| SHA256: | 4d9642c8a02f9c2027e281bab8a42b6d033cdf4a677c5ece600084821e70b1c0 |
| File name: | H1JBFJI.EXE |
| Detection ratio: | 36 / 63 |
| Analysis date: | 2018-07-03 10:05:37 UTC ( 7 months, 2 weeks ago ) |
| Antivirus | Result | Update |
|---|---|---|
| Ad-Aware | Gen:Variant.Ser.Ursu.391 | 20180703 |
| ALYac | Gen:Variant.Ser.Ursu.391 | 20180703 |
| Arcabit | Trojan.Ser.Ursu.391 | 20180703 |
| Avast | Win32:GenX | 20180703 |
| AVG | Win32:GenX | 20180703 |
| Baidu | Win32.Trojan.WisdomEyes.16070401.9500.9999 | 20180703 |
| BitDefender | Gen:Variant.Ser.Ursu.391 | 20180703 |
| CAT-QuickHeal | Trojan.Generic | 20180702 |
| Comodo | TrojWare.Win32.Dovs.MO | 20180703 |
| CrowdStrike Falcon (ML) | malicious_confidence_100% (D) | 20180530 |
| Cyren | W32/Emotet.DE.gen!Eldorado | 20180703 |
| Emsisoft | Trojan.Emotet (A) | 20180703 |
| ESET-NOD32 | a variant of Win32/Kryptik.GHQZ | 20180703 |
| F-Prot | W32/Emotet.DE.gen!Eldorado | 20180703 |
| F-Secure | Gen:Variant.Ser.Ursu.391 | 20180703 |
| Fortinet | W32/Kryptik.GHQZ!tr | 20180703 |
| GData | Win32.Trojan-Spy.Emotet.RF | 20180703 |
| Ikarus | Trojan-Banker.Emotet | 20180703 |
| Sophos ML | heuristic | 20180601 |
| K7AntiVirus | Trojan ( 00533d561 ) | 20180703 |
| K7GW | Trojan ( 00533d561 ) | 20180703 |
| Kaspersky | HEUR:Trojan.Win32.Generic | 20180703 |
| Malwarebytes | Trojan.Emotet | 20180703 |
| MAX | malware (ai score=86) | 20180703 |
| McAfee | GenericRXFT-NE!5BF8A5D87B25 | 20180703 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.dt | 20180703 |
| eScan | Gen:Variant.Ser.Ursu.391 | 20180703 |
| Panda | Trj/Genetic.gen | 20180702 |
| Qihoo-360 | HEUR/QVM20.1.411B.Malware.Gen | 20180703 |
| SentinelOne (Static ML) | static engine - malicious | 20180701 |
| Sophos AV | Mal/EncPk-ANX | 20180703 |
| Symantec | ML.Attribute.HighConfidence | 20180703 |
| Tencent | Win32.Trojan.Generic.Tapk | 20180703 |
| VBA32 | BScope.Trojan.Dovs | 20180629 |
| Webroot | W32.Trojan.Emotet | 20180703 |
| ZoneAlarm by Check Point | HEUR:Trojan.Win32.Generic | 20180703 |
| AegisLab | 20180703 | |
| AhnLab-V3 | 20180703 | |
| Antiy-AVL | 20180703 | |
| Avast-Mobile | 20180703 | |
| Avira (no cloud) | 20180703 | |
| AVware | 20180703 | |
| Babable | 20180406 | |
| Bkav | 20180702 | |
| ClamAV | 20180703 | |
| CMC | 20180702 | |
| Cybereason | 20180225 | |
| DrWeb | 20180703 | |
| eGambit | 20180703 | |
| Endgame | 20180612 | |
| Jiangmin | 20180703 | |
| Kingsoft | 20180703 | |
| Microsoft | 20180703 | |
| NANO-Antivirus | 20180703 | |
| Palo Alto Networks (Known Signatures) | 20180703 | |
| SUPERAntiSpyware | 20180703 | |
| TACHYON | 20180703 | |
| TheHacker | 20180628 | |
| TotalDefense | 20180703 | |
| Trustlook | 20180703 | |
| VIPRE | 20180703 | |
| ViRobot | 20180703 | |
| Yandex | 20180702 | |
| Zillya | 20180702 | |
| Zoner | 20180702 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (C) 2013 Realtek Semiconductor Corporation. All Right Reserved.
