× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
File name: setup
Detection ratio: 1 / 56
Analysis date: 2015-02-05 12:50:38 UTC ( 6 months, 4 weeks ago )
Antivirus Result Update
Symantec WS.Reputation.1 20150205
ALYac 20150205
AVG 20150205
AVware 20150205
Ad-Aware 20150205
AegisLab 20150205
Agnitum 20150205
AhnLab-V3 20150204
Alibaba 20150205
Antiy-AVL 20150205
Avast 20150205
Avira 20150205
Baidu-International 20150205
BitDefender 20150205
Bkav 20150205
ByteHero 20150205
CAT-QuickHeal 20150204
CMC 20150205
ClamAV 20150205
Comodo 20150205
Cyren 20150205
DrWeb 20150205
ESET-NOD32 20150205
Emsisoft 20150205
F-Prot 20150205
F-Secure 20150205
Fortinet 20150205
GData 20150205
Ikarus 20150205
K7AntiVirus 20150205
K7GW 20150205
Kaspersky 20150205
Kingsoft 20150205
Malwarebytes 20150205
McAfee 20150205
McAfee-GW-Edition 20150205
MicroWorld-eScan 20150205
Microsoft 20150205
NANO-Antivirus 20150205
Norman 20150205
Panda 20150205
Qihoo-360 20150205
Rising 20150204
SUPERAntiSpyware 20150205
Sophos 20150205
Tencent 20150205
TheHacker 20150205
TotalDefense 20150205
TrendMicro 20150205
TrendMicro-HouseCall 20150205
VBA32 20150205
VIPRE 20150205
ViRobot 20150205
Zillya 20150204
Zoner 20150205
nProtect 20150205
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (C) QuickPad

Publisher Klumbu
Product QuickPad
Original name setup.exe
Internal name setup
File version 3.0.0.0
Description QuickPad, better than Notepad!
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2012-12-20 15:32:04
Link date 4:32 PM 12/20/2012
Entry Point 0x000AFFC9
Number of sections 5
PE sections
PE imports
RegDeleteKeyA
RegCreateKeyExW
RegCloseKey
RegQueryValueExA
OpenServiceW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
RegCreateKeyA
UnlockServiceDatabase
RegQueryValueExW
CloseServiceHandle
RegOpenKeyA
OpenProcessToken
QueryServiceStatus
RegOpenKeyExW
RegOpenKeyW
RegOpenKeyExA
RegEnumValueA
GetUserNameW
RegQueryInfoKeyW
RegEnumKeyExW
LockServiceDatabase
RegDeleteValueW
StartServiceW
RegSetValueExW
OpenSCManagerW
RegSetValueExA
RegDeleteValueA
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_Destroy
_TrackMouseEvent
ImageList_SetBkColor
ImageList_LoadImageW
ImageList_AddMasked
CreatePropertySheetPageW
ImageList_Create
PropertySheetW
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Add
GetSaveFileNameW
GetOpenFileNameW
CreatePolygonRgn
CreateFontIndirectW
CreatePen
GetRgnBox
CreateRectRgnIndirect
CombineRgn
GetBitmapBits
Rectangle
GetLayout
GetBrushOrgEx
ExcludeClipRect
CreateCompatibleDC
DeleteDC
SetBkMode
GetObjectW
BitBlt
CreateDIBSection
CreateBitmapIndirect
SetTextColor
CreatePatternBrush
GetDeviceCaps
FillRgn
ExtTextOutW
EqualRgn
GetStockObject
SelectClipRgn
SetViewportOrgEx
CreateFontW
SetBrushOrgEx
CreateRectRgn
SelectObject
CreateSolidBrush
SetBkColor
DeleteObject
CreateCompatibleBitmap
GetStdHandle
GetDriveTypeW
GetConsoleOutputCP
SetEvent
HeapDestroy
GetFileAttributesW
DuplicateHandle
GetLocalTime
DeleteCriticalSection
GetCurrentProcess
GetConsoleMode
GetLocaleInfoA
LocalAlloc
LoadLibraryExW
FreeEnvironmentStringsW
GetLocaleInfoW
SetStdHandle
GetTempPathA
GetCPInfo
GetProcAddress
GetStringTypeA
InterlockedExchange
WriteFile
WaitForSingleObject
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetOEMCP
LocalFree
FormatMessageW
ConnectNamedPipe
GetExitCodeProcess
InitializeCriticalSection
OutputDebugStringW
GetLogicalDriveStringsW
FindClose
TlsGetValue
MoveFileW
SetFileAttributesW
GetEnvironmentVariableW
SetLastError
PeekNamedPipe
CopyFileW
GetUserDefaultLangID
LoadResource
GetModuleFileNameW
IsDebuggerPresent
HeapAlloc
GetModuleFileNameA
LoadLibraryA
EnumSystemLocalesA
EnumResourceLanguagesW
UnhandledExceptionFilter
InterlockedDecrement
MultiByteToWideChar
FlushInstructionCache
SetFilePointer
GetFullPathNameW
CreateThread
GetSystemDirectoryW
GetExitCodeThread
SetUnhandledExceptionFilter
CreateMutexW
MulDiv
IsProcessorFeaturePresent
GlobalMemoryStatus
SearchPathW
WriteConsoleA
SetCurrentDirectoryW
GlobalAlloc
GetDiskFreeSpaceExW
SetEndOfFile
GetVersion
LeaveCriticalSection
WriteConsoleW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
GetSystemTime
SetHandleCount
TerminateThread
LoadLibraryW
GetVersionExW
