× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
File name: filename
Detection ratio: 0 / 54
Analysis date: 2015-12-25 22:20:58 UTC ( 5 months ago )
Antivirus Result Update
AVG 20151225
AVware 20151225
Ad-Aware 20151224
AegisLab 20151225
Yandex 20151225
AhnLab-V3 20151225
Alibaba 20151208
Antiy-AVL 20151225
Arcabit 20151225
Avast 20151225
Avira (no cloud) 20151225
Baidu-International 20151225
BitDefender 20151225
Bkav 20151225
ByteHero 20151225
CAT-QuickHeal 20151224
CMC 20151217
ClamAV 20151225
Comodo 20151225
Cyren 20151225
DrWeb 20151225
ESET-NOD32 20151225
Emsisoft 20151225
F-Prot 20151225
F-Secure 20151225
Fortinet 20151225
GData 20151225
Ikarus 20151225
Jiangmin 20151225
K7AntiVirus 20151225
K7GW 20151225
Kaspersky 20151225
Malwarebytes 20151225
McAfee 20151225
McAfee-GW-Edition 20151225
eScan 20151225
Microsoft 20151225
NANO-Antivirus 20151225
Panda 20151225
Rising 20151225
SUPERAntiSpyware 20151225
Sophos 20151225
Symantec 20151225
Tencent 20151225
TheHacker 20151223
TotalDefense 20151225
TrendMicro 20151225
TrendMicro-HouseCall 20151225
VBA32 20151225
VIPRE 20151225
ViRobot 20151225
Zillya 20151225
Zoner 20151225
nProtect 20151224
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (C) QuickPad

