× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 2131173cb9969d9bc76bec8c874ad8fda41cc82dbececede1dfe3016045cca37
File name: 106258-kachestvennyy-skin-dlya-jagdpanther-ii-wot.exe
Detection ratio: 0 / 57
Analysis date: 2015-05-28 08:37:14 UTC ( 2 years, 5 months ago )
Antivirus Result Update
Ad-Aware 20150528
AegisLab 20150528
Yandex 20150525
AhnLab-V3 20150527
Alibaba 20150528
ALYac 20150528
Antiy-AVL 20150528
Avast 20150528
AVG 20150528
Avira (no cloud) 20150528
AVware 20150528
Baidu-International 20150527
BitDefender 20150528
Bkav 20150528
ByteHero 20150528
CAT-QuickHeal 20150523
ClamAV 20150528
CMC 20150527
Comodo 20150528
Cyren 20150528
DrWeb 20150528
Emsisoft 20150528
ESET-NOD32 20150528
F-Prot 20150528
F-Secure 20150528
Fortinet 20150528
GData 20150528
Ikarus 20150528
Jiangmin 20150527
K7AntiVirus 20150528
K7GW 20150528
Kaspersky 20150528
Kingsoft 20150528
Malwarebytes 20150528
McAfee 20150528
McAfee-GW-Edition 20150527
Microsoft 20150528
eScan 20150528
NANO-Antivirus 20150528
Norman 20150528
nProtect 20150527
Panda 20150527
Qihoo-360 20150528
Rising 20150526
Sophos AV 20150528
SUPERAntiSpyware 20150528
Symantec 20150528
Tencent 20150528
TheHacker 20150526
TotalDefense 20150527
TrendMicro 20150528
TrendMicro-HouseCall 20150528
VBA32 20150526
VIPRE 20150528
ViRobot 20150528
Zillya 20150527
Zoner 20150526
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
www.GameModding.net

