× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 380ec805bdb56805f78412c8e705f49f889a09e55053467821e973f45e729b95
File name: Setup.exe
Detection ratio: 0 / 71
Analysis date: 2019-05-02 12:30:08 UTC ( 2 weeks, 3 days ago )
Antivirus Result Update
Acronis 20190501
Ad-Aware 20190502
AegisLab 20190502
AhnLab-V3 20190502
Alibaba 20190426
ALYac 20190502
Antiy-AVL 20190502
Arcabit 20190502
Avast 20190502
Avast-Mobile 20190502
AVG 20190502
Babable 20190424
Baidu 20190318
BitDefender 20190502
Bkav 20190502
CAT-QuickHeal 20190502
ClamAV 20190502
CMC 20190321
Comodo 20190502
CrowdStrike Falcon (ML) 20190212
Cybereason 20190417
Cylance 20190502
Cyren 20190502
DrWeb 20190502
eGambit 20190502
Emsisoft 20190502
Endgame 20190403
ESET-NOD32 20190502
F-Prot 20190502
F-Secure 20190502
FireEye 20190502
Fortinet 20190502
GData 20190502
Ikarus 20190502
Sophos ML 20190313
Jiangmin 20190502
K7AntiVirus 20190502
K7GW 20190502
Kaspersky 20190502
Kingsoft 20190502
Malwarebytes 20190502
MAX 20190502
MaxSecure 20190430
McAfee 20190502
McAfee-GW-Edition 20190501
Microsoft 20190502
eScan 20190502
NANO-Antivirus 20190502
Palo Alto Networks (Known Signatures) 20190502
Panda 20190502
Qihoo-360 20190502
Rising 20190502
SentinelOne (Static ML) 20190420
Sophos AV 20190502
SUPERAntiSpyware 20190430
Symantec Mobile Insight 20190418
TACHYON 20190502
Tencent 20190502
TheHacker 20190430
TotalDefense 20190502
Trapmine 20190325
TrendMicro 20190502
TrendMicro-HouseCall 20190502
Trustlook 20190502
VBA32 20190502
VIPRE 20190501
ViRobot 20190502
Webroot 20190502
Yandex 20190501
Zillya 20190429
ZoneAlarm by Check Point 20190502
Zoner 20190501
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Tilman Hausherr

Product Xenu's Link Sleuth
File version 1.3.8
Description Xenu's Link Sleuth 1.3.8 Setup
Comments This installation was built with NSIS: http://nsis.sourceforge.net
Packers identified
F-PROT NSIS, appended, Unicode
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2009-12-05 22:50:46
Entry Point 0x0000323C
Number of sections 5
PE sections
Overlays
MD5 6dd50be606986115e29b9c27562c5cbe
File type data
Offset 59904
Size 403795
Entropy 8.00
PE imports
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegEnumValueA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
RegDeleteValueA
ImageList_Create
Ord(17)
ImageList_Destroy
ImageList_AddMasked
GetDeviceCaps
SetBkMode
CreateBrushIndirect
CreateFontIndirectA
SelectObject
SetBkColor
DeleteObject
SetTextColor
GetLastError
lstrlenA
GetFileAttributesA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
CopyFileA
ExitProcess
SetFileTime
GlobalUnlock
GetModuleFileNameA
LoadLibraryA
GetShortPathNameA
GetCurrentProcess
LoadLibraryExA
CompareFileTime
GetPrivateProfileStringA
WritePrivateProfileStringA
GetFileSize
lstrcatA
CreateDirectoryA
DeleteFileA
GetWindowsDirectoryA
SetErrorMode
MultiByteToWideChar
GetCommandLineA
GlobalLock
SetFileAttributesA
SetFilePointer
GetTempPathA
CreateThread
lstrcmpiA
GetModuleHandleA
lstrcmpA
ReadFile
WriteFile
FindFirstFileA
CloseHandle
GetTempFileNameA
lstrcpynA
FindNextFileA
RemoveDirectoryA
GetSystemDirectoryA
GetDiskFreeSpaceA
ExpandEnvironmentStringsA
GetFullPathNameA
FreeLibrary
MoveFileA
CreateProcessA
GlobalAlloc
SearchPathA
FindClose
Sleep
CreateFileA
GetTickCount
GetVersion
GetProcAddress
SetCurrentDirectoryA
MulDiv
SHGetFileInfoA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
SHFileOperationA
EmptyClipboard
GetMessagePos
EndPaint
CharPrevA
EndDialog
BeginPaint
PostQuitMessage
DefWindowProcA
SetWindowTextA
SetClassLongA
LoadBitmapA
SetWindowPos
GetSystemMetrics
IsWindow
AppendMenuA
GetWindowRect
DispatchMessageA
ScreenToClient
SetDlgItemTextA
MessageBoxIndirectA
LoadImageA
GetDlgItemTextA
PeekMessageA
SetWindowLongA
IsWindowEnabled
GetSysColor
CheckDlgButton
GetDC
FindWindowExA
SystemParametersInfoA
CreatePopupMenu
wsprintfA
DialogBoxParamA
SetClipboardData
IsWindowVisible
GetClassInfoA
SetForegroundWindow
GetClientRect
CreateWindowExA
GetDlgItem
CreateDialogParamA
DrawTextA
EnableMenuItem
RegisterClassA
InvalidateRect
GetWindowLongA
SendMessageTimeoutA
SetTimer
LoadCursorA
TrackPopupMenu
SendMessageA
FillRect
ShowWindow
OpenClipboard
CharNextA
CallWindowProcA
GetSystemMenu
EnableWindow
CloseClipboard
DestroyWindow
ExitWindowsEx
SetCursor
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
OleUninitialize
CoTaskMemFree
OleInitialize
CoCreateInstance
Number of PE resources by type
RT_ICON 8
RT_DIALOG 6
RT_MANIFEST 1
RT_BITMAP 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 18
PE resources
ExifTool file metadata
SubsystemVersion
4.0

