| SHA256: | 4a417963968601bbe8f9311d779d1a022a380829bed4b7af4daf934eeba5c70f |
| File name: | 4a417963968601bbe8f9311d779d1a022a380829bed4b7af4daf934eeba5c70f |
| Detection ratio: | 9 / 69 |
| Analysis date: | 2018-12-04 13:04:56 UTC ( 2 months, 2 weeks ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| CrowdStrike Falcon (ML) | malicious_confidence_100% (D) | 20181022 |
| Cylance | Unsafe | 20181204 |
| eGambit | Unsafe.AI_Score_93% | 20181204 |
| Endgame | malicious (high confidence) | 20181108 |
| Microsoft | Trojan:Win32/Fuerboos.A!cl | 20181204 |
| Qihoo-360 | HEUR/QVM19.1.A3BB.Malware.Gen | 20181204 |
| Rising | Trojan.Kryptik!8.8 (TFE:dGZlOgTGGHQvxT1H/g) | 20181204 |
| Symantec | ML.Attribute.HighConfidence | 20181204 |
| Trapmine | malicious.high.ml.score | 20181128 |
| Ad-Aware | 20181204 | |
| AegisLab | 20181204 | |
| AhnLab-V3 | 20181204 | |
| Alibaba | 20180921 | |
| ALYac | 20181204 | |
| Antiy-AVL | 20181204 | |
| Arcabit | 20181204 | |
| Avast | 20181204 | |
| Avast-Mobile | 20181204 | |
| AVG | 20181204 | |
| Avira (no cloud) | 20181204 | |
| Babable | 20180918 | |
| Baidu | 20181204 | |
| BitDefender | 20181204 | |
| Bkav | 20181203 | |
| CAT-QuickHeal | 20181203 | |
| ClamAV | 20181203 | |
| CMC | 20181204 | |
| Comodo | 20181204 | |
| Cybereason | 20180225 | |
| Cyren | 20181204 | |
| DrWeb | 20181204 | |
| Emsisoft | 20181204 | |
| ESET-NOD32 | 20181204 | |
| F-Prot | 20181204 | |
| F-Secure | 20181204 | |
| Fortinet | 20181204 | |
| GData | 20181204 | |
| Ikarus | 20181203 | |
| Sophos ML | 20181128 | |
| Jiangmin | 20181204 | |
| K7AntiVirus | 20181204 | |
| K7GW | 20181204 | |
| Kaspersky | 20181204 | |
| Kingsoft | 20181204 | |
| Malwarebytes | 20181204 | |
| MAX | 20181204 | |
| McAfee | 20181204 | |
| McAfee-GW-Edition | 20181204 | |
| eScan | 20181204 | |
| NANO-Antivirus | 20181204 | |
| Palo Alto Networks (Known Signatures) | 20181204 | |
| Panda | 20181203 | |
| SentinelOne (Static ML) | 20181011 | |
| Sophos AV | 20181204 | |
| SUPERAntiSpyware | 20181128 | |
| Symantec Mobile Insight | 20181204 | |
| TACHYON | 20181204 | |
| Tencent | 20181204 | |
| TheHacker | 20181202 | |
| TotalDefense | 20181204 | |
| TrendMicro | 20181204 | |
| TrendMicro-HouseCall | 20181204 | |
| Trustlook | 20181204 | |
| VBA32 | 20181204 | |
| ViRobot | 20181204 | |
| Webroot | 20181204 | |
| Yandex | 20181204 | |
| Zillya | 20181203 | |
| ZoneAlarm by Check Point | 20181204 | |
| Zoner | 20181204 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
© Microsoft Corporation. All rights
Product Microsoft®
Original name mfAA
Internal name Med
File version 6.1.7600.16385 (win7_rtm.090713-1
Description Media Foundation AA
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2018-12-04 13:00:47
Entry Point 0x00002981
Number of sections 7
PE sections
PE imports
Number of PE resources by type
RT_MANIFEST 1
RT_VERSION 1
Number of PE resources by language
ENGLISH US 2
PE resources
ExifTool file metadata
UninitializedDataSize
0
LinkerVersion
2.0
ImageVersion
1.0
FileSubtype
0
FileVersionNumber
6.1.7600.16385
LanguageCode
English (U.S.)
FileFlagsMask
0x003f
FileDescription
Media Foundation AA
ImageFileCharacteristics
Executable, 32-bit
CharacterSet
Unicode
InitializedDataSize
377344
EntryPoint
0x2981
OriginalFileName
mfAA
MIMEType
application/octet-stream
LegalCopyright
Microsoft Corporation. All rights
FileVersion
6.1.7600.16385 (win7_rtm.090713-1
TimeStamp
2018:12:04 05:00:47-08:00
FileType
Win32 EXE
PEType
PE32
InternalName
Med
ProductVersion
6.1.7600.163
SubsystemVersion
5.0
OSVersion
5.0
FileOS
Windows NT 32-bit
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
Microsoft Co
CodeSize
13824
ProductName
Microsoft
ProductVersionNumber
6.1.7600.16385
FileTypeExtension
exe
ObjectFileType
Executable application
File identification
MD5 ac4ad219921aa13ac020f5dc460ad503
SHA1 df3cadeb2736d3df7a31c6c9d3dad122d9570e16
SHA256 4a417963968601bbe8f9311d779d1a022a380829bed4b7af4daf934eeba5c70f
ssdeep
3072:Qiz52gCZrwDdc/dktao29OpN+S2YZLQ9KOdOgo0N1tqMIhJcyRBaIC:QYEtroakoo27S2YZ89b/l1QFheyR
File size
376.0 KB ( 385024 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Dynamic Link Library (generic) (38.4%) Win32 Executable (generic) (26.3%) OS/2 Executable (generic) (11.8%) Generic Win/DOS Executable (11.6%) DOS Executable Generic (11.6%) |
Tags
peexe
VirusTotal metadata
First submission
2018-12-04 13:04:54 UTC ( 2 months, 2 weeks ago )
Last submission
2018-12-04 14:45:04 UTC ( 2 months, 2 weeks ago )
| File names |
Med mfAA payload_1.exe 3284924.exe 516064.exe 0392923.exe 67.exe 5.exe 021971.exe output.114634515.txt 60081.exe 38.exe |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!