× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 4a0ab371e6c6dd54deeab41ab1b77fa373d2face149523dfd183d669b31da6bc
File name: eofuevkngzxwcwjtxva.exe.vir
Detection ratio: 12 / 43
Analysis date: 2011-02-16 07:09:26 UTC ( 4 years, 3 months ago ) View latest
Antivirus Result Update
AhnLab-V3 Trojan/Win32.CSon 20110214
Emsisoft Trojan.Win32.Oficla!IK 20110216
Ikarus Trojan.Win32.Oficla 20110216
Kaspersky IM-Worm.Win32.Yahos.su 20110216
NOD32 a variant of Win32/Kryptik.KRH 20110215
PCTools Trojan.Bredolab 20110216
Panda Suspicious file 20110215
Prevx Medium Risk Malware 20110216
Symantec Trojan.Bredolab 20110216
TrendMicro TROJ_SPYEYE.SMEP 20110216
TrendMicro-HouseCall TROJ_SPYEYE.SMEP 20110215
VIPRE FraudTool.Win32.AVSoft (v) 20110216
AVG 20110216
AntiVir 20110215
Antiy-AVL 20110215
Avast 20110216
Avast5 20110216
BitDefender 20110216
CAT-QuickHeal 20110216
ClamAV 20110216
Commtouch 20110216
Comodo 20110216
DrWeb 20110216
F-Prot 20110215
F-Secure 20110216
Fortinet 20110216
GData 20110216
Jiangmin 20110216
K7AntiVirus 20110215
McAfee 20110216
McAfee-GW-Edition 20110216
Microsoft 20110216
Norman None
Rising 20110215
SUPERAntiSpyware 20110216
Sophos 20110216
TheHacker 20110215
VBA32 20110215
ViRobot 20110216
VirusBuster 20110215
eSafe 20110215
eTrust-Vet 20110215
nProtect 20110215
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Developer metadata
Copyright
Copyright (c) 2002-2005 Four-F

Publisher Four-F
Product Kernel Mode Driver Manager
Original name KmdManager.exe
Internal name KmdManager
File version 1, 3, 0, 0
Description Kernel Mode Driver Manager
Comments Let you install, start, stop and uninstall device drivers
Packers identified
Command UPX
F-PROT UPX
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2005-03-27 17:45:07
Entry Point 0x000146B0
Number of sections 3
PE sections
PE imports
RegCloseKey
ImageList_Draw
VirtualFree
ExitProcess
VirtualProtect
LoadLibraryA
VirtualAlloc
GetProcAddress
DragFinish
PathIsDirectoryA
CopyRect
Number of PE resources by type
RT_VERSION 1
Number of PE resources by language
RUSSIAN 1
ExifTool file metadata
SubsystemVersion
4.0

Comments
Let you install, start, stop and uninstall device drivers

InitializedDataSize
4096

ImageVersion
5.1

FileSubtype
0

FileVersionNumber
1.3.0.0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

FileDescription
Kernel Mode Driver Manager

CharacterSet
Windows, Latin1

LinkerVersion
8.2

FileOS
Windows NT 32-bit

MIMEType
application/octet-stream

LegalCopyright
Copyright 2002-2005 Four-F

FileVersion
1, 3, 0, 0

TimeStamp
2005:03:27 18:45:07+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
KmdManager

ProductVersion
1.3

UninitializedDataSize
49152

OSVersion
8.3

OriginalFilename
KmdManager.exe

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Four-F

CodeSize
32768

ProductName
Kernel Mode Driver Manager

ProductVersionNumber
1.3.0.0

EntryPoint
0x146b0

ObjectFileType
Executable application

File identification
MD5 3810631eeaea4950d0e1bd48ec89be12
SHA1 3f8254e9a3b2f813eaf34fd239436f9e0e9f7d66
SHA256 4a0ab371e6c6dd54deeab41ab1b77fa373d2face149523dfd183d669b31da6bc
ssdeep
768:zDY7TVOuQ54AV+AJpA1otliTC/3UO0hNSfea1NPn:zDY7M95MA01o7/UO0uf

File size 33.0 KB ( 33792 bytes )
File type Win32 EXE
Magic literal
MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit, UPX compressed

TrID Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
Tags
peexe upx

VirusTotal metadata
First submission 2011-02-15 10:06:50 UTC ( 4 years, 3 months ago )
Last submission 2012-10-21 10:25:25 UTC ( 2 years, 7 months ago )
File names kp.php
KmdManager.exe
file-1860913_exe
3810631EEAEA4950D0E1BD48EC89BE12
gvbugzbvazhtapelez.exe_
eofuevkngzxwcwjtxva.exe.vir
8E2B6CFC002BFF8C848F006FBC0CE1000BBB4DEB.exe
KmdManager
3810631eeaea4950d0e1bd48ec89be12
~tm65237.tmp
4a0ab371e6c6dd54deeab41ab1b77fa373d2face149523dfd183d669b31da6bc.bin
Advanced heuristic and reputation engines
ClamAV PUA
Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: http://www.clamav.net/doc/pua.html .

Behaviour characterization
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!