Product QuickPad
Original name setup.exe
Internal name setup
File version 3.0.0.0
Description QuickPad, better than Notepad!
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2012-12-20 15:32:04
Entry Point 0x000AFFC9
Number of sections 5
PE sections
Overlays
MD5 a142f0a7c0c9cff0a130543c37720e3e
File type application/x-ms-dos-executable
Offset 1568768
Size 5568751
Entropy 8.00
PE imports
RegDeleteKeyA
RegCreateKeyExW
RegCloseKey
RegQueryValueExA
OpenServiceW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
RegCreateKeyA
UnlockServiceDatabase
RegQueryValueExW
CloseServiceHandle
RegOpenKeyA
OpenProcessToken
QueryServiceStatus
RegOpenKeyExW
RegOpenKeyW
RegOpenKeyExA
RegEnumValueA
GetUserNameW
RegQueryInfoKeyW
RegEnumKeyExW
LockServiceDatabase
RegDeleteValueW
StartServiceW
RegSetValueExW
OpenSCManagerW
RegSetValueExA
RegDeleteValueA
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_Destroy
_TrackMouseEvent
ImageList_SetBkColor
ImageList_LoadImageW
ImageList_AddMasked
CreatePropertySheetPageW
ImageList_Create
PropertySheetW
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Add
GetSaveFileNameW
GetOpenFileNameW
CreatePolygonRgn
CreateFontIndirectW
CreatePen
GetRgnBox
CreateRectRgnIndirect
CombineRgn
GetBitmapBits
Rectangle
GetLayout
GetBrushOrgEx
ExcludeClipRect
CreateCompatibleDC
DeleteDC
SetBkMode
GetObjectW
BitBlt
CreateDIBSection
CreateBitmapIndirect
SetTextColor
CreatePatternBrush
GetDeviceCaps
FillRgn
ExtTextOutW
EqualRgn
GetStockObject
SelectClipRgn
SetViewportOrgEx
CreateFontW
SetBrushOrgEx
CreateRectRgn
SelectObject
CreateSolidBrush
SetBkColor
DeleteObject
CreateCompatibleBitmap
GetStdHandle
GetDriveTypeW
GetConsoleOutputCP
SetEvent
HeapDestroy
GetFileAttributesW
DuplicateHandle
GetLocalTime
DeleteCriticalSection
GetCurrentProcess
GetConsoleMode
GetLocaleInfoA
LocalAlloc
LoadLibraryExW
FreeEnvironmentStringsW
GetLocaleInfoW
SetStdHandle
GetTempPathA
GetCPInfo
GetProcAddress
GetStringTypeA
InterlockedExchange
WriteFile
WaitForSingleObject
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetOEMCP
LocalFree
FormatMessageW
ConnectNamedPipe
GetExitCodeProcess
InitializeCriticalSection
OutputDebugStringW
GetLogicalDriveStringsW
FindClose
TlsGetValue
MoveFileW
SetFileAttributesW
GetEnvironmentVariableW
SetLastError
PeekNamedPipe
CopyFileW
GetUserDefaultLangID
LoadResource
GetModuleFileNameW
IsDebuggerPresent
HeapAlloc
GetModuleFileNameA
LoadLibraryA
EnumSystemLocalesA
EnumResourceLanguagesW
UnhandledExceptionFilter
InterlockedDecrement
MultiByteToWideChar
FlushInstructionCache
SetFilePointer
GetFullPathNameW
CreateThread
GetSystemDirectoryW
GetExitCodeThread
SetUnhandledExceptionFilter
CreateMutexW
MulDiv
IsProcessorFeaturePresent
GlobalMemoryStatus
SearchPathW
WriteConsoleA
SetCurrentDirectoryW
GlobalAlloc
GetDiskFreeSpaceExW
SetEndOfFile
GetVersion
LeaveCriticalSection
WriteConsoleW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
GetSystemTime
SetHandleCount
TerminateThread
LoadLibraryW
GetVersionExW
FreeLibrary
QueryPerformanceCounter
GetTickCount
SetConsoleTextAttribute
TlsAlloc
FlushFileBuffers
lstrcmpiW
RtlUnwind
GetStartupInfoA
UnlockFile
GetWindowsDirectoryW
GetFileSize
OpenProcess
DeleteFileA
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GlobalLock
GetConsoleScreenBufferInfo
GetSystemInfo
GetProcessHeap
GetTempFileNameW
CompareStringW
RemoveDirectoryW
FindNextFileW
ResetEvent
GetTempFileNameA
FindFirstFileW
IsValidLocale
lstrcmpW
WaitForMultipleObjects
GetUserDefaultLCID
GetTempPathW
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
ExitProcess
InterlockedIncrement
GetLastError
LCMapStringW
GetShortPathNameW
CreateNamedPipeW
GlobalFree
GetConsoleCP
FindResourceW
LCMapStringA
GetEnvironmentStringsW
GlobalUnlock
LockFile
lstrlenW
CreateProcessW
SizeofResource
GetCurrentProcessId
LockResource
GetCommandLineW
WideCharToMultiByte
HeapSize
InterlockedCompareExchange
GetCurrentThread
lstrcpynW
GetSystemDefaultLangID
RaiseException
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
GetACP
GetModuleHandleW
GetCurrentThreadId
FindResourceExW
CreateProcessA
IsValidCodePage
HeapCreate
OpenEventW
VirtualFree
Sleep
TerminateProcess
VirtualAlloc
TransparentBlt
AlphaBlend
NetUserGetLocalGroups
VarUI4FromStr
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VariantClear
SysStringByteLen
LoadRegTypeLib
SysAllocString
VariantCopy
VariantInit
VarDateFromStr
LoadTypeLib
SysFreeString
SysAllocStringByteLen
OleLoadPicture
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW
SHGetMalloc
PathAddBackslashW
PathIsUNCW
PathIsDirectoryW
PathFileExistsW
SetFocus
GetMessagePos
SetWindowRgn
RedrawWindow
LoadBitmapW
SetRectEmpty
DestroyMenu
PostQuitMessage
GetForegroundWindow
DrawStateW
SetWindowPos
GetNextDlgTabItem
IsWindow
EndPaint
IntersectRect
DispatchMessageW
GetAsyncKeyState
ReleaseDC
GetDlgCtrlID
SendMessageW
UnregisterClassA
SendMessageA
GetClientRect
DrawTextW
SetScrollPos
LoadImageW
ClientToScreen
GetActiveWindow
GetWindowTextW
GetWindowTextLengthW
MsgWaitForMultipleObjects
InvalidateRgn
DestroyWindow
GetParent
UpdateWindow
GetPropW
EqualRect
GetMessageW
ShowWindow
DrawFrameControl
SetPropW
GetDesktopWindow
PeekMessageW
EnableWindow
GetSystemMenu
TranslateMessage
IsWindowEnabled
GetWindow
GetIconInfo
SetClipboardData
IsZoomed
LoadStringW
EnableMenuItem
DrawFocusRect
SetTimer
IsDialogMessageW
FillRect
CreateAcceleratorTableW
GetSysColorBrush
CreateWindowExW
GetWindowLongW
CharNextW
IsChild
MapWindowPoints
RegisterWindowMessageW
GetMonitorInfoW
EmptyClipboard
BeginPaint
OffsetRect
DefWindowProcW
GetScrollPos
KillTimer
TrackMouseEvent
GetComboBoxInfo
GetClassInfoExW
GetSystemMetrics
SetWindowLongW
GetWindowRect
InflateRect
SetCapture
ReleaseCapture
GetScrollRange
PostMessageW
EndDialog
CreateDialogParamW
CreatePopupMenu
GetSubMenu
PtInRect
DrawIconEx
SetWindowTextW
GetDlgItem
RemovePropW
FindWindowW
ScreenToClient
TrackPopupMenu
DialogBoxIndirectParamW
DestroyAcceleratorTable
ValidateRect
LoadCursorW
LoadIconW
GetDC
SetForegroundWindow
ExitWindowsEx
OpenClipboard
GetCursorPos
DrawTextExW
GetScrollInfo
CopyRect
GetCapture
MessageBeep
LoadMenuW
MessageBoxW
RegisterClassExW
MoveWindow
DialogBoxParamW
AppendMenuW
GetWindowDC
DestroyCursor
SendMessageTimeoutW
GetSysColor
SetScrollInfo
GetKeyState
GetWindowRgn
DestroyIcon
IsWindowVisible
SetCursorPos
SystemParametersInfoW
UnionRect
MonitorFromWindow
SetRect
InvalidateRect
CallWindowProcW
GetClassNameW
ModifyMenuW
IsRectEmpty
GetFocus
CloseClipboard
SetCursor
TranslateAcceleratorW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SymGetLineFromAddr
StackWalk
SymSetOptions
SymCleanup
SymInitialize
SymFunctionTableAccess
SymGetModuleBase
SymSetSearchPath
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CoInitialize
OleInitialize
StgCreateDocfileOnILockBytes
CoInitializeEx
CoGetClassObject
CoTaskMemRealloc
CoCreateInstance
OleUninitialize
CoUninitialize
CoTaskMemFree
CLSIDFromString
StringFromGUID2
CreateILockBytesOnHGlobal
CoTaskMemAlloc
Number of PE resources by type
RT_DIALOG 13
RT_STRING 12
RT_ICON 12
RT_BITMAP 6
RTF_FILE 2
RT_MENU 2
IMAGE_FILE 2
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 52
Debug information
ExifTool file metadata
SubsystemVersion
5.0

