× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 4a0ab371e6c6dd54deeab41ab1b77fa373d2face149523dfd183d669b31da6bc
File name: file-1860913_exe
Detection ratio: 23 / 42
Analysis date: 2011-02-17 21:27:19 UTC ( 3 years, 2 months ago ) View latest
Antivirus Result Update
AVG Downloader.Generic10.CHAW 20110217
AhnLab-V3 Trojan/Win32.CSon 20110214
AntiVir Worm/Yahos.su 20110217
BitDefender Trojan.Generic.KDV.134134 20110217
DrWeb Win32.HLLW.Oscar.41 20110217
GData Trojan.Generic.KDV.134134 20110217
Ikarus Trojan.Win32.Oficla 20110217
Kaspersky IM-Worm.Win32.Yahos.su 20110217
McAfee Generic Downloader.z 20110217
McAfee-GW-Edition Generic Downloader.z 20110217
Microsoft TrojanDownloader:Win32/Bredolab.AC 20110217
NOD32 a variant of Win32/Kryptik.KSO 20110217
Norman W32/Smalltroj.ZMEH 20110217
PCTools Trojan.Bredolab 20110217
Panda Trj/CI.A 20110217
Rising [Suspicious] 20110217
SUPERAntiSpyware Trojan.Agent/Gen-FraudAgent 20110217
Sophos Troj/Spyeye-V 20110217
Symantec Trojan.Bredolab 20110217
TrendMicro TROJ_SPYEYE.SMEP 20110217
TrendMicro-HouseCall TROJ_SPYEYE.SMEP 20110215
VIPRE FraudTool.Win32.AVSoft (v) 20110217
eSafe Win32.Bredolab 20110217
Antiy-AVL 20110217
Avast 20110217
Avast5 20110217
CAT-QuickHeal 20110217
ClamAV 20110217
Commtouch 20110217
Comodo 20110217
F-Prot 20110217
F-Secure 20110217
Fortinet 20110217
Jiangmin 20110217
K7AntiVirus 20110217
Prevx 20110217
TheHacker 20110217
VBA32 20110217
ViRobot 20110217
VirusBuster 20110217
eTrust-Vet 20110217
nProtect 20110215
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block
Copyright
Copyright (c) 2002-2005 Four-F

Publisher Four-F
Product Kernel Mode Driver Manager
Original name KmdManager.exe
Internal name KmdManager
File version 1, 3, 0, 0
Description Kernel Mode Driver Manager
Comments Let you install, start, stop and uninstall device drivers
Packers identified
Command UPX
F-PROT UPX
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2005-03-27 17:45:07
Entry Point 0x000146B0
Number of sections 3
PE sections
PE imports
RegCloseKey
ImageList_Draw
VirtualFree
ExitProcess
VirtualProtect
LoadLibraryA
VirtualAlloc
GetProcAddress
DragFinish
PathIsDirectoryA
CopyRect
Number of PE resources by type
RT_VERSION 1
Number of PE resources by language
RUSSIAN 1
ExifTool file metadata
SubsystemVersion
4.0

Comments
Let you install, start, stop and uninstall device drivers

InitializedDataSize
4096

ImageVersion
5.1

FileSubtype
0

FileVersionNumber
1.3.0.0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

FileDescription
Kernel Mode Driver Manager

CharacterSet
Windows, Latin1

LinkerVersion
8.2

FileOS
Windows NT 32-bit

MIMEType
application/octet-stream

LegalCopyright
Copyright 2002-2005 Four-F

FileVersion
1, 3, 0, 0

TimeStamp
2005:03:27 18:45:07+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
KmdManager

ProductVersion
1.3

UninitializedDataSize
49152

OSVersion
8.3

OriginalFilename
KmdManager.exe

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Four-F

CodeSize
32768

ProductName
Kernel Mode Driver Manager

ProductVersionNumber
1.3.0.0

EntryPoint
0x146b0

ObjectFileType
Executable application

File identification
MD5 3810631eeaea4950d0e1bd48ec89be12
SHA1 3f8254e9a3b2f813eaf34fd239436f9e0e9f7d66
SHA256 4a0ab371e6c6dd54deeab41ab1b77fa373d2face149523dfd183d669b31da6bc
ssdeep
768:zDY7TVOuQ54AV+AJpA1otliTC/3UO0hNSfea1NPn:zDY7M95MA01o7/UO0uf

File size 33.0 KB ( 33792 bytes )
File type Win32 EXE
Magic literal
MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit, UPX compressed

TrID Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
Tags
peexe upx

VirusTotal metadata
First submission 2011-02-15 10:06:50 UTC ( 3 years, 2 months ago )
Last submission 2012-10-21 10:25:25 UTC ( 1 year, 6 months ago )
File names kp.php
KmdManager.exe
file-1860913_exe
3810631EEAEA4950D0E1BD48EC89BE12
gvbugzbvazhtapelez.exe_
eofuevkngzxwcwjtxva.exe.vir
8E2B6CFC002BFF8C848F006FBC0CE1000BBB4DEB.exe
KmdManager
3810631eeaea4950d0e1bd48ec89be12
~tm65237.tmp
4a0ab371e6c6dd54deeab41ab1b77fa373d2face149523dfd183d669b31da6bc.bin
Advanced heuristic and reputation engines
ClamAV PUA
Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: http://www.clamav.net/index.php?s=pua&lang=en .

Behaviour characterization
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!