× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 41ca1baf59e457aa07b29f3f7033350d6c3aed3c397aa28128ed05a27e1eb6ac
File name: JHgd476
Detection ratio: 8 / 66
Analysis date: 2017-11-23 07:41:50 UTC ( 1 year, 1 month ago ) View latest
Antivirus Result Update
Baidu Win32.Trojan.WisdomEyes.16070401.9500.9999 20171123
CrowdStrike Falcon (ML) malicious_confidence_100% (D) 20171016
Cylance Unsafe 20171123
Endgame malicious (high confidence) 20171024
Fortinet W32/Kryptik.FYVN!tr 20171123
Sophos ML heuristic 20170914
Palo Alto Networks (Known Signatures) generic.ml 20171123
SentinelOne (Static ML) static engine - malicious 20171113
Ad-Aware 20171123
AegisLab 20171123
AhnLab-V3 20171123
Alibaba 20171123
Antiy-AVL 20171123
Arcabit 20171123
Avast 20171123
Avast-Mobile 20171123
AVG 20171123
Avira (no cloud) 20171123
AVware 20171123
BitDefender 20171123
Bkav 20171123
CAT-QuickHeal 20171122
ClamAV 20171123
CMC 20171122
Comodo 20171123
Cybereason 20171103
Cyren 20171123
DrWeb 20171123
eGambit 20171123
Emsisoft 20171123
ESET-NOD32 20171123
F-Prot 20171123
F-Secure 20171123
GData 20171123
Jiangmin 20171123
K7AntiVirus 20171123
K7GW 20171123
Kaspersky 20171123
Kingsoft 20171123
Malwarebytes 20171123
MAX 20171123
McAfee 20171123
McAfee-GW-Edition 20171123
Microsoft 20171123
eScan 20171123
NANO-Antivirus 20171123
nProtect 20171123
Panda 20171122
Qihoo-360 20171123
Rising 20171123
Sophos AV 20171123
SUPERAntiSpyware 20171123
Symantec 20171123
Symantec Mobile Insight 20171123
Tencent 20171123
TheHacker 20171121
TotalDefense 20171123
TrendMicro 20171123
TrendMicro-HouseCall 20171123
Trustlook 20171123
VBA32 20171122
VIPRE 20171123
ViRobot 20171123
Webroot 20171123
WhiteArmor 20171104
Yandex 20171120
Zillya 20171122
ZoneAlarm by Check Point 20171123
Zoner 20171123
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (C) 2017, gazolinesowhatmadmanwhatamitalk

File version 1.0.0.1
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2017-11-23 02:09:55
Entry Point 0x000012BD
Number of sections 6
PE sections
PE imports
GetLastError
InitializeCriticalSectionAndSpinCount
HeapFree
GetSystemTimeAsFileTime
EnterCriticalSection
LCMapStringW
lstrlenA
WriteConsoleW
GetConsoleCP
FreeLibrary
QueryPerformanceCounter
IsDebuggerPresent
ExitProcess
SetProcessShutdownParameters
TlsAlloc
GetCommMask
GetEnvironmentStringsW
FlushFileBuffers
LoadLibraryA
RtlUnwind
GetModuleFileNameA
GetStdHandle
GetCommandLineA
DeleteCriticalSection
GetCommTimeouts
GetStartupInfoW
GetConsoleMode
GetStringTypeW
GetCurrentProcessId
AddAtomA
UnhandledExceptionFilter
GetCommandLineW
WideCharToMultiByte
GetCommProperties
LoadLibraryExW
MultiByteToWideChar
GetAtomNameW
SetFilePointerEx
GetFileInformationByHandle
SetProcessAffinityMask
GetProcAddress
InitializeSListHead
HeapSize
FindNextFileA
SetStdHandle
RaiseException
GetFileSizeEx
GetCPInfo
TlsFree
FreeEnvironmentStringsW
FindFirstFileExA
SetUnhandledExceptionFilter
WriteFile
GetCurrentProcess
CloseHandle
IsProcessorFeaturePresent
GetProcessWorkingSetSize
GetThreadTimes
GetACP
HeapReAlloc
DecodePointer
GetModuleHandleW
GetOEMCP
GetSystemTimeAdjustment
GetThreadSelectorEntry
TerminateProcess
GetModuleHandleExW
IsValidCodePage
CreateFileW
GlobalAlloc
FindClose
TlsGetValue
GetFileType
TlsSetValue
HeapAlloc
GetCurrentThreadId
GetProcessHeap
SetLastError
LeaveCriticalSection
WinHttpCreateUrl
WinHttpWriteData
WinHttpReadData
WinHttpCloseHandle
Number of PE resources by type
RT_ICON 8
RT_BITMAP 3
RT_DIALOG 1
RT_GROUP_CURSOR 1
SAYITAZOCEBOPAROJURECUVIMEREWI 1
IPNJUYWQ 1
AFX_DIALOG_LAYOUT 1
RT_CURSOR 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 13
ENGLISH UK 3
ENGLISH US 2
LITHUANIAN NEUTRAL 1
PE resources
Debug information
ExifTool file metadata
UninitializedDataSize
0