Product RTNicProp
Original name RTNicProp.dll
Internal name RTNicProp
File version 1, 2, 0, 6
Description About Page
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2018-06-11 04:40:27
Entry Point 0x0000100F
Number of sections 9
PE sections
PE imports
Number of PE resources by type
RT_DIALOG 32
RT_MANIFEST 1
RT_VERSION 1
Number of PE resources by language
ENGLISH US 2
HEBREW DEFAULT 1
PORTUGUESE NEUTRAL 1
PORTUGUESE 1
VIETNAMESE DEFAULT 1
CHINESE SIMPLIFIED 1
FRENCH NEUTRAL 1
CZECH DEFAULT 1
SPANISH NEUTRAL 1
NEUTRAL 1
FINNISH DEFAULT 1
KOREAN 1
NEUTRAL DEFAULT 1
HUNGARIAN DEFAULT 1
ITALIAN NEUTRAL 1
SWEDISH NEUTRAL 1
BULGARIAN DEFAULT 1
POLISH DEFAULT 1
JAPANESE DEFAULT 1
DANISH DEFAULT 1
ARABIC NEUTRAL 1
SLOVAK DEFAULT 1
GREEK DEFAULT 1
TURKISH DEFAULT 1
CHINESE TRADITIONAL 1
THAI DEFAULT 1
SERBIAN DEFAULT 1
DUTCH NEUTRAL 1
SLOVENIAN DEFAULT 1
ROMANIAN 1
RUSSIAN 1
NORWEGIAN NEUTRAL 1
GERMAN NEUTRAL 1
PE resources
Debug information
ExifTool file metadata
UninitializedDataSize
0
InitializedDataSize
187904
ImageVersion
0.0
ProductName
RTNicProp
FileVersionNumber
1.2.0.6
LanguageCode
Neutral
FileFlagsMask
0x0017
FileDescription
About Page
CharacterSet
Unicode
LinkerVersion
12.0
FileTypeExtension
exe
OriginalFileName
RTNicProp.dll
MIMEType
application/octet-stream
Subsystem
Windows GUI
FileVersion
1, 2, 0, 6
TimeStamp
2018:06:11 05:40:27+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
RTNicProp
ProductVersion
1, 2, 0, 6
SubsystemVersion
4.0
OSVersion
5.0
FileOS
Win32
LegalCopyright
Copyright (C) 2013 Realtek Semiconductor Corporation. All Right Reserved.
MachineType
Intel 386 or later, and compatibles
CompanyName
Realtek Semiconductor Corporation
CodeSize
0
FileSubtype
0
ProductVersionNumber
1.2.0.6
EntryPoint
0x100f
ObjectFileType
Dynamic link library
Compressed bundles
File identification
MD5 5bf8a5d87b252678f33d447fe56160e9
SHA1 4cc70f79789f7e8b42451ad9ae108eafa91e4e76
SHA256 4d9642c8a02f9c2027e281bab8a42b6d033cdf4a677c5ece600084821e70b1c0
ssdeep
1536:jOPc3ydGnqQd/IChLIoJPM500knUxPdxCoopk2k6CCndyiKT:jOPcCSqQdHzPM505nkykGCCnW
File size
274.0 KB ( 280576 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
OS/2 Executable (generic) (33.6%) Generic Win/DOS Executable (33.1%) DOS Executable Generic (33.1%) |
Tags
peexe
VirusTotal metadata
First submission
2018-07-03 10:05:37 UTC ( 7 months, 2 weeks ago )
Last submission
2018-07-03 10:05:37 UTC ( 7 months, 2 weeks ago )
| File names |
RTNicProp RTNicProp.dll H1JBFJI.EXE |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!