× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
File name: Quickpad.exe
Detection ratio: 0 / 47
Analysis date: 2013-05-31 10:31:00 UTC ( 10 months, 3 weeks ago )
Antivirus Result Update
AVG 20130531
Agnitum 20130530
AhnLab-V3 20130530
AntiVir 20130531
Antiy-AVL 20130530
Avast 20130531
BitDefender 20130531
ByteHero 20130529
CAT-QuickHeal 20130531
ClamAV 20130531
Commtouch 20130531
Comodo 20130531
DrWeb 20130531
ESET-NOD32 20130531
Emsisoft 20130531
F-Prot 20130531
F-Secure 20130531
Fortinet 20130531
GData 20130531
Ikarus 20130531
Jiangmin 20130531
K7AntiVirus 20130530
K7GW 20130530
Kaspersky 20130531
Kingsoft 20130506
Malwarebytes 20130531
McAfee 20130531
McAfee-GW-Edition 20130531
MicroWorld-eScan 20130531
Microsoft 20130531
NANO-Antivirus 20130531
Norman 20130531
PCTools 20130521
Panda 20130531
Rising 20130531
SUPERAntiSpyware 20130531
Sophos 20130531
Symantec 20130531
TheHacker 20130531
TotalDefense 20130530
TrendMicro 20130531
TrendMicro-HouseCall 20130531
VBA32 20130530
VIPRE 20130531
ViRobot 20130531
eSafe 20130530
nProtect 20130531
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block
Copyright
Copyright (C) QuickPad