LinkerVersion
14.0

ImageVersion
0.0

FileVersionNumber
1.0.0.1

LanguageCode
English (British)

FileFlagsMask
0x003f

ImageFileCharacteristics
Executable, 32-bit

CharacterSet
Unicode

InitializedDataSize
1334784

EntryPoint
0x12bd

MIMEType
application/octet-stream

Subsystem
Windows GUI

FileVersion
1.0.0.1

TimeStamp
2017:11:23 03:09:55+01:00

FileType
Win32 EXE

PEType
PE32

ProductVersion
1.0.0.1

SubsystemVersion
5.1

OSVersion
5.1

FileOS
Windows NT 32-bit

LegalCopyright
Copyright (C) 2017, gazolinesowhatmadmanwhatamitalk

MachineType
Intel 386 or later, and compatibles

CodeSize
66560

FileSubtype
0

ProductVersionNumber
1.0.0.1

FileTypeExtension
exe

ObjectFileType
Executable application

File identification
MD5 cfff508b34ff7832c77a32e70deae985
SHA1 6fe57cf326fc2434c93ccc0106b7b64ec0300dd7
SHA256 41ca1baf59e457aa07b29f3f7033350d6c3aed3c397aa28128ed05a27e1eb6ac
ssdeep
6144:VFoOj5ZVkljzhawXSrdq9jfE7j7uI3+waPqwvB3aUHGHwX8xuJr:VFoOjdkmzjuDwaPZB3BzCuJr

authentihash 67f5a6eb4abeac7bfd33bab952ac9e655d6458283219a3e454711218e5a1eec5
imphash 583ead2f5e08887321d2ce05d76b5bda
File size 357.0 KB ( 365568 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win64 Executable (generic) (72.3%)
Win32 Executable (generic) (11.8%)
OS/2 Executable (generic) (5.3%)
Generic Win/DOS Executable (5.2%)
DOS Executable Generic (5.2%)
Tags
peexe

VirusTotal metadata
First submission 2017-11-23 07:41:50 UTC ( 1 year, 1 month ago )
Last submission 2018-10-04 21:31:06 UTC ( 3 months, 2 weeks ago )
File names sevnz.exe
cfff508b34ff7832c77a32e70deae985.bin
16ad005f539d1b85128c86318f93fc92f1d23d15
JHgd476.exe
cfff508b34ff7832c77a32e70deae985.virus
JHgd476.exe
sevnz.txt
CFFF508B34FF7832C77A32E70DEAE985.exe
JHgd476.exe
cfff508b.gxe
JHgd476
sevnz.exe
JHgd476.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Created processes
Terminated processes
Opened mutexes
Runtime DLLs
UDP communications