNextFileW
ResetEvent
FindFirstFileW
lstrcmpW
CreateEventW
CreateFileW
TlsSetValue
GetCurrentThreadId
LeaveCriticalSection
GetLastError
GlobalDeleteAtom
GetShortPathNameW
GetSystemInfo
GetThreadLocale
IsDBCSLeadByte
lstrlenW
CreateProcessW
SwitchToThread
SizeofResource
GetCurrentDirectoryW
GetCurrentProcessId
LockResource
SetFileTime
GetCommandLineW
GetCPInfo
Sleep
InterlockedCompareExchange
WritePrivateProfileStringW
lstrcpynW
RaiseException
SetFilePointer
ReadFile
CloseHandle
OpenMutexW
GetACP
GetModuleHandleW
FreeResource
FileTimeToLocalFileTime
CompareFileTime
FindResourceW
VirtualFree
TransactNamedPipe
VirtualAlloc
WNetGetConnectionW
WNetEnumResourceW
WNetGetUniversalNameW
WNetCloseEnum
WNetOpenEnumW
AlphaBlend
OleUninitialize
CoTaskMemFree
CoInitialize
OleInitialize
CoCreateInstance
CLSIDFromProgID
CoFreeUnusedLibraries
StringFromCLSID
CoUninitialize
CoDisconnectObject
IsEqualGUID
CLSIDFromString
VariantChangeType
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPtrOfIndex
RegisterTypeLib
SysAllocStringLen
VariantCopyInd
VariantClear
GetActiveObject
SafeArrayCreate
SysReAllocStringLen
SafeArrayGetUBound
VariantCopy
GetErrorInfo
SysFreeString
SafeArrayPutElement
LoadTypeLib
VariantInit
SHBrowseForFolderW
SHChangeNotify
ShellExecuteW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ExtractIconW
SHGetMalloc
MapWindowPoints
GetMessagePos
RedrawWindow
LoadBitmapW
EnableScrollBar
DestroyMenu
PostQuitMessage
GetForegroundWindow
SetWindowPos
IsWindow
DispatchMessageA
EndPaint
ScrollWindowEx
WindowFromPoint
DrawIcon
CharUpperBuffW
SetMenuItemInfoW
SetActiveWindow
GetMenuItemID
GetCursorPos
ReleaseDC
SendMessageW
SendMessageA
UnregisterClassW
GetClientRect
GetMenuItemInfoW
DefMDIChildProcW
DrawTextW
SetScrollPos
CallNextHookEx
GetSysColor
GetKeyboardState
ClientToScreen
GetTopWindow
GetWindowTextW
MsgWaitForMultipleObjects
ScrollWindow
PtInRect
DrawEdge
GetParent
UpdateWindow
GetPropW
SetClassLongW
EnumWindows
GetMessageW
ShowWindow
DrawFrameControl
SetPropW
GetDesktopWindow
CharToOemBuffA
PeekMessageW
TranslateMDISysAccel
InsertMenuItemW
SetWindowPlacement
PeekMessageA
TranslateMessage
IsWindowEnabled
GetWindow
ActivateKeyboardLayout
GetIconInfo
SetParent
RegisterClassW
IsZoomed
GetWindowPlacement
LoadStringW
GetKeyboardLayoutList
DrawMenuBar
OemToCharBuffA
IsIconic
GetSubMenu
SetTimer
GetActiveWindow
IsDialogMessageW
FillRect
EnumThreadWindows
WaitForInputIdle
GetSysColorBrush
IsWindowUnicode
CreateWindowExW
GetWindowLongW
CharNextW
IsChild
IsDialogMessageA
SetFocus
RegisterWindowMessageW
BeginPaint
OffsetRect
DefWindowProcW
GetScrollPos
GetKeyboardLayoutNameW
KillTimer
MapVirtualKeyW
SendNotifyMessageW
GetSystemMetrics
SetWindowLongW
SetScrollRange
GetWindowRect
InflateRect
SetCapture
ReleaseCapture
EnumChildWindows
GetScrollRange
CharLowerW
PostMessageW
GetKeyNameTextW
DrawTextExW
WaitMessage
CreatePopupMenu
CheckMenuItem
DrawFocusRect
GetClassLongW
GetLastActivePopup
DrawIconEx
SetWindowTextW
GetDCEx
RemovePropW
BringWindowToTop
GetSystemMenu
ScreenToClient
TrackPopupMenu
GetMenuItemCount
GetMenuState
ShowOwnedPopups
LoadCursorW
LoadIconW
FindWindowExW
GetDC
InsertMenuW
SetForegroundWindow
ExitWindowsEx
GetMenuStringW
CharLowerBuffW
IntersectRect
GetScrollInfo
GetKeyboardLayout
FindWindowW
GetCapture
MessageBeep
RemoveMenu
GetWindowThreadProcessId
ShowScrollBar
MessageBoxW
GetMenu
DestroyIcon
UnhookWindowsHookEx
SetRectEmpty
LoadKeyboardLayoutW
MessageBoxA
AppendMenuW
GetWindowDC
DestroyCursor
AdjustWindowRectEx
GetFocus
MsgWaitForMultipleObjectsEx
RegisterClipboardFormatW
SetScrollInfo
GetKeyState
EnableMenuItem
DefFrameProcW
IsWindowVisible
SetMenu
SystemParametersInfoW
DispatchMessageW
FrameRect
SetRect
DeleteMenu
InvalidateRect
CreateIcon
CallWindowProcW
DestroyWindow
GetClassInfoW
SetWindowsHookExW
IsRectEmpty
GetCursor
SendMessageTimeoutW
CreateMenu
EnableWindow
GetKeyboardType
ReplyMessage
SetCursor
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Number of PE resources by type
RT_STRING 17
RT_RCDATA 12
RT_GROUP_CURSOR 7
RT_CURSOR 7
RT_ICON 6
RT_BITMAP 2
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 28
ENGLISH US 26
PE resources
ExifTool file metadata
UninitializedDataSize
0