Publisher Game Modding
Product ModInstall
File version 3.1.0.0
Description ModInstall 3.0
Signature verification Signed file, verified signature
Signing date 11:23 AM 5/26/2015
Signers
[+] Game Modding
Status Valid
Issuer None
Valid from 1:00 AM 3/18/2015
Valid to 12:59 AM 3/18/2016
Valid usage Code Signing
Algorithm 1.2.840.113549.1.1.11
Thumbprint 37B077EEBE71E29FF70504626DD0D0FC442348BB
Serial number 2F 58 2A B7 6F CB F8 45 DC 89 8C CA 29 99 42 E8
[+] COMODO RSA Code Signing CA
Status Valid
Issuer None
Valid from 1:00 AM 5/9/2013
Valid to 12:59 AM 5/9/2028
Valid usage Code Signing
Algorithm 1.2.840.113549.1.1.12
Thumbprint B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47
Serial number 2E 7C 87 CC 0E 93 4A 52 FE 94 FD 1C B7 CD 34 AF
[+] COMODO
Status Valid
Issuer None
Valid from 1:00 AM 1/19/2010
Valid to 12:59 AM 1/19/2038
Valid usage Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing, EFS, IPSEC Tunnel, IPSEC User
Algorithm 1.2.840.113549.1.1.12
Thumbprint AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4
Serial number 4C AA F9 CA DB 63 6F E0 1F F7 4E D8 5B 03 86 9D
Counter signers
[+] Symantec Time Stamping Services Signer - G4
Status Valid
Issuer None
Valid from 1:00 AM 10/18/2012
Valid to 12:59 AM 12/30/2020
Valid usage Timestamp Signing
Algorithm SHA1
Thumbrint 65439929B67973EB192D6FF243E6767ADF0834E4
Serial number 0E CF F4 38 C8 FE BF 35 6E 04 D8 6A 98 1B 1A 50
[+] Symantec Time Stamping Services CA - G2
Status Valid
Issuer None
Valid from 1:00 AM 12/21/2012
Valid to 12:59 AM 12/31/2020
Valid usage Timestamp Signing
Algorithm SHA1
Thumbrint 6C07453FFDDA08B83707C09B82FB3D15F35336B1
Serial number 7E 93 EB FB 7C C6 4E 59 EA 4B 9A 77 D4 06 FC 3B
[+] Thawte Timestamping CA
Status Valid
Issuer None
Valid from 1:00 AM 1/1/1997
Valid to 12:59 AM 1/1/2021
Valid usage Timestamp Signing
Algorithm MD5
Thumbrint BE36A4562FB2EE05DBB3D32323ADF445084ED656
Serial number 00
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2015-02-17 09:14:22
Entry Point 0x00001D14
Number of sections 9
PE sections
Overlays
MD5 1cb445801bf3c36b97ae03050a49b213
File type font/x-snf
Offset 3345408
Size 4047024
Entropy 7.59
PE imports
RegCreateKeyExW
RegCloseKey
RegRestoreKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
CryptHashData
RegQueryValueExW
CryptCreateHash
RegFlushKey
OpenProcessToken
RegConnectRegistryW
RegOpenKeyExW
RegReplaceKeyW
GetTokenInformation
CryptVerifySignatureW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
OpenThreadToken
InitiateSystemShutdownW
RegLoadKeyW
CryptAcquireContextW
RegDeleteValueW
RegSetValueExW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegSaveKeyW
EqualSid
RegUnLoadKeyW
ImageList_Merge
ImageList_BeginDrag
ImageList_SetBkColor
ImageList_GetImageInfo
FlatSB_SetScrollInfo
ImageList_SetImageCount
Ord(17)
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_DragMove
FlatSB_SetScrollProp
ImageList_Remove
ImageList_GetDragImage
ImageList_DrawEx
ImageList_SetIconSize
ImageList_Write
ImageList_GetImageCount
ImageList_Replace
ImageList_SetOverlayImage
ImageList_Destroy
ImageList_AddMasked
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_GetBkColor
ImageList_GetIcon
FlatSB_SetScrollPos
ImageList_ReplaceIcon
ImageList_DragEnter
ImageList_Add
InitializeFlatSB
ImageList_LoadImageW
FlatSB_GetScrollPos
ImageList_DragShowNolock
ImageList_Create
ImageList_Read
ImageList_Copy
Ord(8)
ImageList_EndDrag
ChooseColorA
GetSaveFileNameW
GetOpenFileNameW
SetDIBits
GetTextMetricsW
SetMapMode
GetWindowOrgEx
ResizePalette
GetPaletteEntries
CombineRgn
CopyEnhMetaFileW
SetPixel
EndDoc
IntersectClipRect
AngleArc
GetTextExtentPointW
CreatePalette
CreateDIBitmap
CreateEllipticRgnIndirect
GetEnhMetaFileBits
StretchBlt
StretchDIBits
ArcTo
Pie
Arc
ExtCreatePen
GetFontData
SetWinMetaFileBits
SetRectRgn
GetDIBColorTable
DeleteEnhMetaFile
TextOutW
CreateFontIndirectW
OffsetRgn
EnumFontsW
GetCurrentPositionEx
TextOutA
CreateRectRgnIndirect
LPtoDP
GetBitmapBits
GetBrushOrgEx
ExcludeClipRect
SetBkMode
BitBlt
FillRgn
SetAbortProc
FrameRgn
CreateBrushIndirect
SelectPalette
SetBkColor
ExtSelectClipRgn
StartDocW
SetROP2
EndPage
GetNearestPaletteIndex
SetDIBColorTable