Comments
This installation was built with NSIS: http://nsis.sourceforge.net

LinkerVersion
6.0

ImageVersion
6.0

FileSubtype
0

FileVersionNumber
0.0.0.0

LanguageCode
English (U.S.)

FileFlagsMask
0x0000

FileDescription
Xenu's Link Sleuth 1.3.8 Setup

ImageFileCharacteristics
No relocs, Executable, No line numbers, No symbols, 32-bit

CharacterSet
ASCII

InitializedDataSize
119808

EntryPoint
0x323c

MIMEType
application/octet-stream

LegalCopyright
Tilman Hausherr

FileVersion
1.3.8

TimeStamp
2009:12:05 23:50:46+01:00

FileType
Win32 EXE

PEType
PE32

UninitializedDataSize
1024

OSVersion
4.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Tilman Hausherr

CodeSize
23552

ProductName
Xenu's Link Sleuth

ProductVersionNumber
0.0.0.0

FileTypeExtension
exe

ObjectFileType
Executable application

CarbonBlack CarbonBlack acts as a surveillance camera for computers
Execution parents
Compressed bundles
File identification
MD5 1516c013ee32d7b32d1a391e3e6a4846
SHA1 a35180ca02c265402d5e979235e6cc784a3f02e2
SHA256 380ec805bdb56805f78412c8e705f49f889a09e55053467821e973f45e729b95
ssdeep
6144:CsB99KMJqDDBiyi03fQL8+DfS8CvwS/1V4wYEnQFrdgRqHJzqUjB67nsxz:79BqDUyi0oVfS8Cv9X4wJ8GYDjB6j4z

authentihash 11fc0257552c8b9ef08a2f9a459909b5ad385e5f5efc441addb4c9499c32900f
imphash 099c0646ea7282d232219f8807883be0
File size 452.8 KB ( 463699 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID NSIS - Nullsoft Scriptable Install System (94.6%)
Win32 Executable MS Visual C++ (generic) (3.4%)
Win32 Dynamic Link Library (generic) (0.7%)
Win32 Executable (generic) (0.5%)
OS/2 Executable (generic) (0.2%)
Tags
nsis peexe overlay

VirusTotal metadata
First submission 2010-09-04 05:29:15 UTC ( 8 years, 8 months ago )
Last submission 2019-04-27 12:04:19 UTC ( 3 weeks, 1 day ago )
File names vsll0ngm.oua
Xenu-Setup.exe
zip.000
Setup.exe
1516c013ee32d7b32d1a391e3e6a4846
000315f9.tmp
vscf1ga7.ec6
smona132574052460162940517
946B73265372257B132207D33F4F7B002A55CDD7.exe
xenu_setup.exe
vsll1b03.aut
380ec805bdb56805f78412c8e705f49f889a09e55053467821e973f45e729b95
vstl0r7g.r4l
vsro12k7.old
XENU.exe
1.exe
vsb31du4.b5j
vso60j75.o06
Setup.no
smona131099015220378342987
setup-{2ba0d823-4146-4f00-99ca-9bdfecd91e28}-v18764315.exe
Setup.exe
vs5l100b.pvc
vs2b0iig.l1t
vs061gg2.r28
Advanced heuristic and reputation engines
ClamAV
Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: https://www.clamav.net/documents/potentially-unwanted-applications-pua .

Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!