× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 1e6cf3ae749ee5cd47d408d42541946816c27b281fe702b42532b14fe3ac8876
File name: Ez9fTT7TPcr668PEvAk.exe
Detection ratio: 40 / 68
Analysis date: 2018-10-13 06:59:13 UTC ( 4 months, 1 week ago ) View latest
Antivirus Result Update
Ad-Aware Trojan.MaliciousTools.GenericKDS.31274002 20181013
AhnLab-V3 Trojan/Win32.Agent.R238870 20181012
ALYac Trojan.MaliciousTools.GenericKDS.31274002 20181013
Arcabit Trojan.MaliciousTools.GenericS.D1DD3412 20181013
Avast Win32:Malware-gen 20181013
AVG Win32:Malware-gen 20181013
Avira (no cloud) TR/AD.Emotet.vkmra 20181012
BitDefender Trojan.MaliciousTools.GenericKDS.31274002 20181013
CMC Trojan.Win32.Obfuscated.en!O 20181012
Comodo CloudScanner.Trojan.Gen 20181013
CrowdStrike Falcon (ML) malicious_confidence_100% (D) 20180723
Cylance Unsafe 20181013
Cyren W32/Trojan.XDDQ-8451 20181013
Emsisoft Trojan.MaliciousTools.GenericKDS.31274002 (B) 20181013
Endgame malicious (high confidence) 20180730
ESET-NOD32 a variant of Win32/Kryptik.GLNG 20181013
F-Secure Trojan.MaliciousTools.GenericKDS.31274002 20181013
Fortinet W32/Kryptik.GLNG!tr 20181013
GData Win32.Trojan-Spy.Emotet.4KRWD8 20181013
Ikarus Trojan.Win32.Crypt 20181012
Sophos ML heuristic 20180717
K7GW Trojan ( 0053eb911 ) 20181013
Kaspersky Trojan-Banker.Win32.Emotet.bhua 20181013
Malwarebytes Trojan.Emotet 20181013
McAfee RDN/Generic.hbg 20181013
McAfee-GW-Edition BehavesLike.Win32.Upatre.jt 20181013
Microsoft Trojan:Win32/Occamy.C 20181013
eScan Trojan.MaliciousTools.GenericKDS.31274002 20181013
NANO-Antivirus Virus.Win32.Gen.ccmw 20181013
Palo Alto Networks (Known Signatures) generic.ml 20181013
Panda Trj/Genetic.gen 20181012
Qihoo-360 Win32/Trojan.4df 20181013
Rising Trojan.Fuerboos!8.EFC8 (TFE:3:6OqfWqarcZJ) 20181012
SentinelOne (Static ML) static engine - malicious 20181011
Sophos AV Mal/Generic-S 20181013
Symantec Trojan.Emotet 20181012
TACHYON Banker/W32.Emotet.712704 20181013
Tencent Win32.Trojan-banker.Emotet.Wqne 20181013
Webroot W32.Trojan.Gen 20181013
ZoneAlarm by Check Point Trojan-Banker.Win32.Emotet.bhua 20181013
AegisLab 20181013
Alibaba 20180921
Antiy-AVL 20181013
Avast-Mobile 20181013
Babable 20180918
Baidu 20181012
Bkav 20181013
CAT-QuickHeal 20181011
ClamAV 20181013
Cybereason 20180225
DrWeb 20181013
eGambit 20181013
F-Prot 20181013
Jiangmin 20181013
K7AntiVirus 20181013
Kingsoft 20181013
MAX 20181013
SUPERAntiSpyware 20181013
Symantec Mobile Insight 20181001
TheHacker 20181011
TotalDefense 20181013
TrendMicro 20181010
TrendMicro-HouseCall 20181010
Trustlook 20181013
VBA32 20181012
VIPRE 20181013
ViRobot 20181012
Yandex 20181012
Zillya 20181012
Zoner 20181012
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2018-03-01 09:39:18
Entry Point 0x00012180
Number of sections 4
PE sections
PE imports
InitiateSystemShutdownA
GetSidSubAuthority
IsValidSid
InitiateSystemShutdownExW
GetOldestEventLogRecord
GetSecurityDescriptorOwner
GetFileSecurityA
LogonUserExW
FreeEncryptionCertificateHashList
GetWindowsAccountDomainSid
InitializeSid
GetEventLogInformation
GetClusterFromResource
GetOpenFileNameA
GetRandomRgn
GetDeviceCaps
DeleteDC
GetWorldTransform
GetMetaFileA
FillPath
GdiComment
GetTextExtentPointW
FillRgn
GetMiterLimit
GetTextExtentPoint32W
EqualRgn
GetViewportExtEx
ExtCreateRegion
GdiFlush
GdiSetBatchLimit
GetCharWidthFloatA
DeleteObject
GetTextColor
ExtCreatePen
GetFontData
GetCharWidth32A
LineDDA
DefineDosDeviceW
GetComputerNameExW
GetDriveTypeW
WriteProcessMemory
GetPrivateProfileStructA
GetOverlappedResult
GetLastError
GetProfileSectionW
GetProcessTimes
lstrcmpiW
GetStdHandle
FindFirstChangeNotificationW
GetProcessId
GetQueuedCompletionStatus
GetCurrentProcess
GetVolumeInformationA
FlushConsoleInputBuffer
GetFileType
GetPrivateProfileStringA
VirtualFreeEx
GetCurrentProcessId
WriteProfileStringA
GetCalendarInfoW
ExpandEnvironmentStringsA
GetLogicalDrives
DeleteFileW
GetUserDefaultLCID
WriteProfileStringW
FormatMessageA
EnumSystemCodePagesW
GetComputerNameW
GetProfileStringW
GetTempPathA
EraseTape
LocalFlags
lstrcmpA
GetFileAttributesA
lstrcpyA
FindNextVolumeMountPointW
DeleteAtom
GetVolumeNameForVolumeMountPointW
FreeConsole
GetDynamicTimeZoneInformation
GetStringTypeW
DecodePointer
EscapeCommFunction
GetMailslotInfo
FindCloseChangeNotification
EnumSystemCodePagesA
LoadResource
GetCommState
VirtualFree
GetProfileIntA
GetStringTypeExA
GetSystemWindowsDirectoryW
GetCurrentThread
LZSeek
GetRecordInfoFromTypeInfo
GetRecordInfoFromGuids
FindExecutableA
ExtractIconW
EnumerateSecurityPackagesW
DecryptMessage
GetClassInfoExW
GetCursorInfo
DrawTextExW
OffsetRect
DestroyAcceleratorTable
GetMessageW
DefWindowProcA
FindWindowA
GetDialogBaseUnits
GetDlgItemTextA
GetRawInputDeviceList
GetScrollRange
GetMessageExtraInfo
GetWindowTextLengthW
DestroyCaret
GetClipboardSequenceNumber
GetMenuItemID
GetProcessDefaultLayout
GetTitleBarInfo
DrawIconEx
EnumWindows
DrawMenuBar
LoadIconA
DrawFocusRect
GetSysColor
LoadImageW
GetClassNameW
GetTopWindow
DefDlgProcA
GetWindowTextW
DeferWindowPos
LoadImageA
FindWindowExW
GetMenuBarInfo
GetWindowLongW
GetWindowTextA
GetUserObjectSecurity
GetMenuStringW
FindClosePrinterChangeNotification
GetPrinterW
GetStandardColorSpaceProfileW
fwprintf
fwrite
vfprintf
strtol
memset
tolower
strcspn
strcmp
GetClassFileOrMime
Number of PE resources by type
TEXT 1
Number of PE resources by language
NEUTRAL 1
PE resources
Debug information
ExifTool file metadata
MIMEType
application/octet-stream