DeleteObject
CreatePenIndirect
SetGraphicsMode
PatBlt
CreatePen
GetClipBox
Rectangle
GetDeviceCaps
LineTo
DeleteDC
SetWorldTransform
SetEnhMetaFileBits
GetSystemPaletteEntries
StartPage
GetObjectW
CreateDCW
RealizePalette
CreatePatternBrush
ExtTextOutW
CreateBitmap
RectVisible
GetStockObject
PlayEnhMetaFile
ExtTextOutA
UnrealizeObject
GdiFlush
RoundRect
GetWinMetaFileBits
GetEnhMetaFileDescriptionW
GetEnhMetaFileHeader
SetWindowOrgEx
GetTextExtentPoint32W
CreatePolygonRgn
Polygon
CreateHalftonePalette
GetRgnBox
SaveDC
CreateICW
MaskBlt
GetEnhMetaFilePaletteEntries
RestoreDC
GetPixel
CreateDIBSection
SetTextColor
ExtFloodFill
MoveToEx
EnumFontFamiliesExW
SetViewportOrgEx
CreateRoundRectRgn
CreateCompatibleDC
PolyBezierTo
SetStretchBltMode
PolyBezier
Chord
SetBrushOrgEx
CreateRectRgn
SelectObject
CreateCompatibleBitmap
CreateSolidBrush
Polyline
GetDIBits
AbortDoc
Ellipse
SetThreadLocale
GetStdHandle
FileTimeToDosDateTime
ReleaseMutex
FileTimeToSystemTime
GetFileAttributesA
SetEvent
GetPrivateProfileSectionNamesW
GetFileAttributesW
GetPrivateProfileStructW
CreatePipe
GetCurrentProcess
GetDriveTypeW
GetLocaleInfoA
LocalAlloc
GetVolumeInformationW
SetErrorMode
GetLocaleInfoW
SetStdHandle
GetFileTime
IsDBCSLeadByteEx
GetCPInfo
lstrcmpiA
GetStringTypeA
GetDiskFreeSpaceW
InterlockedExchange
GetTempPathW
WaitForSingleObject
WritePrivateProfileStructW
GetStringTypeW
ResumeThread
EnumDateFormatsW
GetExitCodeProcess
LocalFree
FormatMessageW
GetThreadPriority
GetTimeZoneInformation
LoadResource
GlobalHandle
FindClose
InterlockedDecrement
QueryDosDeviceW
GetFullPathNameW
WritePrivateProfileStringW
GetEnvironmentVariableW
SetLastError
GetUserDefaultUILanguage
GetSystemTime
InitializeCriticalSection
CopyFileW
lstrcpynW
GetModuleFileNameW
TryEnterCriticalSection
Beep
IsDebuggerPresent
ExitProcess
lstrcpyW
SwitchToThread
GetModuleFileNameA
GetPriorityClass
InterlockedExchangeAdd
SetConsoleCtrlHandler
WritePrivateProfileSectionW
EnumSystemLocalesW
LoadLibraryExW
MultiByteToWideChar
EnumCalendarInfoW
GetPrivateProfileStringW
SetFilePointer
SetFileAttributesW
GlobalAddAtomW
CreateThread
GetSystemDirectoryW
GetSystemDefaultUILanguage
DeleteCriticalSection
GetExitCodeThread
CreateMutexW
MulDiv
ExitThread
SetPriorityClass
WaitForMultipleObjectsEx
TerminateProcess
GetVersion
SetCurrentDirectoryW
GlobalAlloc
LocalFileTimeToFileTime
VirtualQueryEx
SetEndOfFile
GetCurrentThreadId
LeaveCriticalSection
CreateToolhelp32Snapshot
HeapFree
EnterCriticalSection
SetHandleCount
TerminateThread
LoadLibraryW
GetVersionExW
GetOEMCP
QueryPerformanceCounter
GetTickCount
TlsAlloc
GetVersionExA
LoadLibraryA
RtlUnwind
FreeLibrary
GlobalFindAtomW
GlobalSize
GetStartupInfoA
GetWindowsDirectoryW
GetFileSize
OpenProcess
DeleteFileA
GetDateFormatW
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GetProcAddress
GetPrivateProfileIntW
GetProcessHeap
GetTempFileNameW
GetComputerNameW
CompareStringW
WriteFile
RemoveDirectoryW
ExpandEnvironmentStringsW
FindNextFileW
lstrcpyA
CompareStringA
FindFirstFileW
IsValidLocale
DuplicateHandle
FindFirstFileExW
GetUserDefaultLCID
GetPrivateProfileSectionW
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
HeapAlloc
InterlockedIncrement
GetLastError
SystemTimeToFileTime
GlobalDeleteAtom
GetShortPathNameW
GetSystemInfo
GlobalFree
LCMapStringA
GetTimeFormatW
GetThreadLocale
GetEnvironmentStringsW
GlobalUnlock
VirtualQuery
lstrlenW
WinExec
Process32NextW
VirtualFree
EnumTimeFormatsW
GetCPInfoExW
GetEnvironmentStrings
CompareFileTime
GetCurrentProcessId
LockResource
GetCommandLineW
WideCharToMultiByte
InterlockedCompareExchange
Process32FirstW
GetCurrentThread
SuspendThread
GetSystemDefaultLangID
RaiseException
UnhandledExceptionFilter
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
OpenMutexW
GetACP
GlobalLock
GetModuleHandleW
FreeResource
FileTimeToLocalFileTime
SizeofResource
TlsGetValue
GetLocalTime
GetCurrentDirectoryW
FindResourceW
CreateProcessW
Sleep
SetThreadPriority
VirtualAlloc
ResetEvent
GradientFill
TransparentBlt
AlphaBlend
OleUninitialize
CoUninitialize
CoInitialize
OleInitialize
CoCreateInstance
CLSIDFromProgID
RevokeDragDrop
IsEqualGUID
CoTaskMemFree
