Antivirus scan for 5026554e2caac297a4f379c0098d1f43660a1e7956a1ab5bfbe68e29ccfd88d4 at 2018-11-19 17:04:20 UTC

Antivirus	Result	Update
Ad-Aware	Trojan.Agent.DIYX	20181119
AhnLab-V3	Trojan/Win32.Skeeyah.R244952	20181119
ALYac	Trojan.Agent.DIYX	20181119
Arcabit	Trojan.Agent.DIYX	20181119
Avast	Win32:MalwareX-gen [Trj]	20181119
AVG	Win32:MalwareX-gen [Trj]	20181119
Avira (no cloud)	TR/Kryptik.ieokv	20181119
BitDefender	Trojan.Agent.DIYX	20181119
CrowdStrike Falcon (ML)	malicious_confidence_70% (D)	20181022
Cylance	Unsafe	20181119
DrWeb	Trojan.Gozi.363	20181119
eGambit	PE.Heur.InvalidSig	20181119
Emsisoft	Trojan.Agent.DIYX (B)	20181119
Endgame	malicious (moderate confidence)	20181108
ESET-NOD32	a variant of Win32/GenKryptik.CQXB	20181119
Fortinet	W32/GenKryptik.CQXB!tr	20181119
GData	Trojan.Agent.DIYX	20181119
K7AntiVirus	Trojan ( 005413c41 )	20181119
K7GW	Trojan ( 005413c41 )	20181119
MAX	malware (ai score=80)	20181119
eScan	Trojan.Agent.DIYX	20181119
NANO-Antivirus	Trojan.Win32.Ursnif.fkesyg	20181119
Qihoo-360	HEUR/QVM20.1.5060.Malware.Gen	20181119
Rising	Backdoor.Vawtrak!8.11D (TFE:1:6J5Jh0AutOK)	20181119
Sophos AV	Mal/EncPk-ANX	20181119
VBA32	BScope.TrojanSpy.Ursnif	20181119
AegisLab		20181119
Alibaba		20180921
Antiy-AVL		20181119
Avast-Mobile		20181119
Babable		20180918
Baidu		20181119
Bkav		20181119
CAT-QuickHeal		20181119
ClamAV		20181119
CMC		20181119
Cybereason		20180225
Cyren		20181119
F-Prot		20181119
F-Secure		20181119
Ikarus		20181119
Sophos ML		20181108
Jiangmin		20181119
Kaspersky		20181119
Kingsoft		20181119
Malwarebytes		20181119
McAfee		20181119
McAfee-GW-Edition		20181119
Microsoft		20181119
Palo Alto Networks (Known Signatures)		20181119
Panda		20181119
SentinelOne (Static ML)		20181011
SUPERAntiSpyware		20181114
Symantec		20181118
Symantec Mobile Insight		20181108
TACHYON		20181119
Tencent		20181119
TheHacker		20181118
TotalDefense		20181118
TrendMicro		20181119
TrendMicro-HouseCall		20181119
Trustlook		20181119
VIPRE		20181119
ViRobot		20181119
Webroot		20181119
Yandex		20181119
Zillya		20181116
ZoneAlarm by Check Point		20181119
Zoner		20181119

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Product Apache HTTP Server

Original name httpd.exe

Internal name httpd.exe

File version 2.4.25

Description Apache HTTP Server

Comments Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Signature verification The digital signature of the object did not verify.

Signing date 11:44 PM 2/6/2019

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2009-08-15 12:38:03

Entry Point 0x00002430

Number of sections 6

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 19208 20480 5.84 bf58076e640272b8359ed1c0aef5b700

.data 24576 11396 8192 2.29 4713ff2b82edb18abb69464fa61c20e0

.rdata 36864 676 4096 1.01 783cadd1bc414f274a9f0128b656536e

.CRT 40960 262380 266240 5.98 1e8f34091dc9bcb31b3d05709495046a

.rsrc 307200 3312 4096 2.93 4153858217dfa370c3e157a0c191b00a

.reloc 311296 2152 4096 4.02 23516c0e90ed2ed24f84b759d25268a0

Overlays

MD5 9daee6e60c3c105e932de69d4d0ae1c4

File type data

Offset 311296

Size 7552

Entropy 7.24

PE imports

Number of PE resources by type

RT_ICON 2

RT_VERSION 1

RT_GROUP_ICON 1

Number of PE resources by language

ENGLISH US 4

PE resources

066385603099a55f045ac91e8d4af66bc2a7a4340aa2ea7f603a886e89ddb80d data

a40971c36cbe9f0ebca8d79e270670311c8c366a410d195798233283f57a8f3c data

b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b data

fa581857b36d666263aa7c83fcceafed7d4d771117197293cb852ca4f388e74e data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Sat Aug 15 12:38:03 2009 4592 46 Bytes

12 (12) Sat Aug 15 12:38:03 2009 4716 20 Bytes

ExifTool file metadata

UninitializedDataSize

4294905856

LinkerVersion

8.0

ImageVersion

0.0

FileSubtype

FileVersionNumber

2.4.25.0

LanguageCode

English (U.S.)

FileFlagsMask

0x003f

FileDescription

Apache HTTP Server

ImageFileCharacteristics

Executable, 32-bit

CharacterSet

Unicode

InitializedDataSize

290816

EntryPoint

0x2430

OriginalFileName

httpd.exe

MIMEType

application/octet-stream

LegalCopyright

FileVersion

2.4.25

TimeStamp

2009:08:15 14:38:03+02:00

FileType

Win32 EXE

PEType

PE32

InternalName

httpd.exe

ProductVersion

2.4.25

SubsystemVersion

5.0

OSVersion

5.0

FileOS

Win32

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Apache Software Foundation

CodeSize

20480

ProductName

Apache HTTP Server

ProductVersionNumber

2.4.25.0

DistributedBy

The Apache Haus

FileTypeExtension

exe

ObjectFileType

Executable application

File identification

MD5 eba8b5b8b9d9783900cf89e28e58e065

SHA1 cc0ba40e5b289a790d5a28d770ad4a57e1cca5ef

SHA256 5026554e2caac297a4f379c0098d1f43660a1e7956a1ab5bfbe68e29ccfd88d4

ssdeep

1536:zlhc9MLyRR5AB4yxIAGWVV9+PmW49KBEPgjC+EhqIHkC5oi7E:zlh2MGRQB4qIWokRHkCG

authentihash 4cd4554dd68159970eaf8a738dcbbab4c44e85a1fe819428751c536ee83999dd

imphash 99c3bb22296edaa6606a5feb0290d47b

File size 311.4 KB ( 318848 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	OS/2 Executable (generic) (33.6%) Generic Win/DOS Executable (33.1%) DOS Executable Generic (33.1%)

VirusTotal metadata

First submission 2018-11-19 17:04:20 UTC ( 3 months ago )

Last submission 2018-11-19 17:04:20 UTC ( 3 months ago )

File names

.
httpd.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

SHA256:	5026554e2caac297a4f379c0098d1f43660a1e7956a1ab5bfbe68e29ccfd88d4
File name:	.
Detection ratio:	26 / 68
Analysis date:	2018-11-19 17:04:20 UTC ( 3 months ago ) View latest

Ciphered bundle