| SHA256: | 4bf81e1153f96254505204c70d90f2ad9d4f31fda1ce83db4e2ea8c3f381e616 |
| File name: | 4bf81e1153f96254505204c70d90f2ad9d4f31fda1ce83db4e2ea8c3f381e616 |
| Detection ratio: | 0 / 68 |
| Analysis date: | 2017-12-16 12:18:18 UTC ( 1 year, 2 months ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| Ad-Aware | 20171216 | |
| AegisLab | 20171216 | |
| AhnLab-V3 | 20171216 | |
| Alibaba | 20171215 | |
| ALYac | 20171216 | |
| Antiy-AVL | 20171216 | |
| Arcabit | 20171215 | |
| Avast | 20171216 | |
| Avast-Mobile | 20171215 | |
| AVG | 20171216 | |
| Avira (no cloud) | 20171216 | |
| AVware | 20171216 | |
| Baidu | 20171216 | |
| BitDefender | 20171216 | |
| Bkav | 20171216 | |
| CAT-QuickHeal | 20171216 | |
| ClamAV | 20171216 | |
| CMC | 20171216 | |
| Comodo | 20171216 | |
| CrowdStrike Falcon (ML) | 20171016 | |
| Cybereason | 20171103 | |
| Cylance | 20171216 | |
| Cyren | 20171216 | |
| DrWeb | 20171216 | |
| eGambit | 20171216 | |
| Emsisoft | 20171216 | |
| Endgame | 20171130 | |
| ESET-NOD32 | 20171216 | |
| F-Prot | 20171216 | |
| F-Secure | 20171216 | |
| Fortinet | 20171216 | |
| GData | 20171216 | |
| Ikarus | 20171216 | |
| Sophos ML | 20170914 | |
| Jiangmin | 20171216 | |
| K7AntiVirus | 20171216 | |
| K7GW | 20171214 | |
| Kaspersky | 20171216 | |
| Kingsoft | 20171216 | |
| Malwarebytes | 20171216 | |
| MAX | 20171216 | |
| McAfee | 20171216 | |
| McAfee-GW-Edition | 20171216 | |
| Microsoft | 20171216 | |
| eScan | 20171216 | |
| NANO-Antivirus | 20171216 | |
| nProtect | 20171216 | |
| Palo Alto Networks (Known Signatures) | 20171216 | |
| Panda | 20171216 | |
| Qihoo-360 | 20171216 | |
| Rising | 20171216 | |
| SentinelOne (Static ML) | 20171207 | |
| Sophos AV | 20171216 | |
| SUPERAntiSpyware | 20171216 | |
| Symantec | 20171215 | |
| Symantec Mobile Insight | 20171215 | |
| Tencent | 20171216 | |
| TheHacker | 20171210 | |
| TotalDefense | 20171216 | |
| TrendMicro | 20171216 | |
| TrendMicro-HouseCall | 20171216 | |
| Trustlook | 20171216 | |
| VBA32 | 20171215 | |
| VIPRE | 20171216 | |
| ViRobot | 20171216 | |
| Webroot | 20171216 | |
| WhiteArmor | 20171204 | |
| Yandex | 20171216 | |
| Zillya | 20171214 | |
| ZoneAlarm by Check Point | 20171216 | |
| Zoner | 20171216 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
Jeff L. Holcomb 2000 - 2017
Product Kaleider
File version Kaleider 5.2.1
Description Kaleider 5.2.1
Comments This installation was built with Inno Setup.
Signature verification
Signed file, verified signature
Signing date 8:25 PM 10/27/2017
| Signers |
| Counter signers |
Packers identified
F-PROT INNO, appended
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2016-04-06 14:39:04
Entry Point 0x000117DC
Number of sections 8
PE sections
Overlays
MD5 d581d9a2cd59b073674f228bc0b67c0c
File type data
Offset 121344
Size 9136752
Entropy 8.00
PE imports
Number of PE resources by type
RT_STRING 6
RT_ICON 4
RT_RCDATA 4
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 9
ENGLISH US 4
DUTCH 4
PE resources
ExifTool file metadata
UninitializedDataSize
0
Comments
This installation was built with Inno Setup.
LinkerVersion
2.25
ImageVersion
6.0
FileSubtype
0
FileVersionNumber
5.2.1.0
LanguageCode
Neutral
FileFlagsMask
0x003f
CharacterSet
Unicode
InitializedDataSize
53760
EntryPoint
0x117dc
MIMEType
application/octet-stream
LegalCopyright
Jeff L. Holcomb 2000 - 2017
FileVersion
Kaleider 5.2.1
TimeStamp
2016:04:06 14:39:04+00:00
FileType
Win32 EXE
PEType
PE32
SubsystemVersion
5.0
ProductVersion
Kaleider 5.2.1
FileDescription
Kaleider 5.2.1
OSVersion
5.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
Whizical.com
CodeSize
66560
ProductName
Kaleider
ProductVersionNumber
5.2.1.0
FileTypeExtension
exe
ObjectFileType
Executable application
File identification
MD5 543aa59c1ef063667febeb085bf8699a
SHA1 742a645552dbce6cf4bee5fdc6e6523d4e6f9c10
SHA256 4bf81e1153f96254505204c70d90f2ad9d4f31fda1ce83db4e2ea8c3f381e616
ssdeep
196608:6VHmFArcrW6z+J5OvMWvtds+JpdIxAqhj6bz3T6ZzubIGmTusbA:YH0ArcrxDs+Lxqj6bTTOqIGmas8
File size
8.8 MB ( 9258096 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable Delphi generic (42.4%) Win32 Dynamic Link Library (generic) (19.7%) Win32 Executable (generic) (13.5%) Win16/32 Executable Delphi generic (6.2%) OS/2 Executable (generic) (6.0%) |
Tags
peexe
signed
overlay
VirusTotal metadata
First submission
2017-10-30 08:30:39 UTC ( 1 year, 3 months ago )
Last submission
2018-04-07 11:23:40 UTC ( 10 months, 3 weeks ago )
| File names |
KaleidTr.exe |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.