VariantChangeType
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPtrOfIndex
SysAllocStringLen
SafeArrayUnaccessData
VariantCopyInd
VariantClear
SafeArrayCreate
SysReAllocStringLen
SafeArrayGetUBound
VariantCopy
GetErrorInfo
SysFreeString
SafeArrayPutElement
VariantInit
DragQueryFileW
SHBrowseForFolderW
DragAcceptFiles
SHFileOperationW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderPathA
DragQueryPoint
ShellExecuteExW
SHGetFileInfoW
ExtractIconW
Shell_NotifyIconW
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHGetMalloc
ShellExecuteA
DragFinish
SHGetFolderPathW
RedrawWindow
GetForegroundWindow
VkKeyScanExW
DrawTextW
EnableScrollBar
DestroyMenu
PostQuitMessage
GetMessagePos
DrawStateW
SetWindowPos
IsWindow
DispatchMessageA
EndPaint
CharUpperBuffA
WindowFromPoint
IntersectRect
PeekMessageA
CharUpperBuffW
SetMenuItemInfoW
SendMessageW
SetActiveWindow
GetDC
GetCursorPos
DrawTextA
GetMenuStringW
DefFrameProcW
EndMenu
TranslateMessage
OpenClipboard
SendMessageA
UnregisterClassW
GetClassInfoW
SetWindowContextHelpId
DefWindowProcW
CharLowerBuffA
LoadImageW
SetScrollPos
CallNextHookEx
IsClipboardFormatAvailable
MsgWaitForMultipleObjectsEx
GetClientRect
GetKeyboardState
keybd_event
GetActiveWindow
GetUpdateRgn
GetWindowTextW
EnumClipboardFormats
GetWindowTextLengthW
MsgWaitForMultipleObjects
GetTopWindow
GetKeyState
GetMenuContextHelpId
DestroyWindow
DrawEdge
GetParent
UpdateWindow
GetPropW
EqualRect
SetClassLongW
EnumWindows
GetMenuState
GetWindowContextHelpId
ShowWindow
DrawFrameControl
SetPropW
EnumDisplayMonitors
PeekMessageW
SetWindowsHookExW
EnableWindow
SetWindowPlacement
CharUpperW
LoadIconW
SetParent
IsWindowEnabled
GetWindow
ActivateKeyboardLayout
SetClipboardData
GetMenuItemID
GetIconInfo
GetQueueStatus
RegisterClassW
ScrollWindow
IsZoomed
GetWindowPlacement
LoadStringW
SetWindowLongW
GetKeyboardLayoutList
DrawMenuBar
EnableMenuItem
InvertRect
DrawFocusRect
GetDCEx
GetKeyboardLayout
FillRect
EnumThreadWindows
MonitorFromPoint
CreateAcceleratorTableW
GetSysColorBrush
IsWindowUnicode
CreateWindowExW
ReleaseDC
GetWindowLongW
CharNextW
IsChild
IsDialogMessageA
MapWindowPoints
RegisterWindowMessageW
GetMonitorInfoW
ReleaseCapture
EmptyClipboard
BeginPaint
OffsetRect
DefMDIChildProcW
GetScrollPos
CopyIcon
GetKeyboardLayoutNameW
KillTimer
MapVirtualKeyW
SetTimer
SetMenuContextHelpId
CheckMenuRadioItem
GetClipboardData
LoadBitmapW
GetSystemMetrics
IsIconic
SetScrollRange
BroadcastSystemMessage
GetWindowRect
InflateRect
SetCapture
DrawIcon
EnumChildWindows
GetScrollRange
GetMessageExtraInfo
CharLowerW
ShowOwnedPopups
PostMessageW
InvalidateRect
WaitMessage
CreatePopupMenu
CheckMenuItem
GetSubMenu
GetClassLongW
GetLastActivePopup
DrawIconEx
SetWindowTextW
CreateMenu
RemovePropW
FindWindowW
ClientToScreen
CountClipboardFormats
GetMenuItemCount
AttachThreadInput
DestroyAcceleratorTable
GetDesktopWindow
IsDialogMessageW
LoadCursorW
GetSystemMenu
FindWindowExW
DispatchMessageW
InsertMenuW
SetForegroundWindow
ExitWindowsEx
SetFocus
GetMenuItemInfoW
GetAsyncKeyState
wvsprintfW
CharLowerBuffW
DrawTextExW
GetScrollInfo
HideCaret
CreateIconIndirect
GetCapture
ScreenToClient
MessageBeep
RemoveMenu
GetWindowThreadProcessId
ShowScrollBar
MessageBoxW
GetMenu
MonitorFromRect
SetMenu
MoveWindow
LoadKeyboardLayoutW
MessageBoxA
GetWindowDC
DestroyCursor
AdjustWindowRectEx
TrackPopupMenu
GetSysColor
RegisterClipboardFormatW
SetScrollInfo
CopyImage
GetWindowRgn
DestroyIcon
IsWindowVisible
WinHelpW
SetCursorPos
SystemParametersInfoW
MonitorFromWindow
FrameRect
SetRect
DeleteMenu
GetKeyNameTextW
wsprintfA
CallWindowProcW
GetClassNameW
TranslateMDISysAccel
CreateIcon
ValidateRect
GetCursor
GetFocus
InsertMenuItemW
CloseClipboard
TranslateAcceleratorW
UnhookWindowsHookEx
SetCursor
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
timeKillEvent
timeSetEvent
timeGetTime
DocumentPropertiesW
OpenPrinterW
ClosePrinter
EnumPrintersW
Ord(203)
PE exports
Number of PE resources by type
RT_STRING 36
RT_GROUP_CURSOR 7
RT_CURSOR 7
RT_RCDATA 6
RT_ICON 1
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 42
ENGLISH US 14
RUSSIAN 4
PE resources
ExifTool file metadata
SubsystemVersion
5.0