LinkerVersion
2.25

ImageVersion
6.0

FileVersionNumber
51.1052.0.0

LanguageCode
Neutral

FileFlagsMask
0x003f

FileDescription
Setup/Uninstall

ImageFileCharacteristics
No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi

CharacterSet
Unicode

InitializedDataSize
210944

EntryPoint
0xff004

MIMEType
application/octet-stream

FileVersion
51.1052.0.0

TimeStamp
2014:07:09 08:58:14+01:00

FileType
Win32 EXE

PEType
PE32

SubsystemVersion
5.0

OSVersion
5.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CodeSize
1041408

FileSubtype
0

ProductVersionNumber
0.0.0.0

FileTypeExtension
exe

ObjectFileType
Executable application

CarbonBlack CarbonBlack acts as a surveillance camera for computers
Execution parents
Compressed bundles
File identification
MD5 89a2266e7671926edef91e3062db1ea1
SHA1 6b2d219b019dc97f150ece15f47c0b8272db8c83
SHA256 1d75b0c430862639c84d9442d188872aafdacb40c11fdec4575fa29869121b1d
ssdeep
24576:81VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3G+KzULvx9bz:gQdhZgEN6GnJWz8B

authentihash 7b5bc7cf0217538b45a82ecb838c15cdabd5eb80f3b5dad16a23f62d2683f315
imphash ccd5f2ad4761330df297d2ddedcd8ed3
File size 1.2 MB ( 1253376 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Windows ActiveX control (37.6%)
Inno Setup installer (35.4%)
InstallShield setup (13.9%)
Win32 Executable Delphi generic (4.5%)
Windows screen saver (4.2%)
Tags
peexe

VirusTotal metadata
First submission 2014-09-30 06:43:10 UTC ( 4 years, 7 months ago )
Last submission 2018-05-18 04:07:19 UTC ( 1 year ago )
File names RevoUninProSetup_2.tmp
VSUSetup.tmp
amx3wopw.tps
RevoUninProSetup.tmp
revouninprosetup.tmp
VSUSetup.tmp
vsusetup.tmp
VSUSetup.tmp
RevoUninProSetup.tmp
VSUSetup.tmp
511dfc8a444f5e957ab216742e9f1dafab934c07f0264f967521f038e0d85419.tmp
RevoUninProSetup315.tmp
b2ccb094fa4f1c4f17ea0be0f9600a7a8c27673948d6c21f2ab4c1bbda12d673.tmp
RevoUninProSetup.tmp
VSUSetup.tmp
RevoUninProSetup.tmp
VSUSetup.tmp
RevoUninProSetup.tmp
RevoUninProSetup.tmp
revo uninstaller.tmp
RevoUninProSetup.tmp
revouninprosetup.tmp
c0583721fcca0a82015bbd22987fd7ba75a195e859cacb1194281fcb51fb6830.tmp
VSUSetup.tmp
RevoUninProSetup.tmp
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
Behaviour characterization
Zemana
keylogger

No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.