Publisher Klumbu
Product QuickPad
Version 3.0.0.0
Original name setup.exe
Internal name setup
File version 3.0.0.0
Description QuickPad, better than Notepad!
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2012-12-20 15:32:04
Link date 4:32 PM 12/20/2012
Entry Point 0x000AFFC9
Number of sections 5
PE sections
PE imports
RegDeleteKeyA
RegCreateKeyExW
RegCloseKey
RegQueryValueExA
OpenServiceW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
RegCreateKeyA
UnlockServiceDatabase
RegQueryValueExW
CloseServiceHandle
RegOpenKeyA
OpenProcessToken
QueryServiceStatus
RegOpenKeyExW
RegOpenKeyW
RegOpenKeyExA
RegEnumValueA
GetUserNameW
RegQueryInfoKeyW
RegEnumKeyExW
LockServiceDatabase
RegDeleteValueW
StartServiceW
RegSetValueExW
OpenSCManagerW
RegSetValueExA
RegDeleteValueA
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_Destroy
_TrackMouseEvent
ImageList_SetBkColor
ImageList_LoadImageW
ImageList_AddMasked
CreatePropertySheetPageW
ImageList_Create
PropertySheetW
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Add
GetSaveFileNameW
GetOpenFileNameW
CreatePolygonRgn
CreateFontIndirectW
CreatePen
GetRgnBox
CreateRectRgnIndirect
CombineRgn
GetBitmapBits
Rectangle
GetLayout
GetBrushOrgEx
ExcludeClipRect
CreateCompatibleDC
DeleteDC
SetBkMode
GetObjectW
BitBlt
CreateDIBSection
CreateBitmapIndirect
SetTextColor
CreatePatternBrush
GetDeviceCaps
FillRgn
ExtTextOutW
EqualRgn
GetStockObject
SelectClipRgn
SetViewportOrgEx
CreateFontW
SetBrushOrgEx
CreateRectRgn
SelectObject
CreateSolidBrush
SetBkColor
DeleteObject
CreateCompatibleBitmap
GetStdHandle
GetDriveTypeW
GetConsoleOutputCP
SetEvent
HeapDestroy
GetFileAttributesW
DuplicateHandle
GetLocalTime
DeleteCriticalSection
GetCurrentProcess
GetConsoleMode
GetLocaleInfoA
LocalAlloc
LoadLibraryExW
FreeEnvironmentStringsW
GetLocaleInfoW
SetStdHandle
GetTempPathA
GetCPInfo
GetProcAddress
GetStringTypeA
InterlockedExchange
WriteFile
WaitForSingleObject
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetOEMCP
LocalFree
FormatMessageW
ConnectNamedPipe
GetExitCodeProcess
InitializeCriticalSection
OutputDebugStringW
GetLogicalDriveStringsW
FindClose
TlsGetValue
MoveFileW
SetFileAttributesW
GetEnvironmentVariableW
SetLastError
PeekNamedPipe
CopyFileW
GetUserDefaultLangID
LoadResource
GetModuleFileNameW
IsDebuggerPresent
HeapAlloc
GetModuleFileNameA
LoadLibraryA
EnumSystemLocalesA
EnumResourceLanguagesW
UnhandledExceptionFilter
InterlockedDecrement
MultiByteToWideChar
FlushInstructionCache
SetFilePointer
GetFullPathNameW
CreateThread
GetSystemDirectoryW
GetExitCodeThread
SetUnhandledExceptionFilter
CreateMutexW
MulDiv
IsProcessorFeaturePresent
GlobalMemoryStatus
SearchPathW
WriteConsoleA
SetCurrentDirectoryW
GlobalAlloc
GetDiskFreeSpaceExW
SetEndOfFile
GetVersion
LeaveCriticalSection
WriteConsoleW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
GetSystemTime
SetHandleCount
TerminateThread
LoadLibraryW
GetVersionExW
FreeLibrary
QueryPerformanceCounter
GetTickCount
SetConsoleTextAttribute
TlsAlloc
FlushFileBuffers
lstrcmpiW
RtlUnwind
GetStartupInfoA
UnlockFile
GetWindowsDirectoryW
GetFileSize
OpenProcess
DeleteFileA
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GlobalLock
GetConsoleScreenBufferInfo
GetSystemInfo
GetProcessHeap
GetTempFileNameW
CompareStringW
RemoveDirectoryW
FindNextFileW
ResetEvent
GetTempFileNameA
FindFirstFileW
IsValidLocale
lstrcmpW
WaitForMultipleObjects
GetUserDefaultLCID
GetTempPathW
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
ExitProcess
InterlockedIncrement
GetLastError
LCMapStringW
GetShortPathNameW
CreateNamedPipeW
GlobalFree
GetConsoleCP
FindResourceW
LCMapStringA
GetEnvironmentStringsW
GlobalUnlock
LockFile
lstrlenW
CreateProcessW
SizeofResource
GetCurrentProcessId
LockResource
GetCommandLineW
WideCharToMultiByte
HeapSize
InterlockedCompareExchange
GetCurrentThread
lstrcpynW
GetSystemDefaultLangID
RaiseException
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
GetACP
GetModuleHandleW
GetCurrentThreadId
FindResourceExW
CreateProcessA
IsValidCodePage
HeapCreate
OpenEventW
VirtualFree
Sleep
TerminateProcess
VirtualAlloc
TransparentBlt
AlphaBlend
NetUserGetLocalGroups
Ord(161)
Ord(94)
Ord(10)
Ord(149)
Ord(8)
Ord(277)
Ord(6)
Ord(150)
Ord(7)
Ord(4)
Ord(162)
Ord(9)
Ord(420)
Ord(2)
Ord(418)
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW
SHGetMalloc
PathAddBackslashW
PathIsUNCW
PathIsDirectoryW
PathFileExistsW
SetFocus
GetMessagePos
SetWindowRgn
RedrawWindow
LoadBitmapW
SetRectEmpty
DestroyMenu
PostQuitMessage
GetForegroundWindow
DrawStateW
SetWindowPos
GetNextDlgTabItem
IsWindow
EndPaint
IntersectRect
DispatchMessageW
GetAsyncKeyState
ReleaseDC
GetDlgCtrlID
SendMessageW
UnregisterClassA
SendMessageA
GetClientRect
DrawTextW
SetScrollPos
LoadImageW
ClientToScreen
GetActiveWindow
GetWindowTextW
GetWindowTextLengthW
MsgWaitForMultipleObjects
InvalidateRgn
DestroyWindow
GetParent
UpdateWindow
GetPropW
EqualRect
GetMessageW
ShowWindow
DrawFrameControl
SetPropW
GetDesktopWindow
PeekMessageW
EnableWindow
GetSystemMenu
TranslateMessage
IsWindowEnabled
GetWindow
GetIconInfo
SetClipboardData
IsZoomed
LoadStringW
EnableMenuItem
DrawFocusRect
SetTimer
IsDialogMessageW
FillRect
CreateAcceleratorTableW
GetSysColorBrush
CreateWindowExW
GetWindowLongW
CharNextW
IsChild
MapWindowPoints
RegisterWindowMessageW
GetMonitorInfoW
EmptyClipboard
BeginPaint
OffsetRect
DefWindowProcW
GetScrollPos
KillTimer
TrackMouseEvent
GetComboBoxInfo
GetClassInfoExW
GetSystemMetrics
SetWindowLongW
GetWindowRect
InflateRect
SetCapture
ReleaseCapture
GetScrollRange
PostMessageW
EndDialog
CreateDialogParamW
CreatePopupMenu
GetSubMenu
PtInRect
DrawIconEx
SetWindowTextW
GetDlgItem
RemovePropW
FindWindowW
ScreenToClient
TrackPopupMenu
DialogBoxIndirectParamW
DestroyAcceleratorTable
ValidateRect
LoadCursorW
LoadIconW
GetDC
SetForegroundWindow
ExitWindowsEx
OpenClipboard
GetCursorPos
DrawTextExW
GetScrollInfo
CopyRect
GetCapture
MessageBeep
LoadMenuW
MessageBoxW
RegisterClassExW
MoveWindow
DialogBoxParamW
AppendMenuW
GetWindowDC
DestroyCursor
SendMessageTimeoutW
GetSysColor
SetScrollInfo
GetKeyState
GetWindowRgn
DestroyIcon
IsWindowVisible
SetCursorPos
SystemParametersInfoW
UnionRect
MonitorFromWindow
SetRect
InvalidateRect
CallWindowProcW
GetClassNameW
ModifyMenuW
IsRectEmpty
GetFocus
CloseClipboard
SetCursor
TranslateAcceleratorW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SymGetLineFromAddr
StackWalk
SymSetOptions
SymCleanup
SymInitialize
SymFunctionTableAccess
SymGetModuleBase
SymSetSearchPath
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CoInitialize
OleInitialize
StgCreateDocfileOnILockBytes
CoInitializeEx
CoGetClassObject
CoTaskMemRealloc
CoCreateInstance
OleUninitialize
CoUninitialize
CoTaskMemFree
CLSIDFromString
StringFromGUID2
CreateILockBytesOnHGlobal
CoTaskMemAlloc
Number of PE resources by type
RT_DIALOG 13
RT_STRING 12
RT_ICON 12
RT_BITMAP 6
RTF_FILE 2
RT_MENU 2
IMAGE_FILE 2
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 52
ExifTool file metadata
SubsystemVersion
5.0