InitializedDataSize
788992

ImageVersion
0.0

ProductName
ModInstall

FileVersionNumber
3.1.0.0

UninitializedDataSize
0

LanguageCode
Russian

FileFlagsMask
0x003f

CharacterSet
Windows, Cyrillic

LinkerVersion
5.0

FileTypeExtension
exe

MIMEType
application/octet-stream

Subsystem
Windows GUI

FileVersion
3.1.0.0

TimeStamp
2015:02:17 10:14:22+01:00

FileType
Win32 EXE

PEType
PE32

ProductVersion
1.0.0.0

FileDescription
ModInstall 3.0

OSVersion
4.0

FileOS
Win32

LegalCopyright
www.GameModding.net

MachineType
Intel 386 or later, and compatibles

CompanyName
www.GameModding.net

CodeSize
2555904

FileSubtype
0

ProductVersionNumber
3.1.0.0

EntryPoint
0x1d14

ObjectFileType
Executable application

File identification
MD5 078f4e419702fe352de737275a7b5572
SHA1 22746fa80bd40ac5d843689c18867aaf47c85b12
SHA256 2131173cb9969d9bc76bec8c874ad8fda41cc82dbececede1dfe3016045cca37
ssdeep
98304:eu5t3/PmH2m24A1pnOhEOtGsOu+Y0slXc/423Cv1/QZ/ZLnROLZRAflVUeYzISjm:euT3/OYOCtu+Y0su3Cv0Fnw/wYzIv

authentihash 642e72cd7867f5314bd5715c18a66063b58cdde42feeb8b58503ae37374669f4
imphash 9dd410cc200a3f275a72f1606c03b369
File size 7.0 MB ( 7392432 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Windows screen saver (60.5%)
Win32 Executable (generic) (20.8%)
Generic Win/DOS Executable (9.2%)
DOS Executable Generic (9.2%)
VXD Driver (0.1%)
Tags
peexe signed overlay

VirusTotal metadata
First submission 2015-05-28 08:37:14 UTC ( 2 years, 5 months ago )
Last submission 2015-05-28 08:37:14 UTC ( 2 years, 5 months ago )
File names 106258-kachestvennyy-skin-dlya-jagdpanther-ii-wot.exe
Advanced heuristic and reputation engines
ClamAV
Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: https://www.clamav.net/documents/potentially-unwanted-applications-pua .

Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Written files
Deleted files
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.