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

FileTypeExtension
exe

TimeStamp
2018:03:01 10:39:18+01:00

FileType
Win32 EXE

PEType
PE32

CodeSize
520192

LinkerVersion
12.0

ImageFileCharacteristics
No relocs, Executable, 32-bit

EntryPoint
0x12180

InitializedDataSize
192512

SubsystemVersion
5.0

ImageVersion
0.0

OSVersion
5.0

UninitializedDataSize
0

File identification
MD5 6a86d3cd044cafda10fd3505d6751185
SHA1 524ff9474ac0303369980616b77529a3d005671f
SHA256 1e6cf3ae749ee5cd47d408d42541946816c27b281fe702b42532b14fe3ac8876
ssdeep
3072:y8rkLTbhU1J+4hOYfv6Bw58GoVQHWaugk+mjHW9AEJEaYrpR8uivUPL0N2cRgzHo:yZP4iBaKIcgkDH5E6NRw4/zJzgwmQ6J

authentihash f58825085dd673cbbe992569391bbc4837778dde79456321da5a8cd2360b93b0
imphash c1bd063f2fe35ba25208fa5221c546e6
File size 696.0 KB ( 712704 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable (generic) (42.7%)
OS/2 Executable (generic) (19.2%)
Generic Win/DOS Executable (18.9%)
DOS Executable Generic (18.9%)
Tags
peexe

VirusTotal metadata
First submission 2018-10-09 22:57:01 UTC ( 4 months, 2 weeks ago )
Last submission 2018-10-10 09:03:32 UTC ( 4 months, 2 weeks ago )
File names Ez9fTT7TPcr668PEvAk.exe
TpvSvbE9FD.exe
0u2uTUwgTT.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!