LinkerVersion
9.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
3.0.0.0

UninitializedDataSize
0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

CharacterSet
Unicode

InitializedDataSize
635904

OriginalFileName
setup.exe

MIMEType
application/octet-stream

LegalCopyright
Copyright (C) QuickPad

FileVersion
3.0.0.0

TimeStamp
2012:12:20 16:32:04+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
setup

FileAccessDate
2013:05:31 11:31:24+01:00

ProductVersion
3.0.0.0

FileDescription
QuickPad, better than Notepad!

OSVersion
5.0

FileCreateDate
2013:05:31 11:31:24+01:00

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Klumbu

CodeSize
931840

ProductName
QuickPad

ProductVersionNumber
3.0.0.0

EntryPoint
0xaffc9

ObjectFileType
Dynamic link library

File identification
MD5 f26f67918444399632c3b6169662b4eb
SHA1 6d9990115196db1c342db779e79773c27b06c89a
SHA256 5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
ssdeep
196608:cyNX50r5Pqu4da6OUFuLpeOn5I7n9SiAYxCZocq:x5IclT2eC5I7n9Si5Cy

File size 6.8 MB ( 7137519 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (74.7%)
Win32 Executable (generic) (15.6%)
Generic Win/DOS Executable (4.7%)
DOS Executable Generic (4.7%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
Tags
peexe

VirusTotal metadata
First submission 2012-12-26 21:25:13 UTC ( 1 year, 3 months ago )
Last submission 2013-05-31 10:31:00 UTC ( 10 months, 3 weeks ago )
File names setup.exe
setup
5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
Quickpad.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Set keys
Deleted keys
Created mutexes
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.
UDP communications