× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 52b527cdf3b7ac78256916466eef22327add6e142d7fd2347456eae708ae9e64
File name: 4ce937a95341106a5396c09465ef5035d5eedddd
Detection ratio: 30 / 56
Analysis date: 2016-08-13 22:04:15 UTC ( 2 years, 8 months ago ) View latest
Antivirus Result Update
Ad-Aware Trojan.GenericKD.3462782 20160813
AegisLab Troj.W32.Gen.m35D 20160813
AhnLab-V3 Trojan/Win32.Yakes.N2079147797 20160813
Arcabit Trojan.Generic.D34D67E 20160813
Avast Win32:Malware-gen 20160813
AVG Luhe.Fiha.A 20160813
Avira (no cloud) TR/Dropper.aupp 20160813
AVware Trojan.Win32.Generic.pak!cobra 20160813
BitDefender Trojan.GenericKD.3462782 20160813
Cyren W32/PWS.QSLT-0728 20160813
DrWeb Trojan.Inject2.26880 20160813
Emsisoft Trojan.GenericKD.3462782 (B) 20160813
ESET-NOD32 Win32/PSW.Papras.EH 20160813
F-Secure Trojan.GenericKD.3462782 20160813
Fortinet W32/Papras.EH!tr.pws 20160813
GData Trojan.GenericKD.3462782 20160813
K7AntiVirus Password-Stealer ( 004c893a1 ) 20160813
K7GW Password-Stealer ( 004c893a1 ) 20160813
Kaspersky Trojan.Win32.Yakes.qmkz 20160813
McAfee Artemis!44749F7FB064 20160813
McAfee-GW-Edition BehavesLike.Win32.Dropper.cc 20160813
Microsoft TrojanSpy:Win32/Skeeyah.A!rfn 20160813
eScan Trojan.GenericKD.3462782 20160813
Qihoo-360 Win32/Virus.Downloader.9a9 20160813
Rising Stealer.Papras!8.132-kii46t8VhDJ (Cloud) 20160813
Symantec Heur.AdvML.C 20160813
TrendMicro TROJ_FAGUDOC.A 20160813
TrendMicro-HouseCall TROJ_FAGUDOC.A 20160813
VIPRE Trojan.Win32.Generic.pak!cobra 20160813
ViRobot Dropper.S.Agent.863822[h] 20160813
Alibaba 20160812
ALYac 20160813
Antiy-AVL 20160813
Baidu 20160813
Bkav 20160813
CAT-QuickHeal 20160813
ClamAV 20160813
CMC 20160811
Comodo 20160813
F-Prot 20160813
Ikarus 20160813
Jiangmin 20160813
Kingsoft 20160813
Malwarebytes 20160813
NANO-Antivirus 20160813
nProtect 20160812
Panda 20160813
Sophos AV 20160813
SUPERAntiSpyware 20160813
Tencent 20160813
TheHacker 20160812
TotalDefense 20160813
VBA32 20160812
Yandex 20160813
Zillya 20160813
Zoner 20160813
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Packers identified
F-PROT RAR
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2014-05-07 14:34:29
Entry Point 0x0001D41B
Number of sections 4
PE sections
Overlays
MD5 4593b4640fe2aa350cff99241b5dfef0
File type application/x-rar
Offset 272896
Size 590926
Entropy 8.00
PE imports
RegCreateKeyExW
RegCloseKey
OpenProcessToken
RegSetValueExW
RegOpenKeyExW
SetFileSecurityW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
InitCommonControlsEx
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
GetDeviceCaps
CreateDIBSection
DeleteObject
GetObjectW
GetStdHandle
GetConsoleOutputCP
FileTimeToSystemTime
WaitForSingleObject
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
FreeEnvironmentStringsA
DeleteCriticalSection
GetCurrentProcess
OpenFileMappingW
GetConsoleMode
GetLocaleInfoA
FreeEnvironmentStringsW
GetLocaleInfoW
SetStdHandle
GetCPInfo
GetStringTypeA
GetTempPathW
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetOEMCP
GetExitCodeProcess
InitializeCriticalSection
FindClose
InterlockedDecrement
MoveFileW
SetFileAttributesW
SetLastError
GetSystemTime
DeviceIoControl
GetModuleFileNameW
IsDebuggerPresent
ExitProcess
GetModuleFileNameA
SetThreadPriority
UnhandledExceptionFilter
TlsGetValue
MultiByteToWideChar
SetFilePointer
GetFullPathNameW
CreateThread
SetEnvironmentVariableW
MoveFileExW
SetUnhandledExceptionFilter
TzSpecificLocalTimeToSystemTime
TerminateProcess
CreateSemaphoreW
WriteConsoleA
SetCurrentDirectoryW
GlobalAlloc
SetEndOfFile
GetCurrentThreadId
InterlockedIncrement
GetNumberFormatW
WriteConsoleW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
SetHandleCount
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetTickCount
TlsAlloc
FlushFileBuffers
LoadLibraryA
RtlUnwind
GetStartupInfoA
GetDateFormatW
SetEvent
DeleteFileW
GetProcAddress
CreateFileMappingW
GetTimeFormatW
WriteFile
RemoveDirectoryW
ExpandEnvironmentStringsW
FindNextFileW
CreateDirectoryW
ResetEvent
FindFirstFileW
GetProcessAffinityMask
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
HeapAlloc
LeaveCriticalSection
GetLastError
SystemTimeToFileTime
LCMapStringW
GetShortPathNameW
HeapCreate
GetConsoleCP
LCMapStringA
CompareStringW
GetEnvironmentStringsW
IsDBCSLeadByte
FileTimeToLocalFileTime
GetEnvironmentStrings
GetCurrentDirectoryW
GetCurrentProcessId
SetFileTime
GetCommandLineW
WideCharToMultiByte
HeapSize
GetCommandLineA
RaiseException
ReleaseSemaphore
MapViewOfFile
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
GetACP
GetModuleHandleW
GetLongPathNameW
IsValidCodePage
UnmapViewOfFile
FindResourceW
VirtualFree
Sleep
VirtualAlloc
CreateHardLinkW
VariantInit
SHBrowseForFolderW
SHChangeNotify
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW
SHGetMalloc
SHAutoComplete
MapWindowPoints
SetFocus
GetParent
UpdateWindow
EndDialog
LoadBitmapW
SetWindowTextW
DefWindowProcW
GetWindowTextW
GetMessageW
ShowWindow
SetWindowPos
wvsprintfW
GetSystemMetrics
SetWindowLongW
IsWindow
SendMessageW
GetWindowRect
RegisterClassExW
DialogBoxParamW
SendDlgItemMessageW
GetDlgItemTextW
PostMessageW
MessageBoxW
SetDlgItemTextW
GetDC
GetWindowLongW
ReleaseDC
DestroyIcon
TranslateMessage
IsWindowVisible
LoadStringW
GetClientRect
GetDlgItem
GetWindow
OemToCharBuffA
DispatchMessageW
PeekMessageW
GetSysColor
GetClassNameW
CopyRect
WaitForInputIdle
LoadCursorW
LoadIconW
FindWindowExW
CreateWindowExW
EnableWindow
SetForegroundWindow
DestroyWindow
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromString
OleInitialize
OleUninitialize
Number of PE resources by type
RT_STRING 9
RT_DIALOG 6
RT_ICON 1
RT_MANIFEST 1
RT_BITMAP 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 17
NEUTRAL DEFAULT 2
PE resources
Debug information
ExifTool file metadata
MIMEType
application/octet-stream