LinkerVersion
9.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
3.0.0.0

UninitializedDataSize
0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

CharacterSet
Unicode

InitializedDataSize
635904

EntryPoint
0xaffc9

OriginalFileName
setup.exe

MIMEType
application/octet-stream

LegalCopyright
Copyright (C) QuickPad

FileVersion
3.0.0.0

TimeStamp
2012:12:20 16:32:04+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
setup

ProductVersion
3.0.0.0

FileDescription
QuickPad, better than Notepad!

OSVersion
5.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Klumbu

CodeSize
931840

ProductName
QuickPad

ProductVersionNumber
3.0.0.0

FileTypeExtension
exe

ObjectFileType
Dynamic link library

File identification
MD5 f26f67918444399632c3b6169662b4eb
SHA1 6d9990115196db1c342db779e79773c27b06c89a
SHA256 5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
ssdeep
196608:cyNX50r5Pqu4da6OUFuLpeOn5I7n9SiAYxCZocq:x5IclT2eC5I7n9Si5Cy

authentihash 26946d21f2d0d9c813204c5e83a0edfe4f50044309081a22fbc3ccf86df068fe
imphash 7f1244f86d79dd24218fbb9c549e2ed5
File size 6.8 MB ( 7137519 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (67.4%)
Win32 Dynamic Link Library (generic) (14.2%)
Win32 Executable (generic) (9.7%)
Generic Win/DOS Executable (4.3%)
DOS Executable Generic (4.3%)
Tags
peexe overlay

VirusTotal metadata
First submission 2012-12-26 21:25:13 UTC ( 3 years, 5 months ago )
Last submission 2015-12-25 22:20:58 UTC ( 5 months ago )
File names setup
filename
QuickPad.exe
setup.exe
5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
Quickpad.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Set keys
Deleted keys
Created mutexes
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.
UDP communications