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

TimeStamp
2014:05:07 15:34:29+01:00

FileType
Win32 EXE

PEType
PE32

CodeSize
165376

LinkerVersion
9.0

FileTypeExtension
exe

InitializedDataSize
106496

SubsystemVersion
5.0

EntryPoint
0x1d41b

OSVersion
5.0

ImageVersion
0.0

UninitializedDataSize
0

File identification
MD5 44749f7fb064b534275a7b876025c01f
SHA1 18bd41df30e9129688fae8fd6205d9d303fa353a
SHA256 52b527cdf3b7ac78256916466eef22327add6e142d7fd2347456eae708ae9e64
ssdeep
24576:HmOMSPEYeZ8KcXSW30Wf3ojWUigh5aVlrTBRrp:XPGcx30pjeVlfF

authentihash 4d702a0911c9d3f7f7e0b3bf735af7f40db89ff6fc9fcbf3af9a2c771c437e7b
imphash d32519c93924bb24d9874d86c5993ee3
File size 843.6 KB ( 863822 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (64.5%)
Win32 Dynamic Link Library (generic) (13.6%)
Win32 Executable (generic) (9.3%)
OS/2 Executable (generic) (4.1%)
Generic Win/DOS Executable (4.1%)
Tags
peexe overlay

VirusTotal metadata
First submission 2016-08-12 15:22:14 UTC ( 2 years, 8 months ago )
Last submission 2016-12-08 18:00:25 UTC ( 2 years, 4 months ago )
File names PPRTSAqz.bz2
4ce937a95341106a5396c09465ef5035d5eedddd
invoice.exe
aa
VirusShare_44749f7fb064b534275a7b876025c01f
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Runtime DLLs
UDP communications