FreeLibrary
QueryPerformanceCounter
GetTickCount
SetConsoleTextAttribute
TlsAlloc
FlushFileBuffers
lstrcmpiW
RtlUnwind
GetStartupInfoA
UnlockFile
GetWindowsDirectoryW
GetFileSize
OpenProcess
DeleteFileA
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GlobalLock
GetConsoleScreenBufferInfo
GetSystemInfo
GetProcessHeap
GetTempFileNameW
CompareStringW
RemoveDirectoryW
FindNextFileW
ResetEvent
GetTempFileNameA
FindFirstFileW
IsValidLocale
lstrcmpW
WaitForMultipleObjects
GetUserDefaultLCID
GetTempPathW
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
ExitProcess
InterlockedIncrement
GetLastError
LCMapStringW
GetShortPathNameW
CreateNamedPipeW
GlobalFree
GetConsoleCP
FindResourceW
LCMapStringA
GetEnvironmentStringsW
GlobalUnlock
LockFile
lstrlenW
CreateProcessW
SizeofResource
GetCurrentProcessId
LockResource
GetCommandLineW
WideCharToMultiByte
HeapSize
InterlockedCompareExchange
GetCurrentThread
lstrcpynW
GetSystemDefaultLangID
RaiseException
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
GetACP
GetModuleHandleW
GetCurrentThreadId
FindResourceExW
CreateProcessA
IsValidCodePage
HeapCreate
OpenEventW
VirtualFree
Sleep
TerminateProcess
VirtualAlloc
TransparentBlt
AlphaBlend
NetUserGetLocalGroups
VarUI4FromStr
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VariantClear
SysStringByteLen
LoadRegTypeLib
SysAllocString
VariantCopy
VariantInit
VarDateFromStr
LoadTypeLib
SysFreeString
SysAllocStringByteLen
OleLoadPicture
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW
SHGetMalloc
PathAddBackslashW
PathIsUNCW
PathIsDirectoryW
PathFileExistsW
SetFocus
GetMessagePos
SetWindowRgn
RedrawWindow
LoadBitmapW
SetRectEmpty
DestroyMenu
PostQuitMessage
GetForegroundWindow
DrawStateW
SetWindowPos
GetNextDlgTabItem
IsWindow
EndPaint
IntersectRect
DispatchMessageW
GetAsyncKeyState
ReleaseDC
GetDlgCtrlID
SendMessageW
UnregisterClassA
SendMessageA
GetClientRect
DrawTextW
SetScrollPos
LoadImageW
ClientToScreen
GetActiveWindow
GetWindowTextW
GetWindowTextLengthW
MsgWaitForMultipleObjects
InvalidateRgn
DestroyWindow
GetParent
UpdateWindow
GetPropW
EqualRect
GetMessageW
ShowWindow
DrawFrameControl
SetPropW
GetDesktopWindow
PeekMessageW
EnableWindow
GetSystemMenu
TranslateMessage
IsWindowEnabled
GetWindow
GetIconInfo
SetClipboardData
IsZoomed
LoadStringW
EnableMenuItem
DrawFocusRect
SetTimer
IsDialogMessageW
FillRect
CreateAcceleratorTableW
GetSysColorBrush
CreateWindowExW
GetWindowLongW
CharNextW
IsChild
MapWindowPoints
RegisterWindowMessageW
GetMonitorInfoW
EmptyClipboard
BeginPaint
OffsetRect
DefWindowProcW
GetScrollPos
KillTimer
TrackMouseEvent
GetComboBoxInfo
GetClassInfoExW
GetSystemMetrics
SetWindowLongW
GetWindowRect
InflateRect
SetCapture
ReleaseCapture
GetScrollRange
PostMessageW
EndDialog
CreateDialogParamW
CreatePopupMenu
GetSubMenu
PtInRect
DrawIconEx
SetWindowTextW
GetDlgItem
RemovePropW
FindWindowW
ScreenToClient
TrackPopupMenu
DialogBoxIndirectParamW
DestroyAcceleratorTable
ValidateRect
LoadCursorW
LoadIconW
GetDC
SetForegroundWindow
ExitWindowsEx
OpenClipboard
GetCursorPos
DrawTextExW
GetScrollInfo
CopyRect
GetCapture
MessageBeep
LoadMenuW
MessageBoxW
RegisterClassExW
MoveWindow
DialogBoxParamW
AppendMenuW
GetWindowDC
DestroyCursor
SendMessageTimeoutW
GetSysColor
SetScrollInfo
GetKeyState
GetWindowRgn
DestroyIcon
IsWindowVisible
SetCursorPos
SystemParametersInfoW
UnionRect
MonitorFromWindow
SetRect
InvalidateRect
CallWindowProcW
GetClassNameW
ModifyMenuW
IsRectEmpty
GetFocus
CloseClipboard
SetCursor
TranslateAcceleratorW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SymGetLineFromAddr
StackWalk
SymSetOptions
SymCleanup
SymInitialize
SymFunctionTableAccess
SymGetModuleBase
SymSetSearchPath
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CoInitialize
OleInitialize
StgCreateDocfileOnILockBytes
CoInitializeEx
CoGetClassObject
CoTaskMemRealloc
CoCreateInstance
OleUninitialize
CoUninitialize
CoTaskMemFree
CLSIDFromString
StringFromGUID2
CreateILockBytesOnHGlobal
CoTaskMemAlloc
Number of PE resources by type
RT_DIALOG 13
RT_STRING 12
RT_ICON 12
RT_BITMAP 6
RTF_FILE 2
RT_MENU 2
IMAGE_FILE 2
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 52
ExifTool file metadata
SubsystemVersion
5.0

LinkerVersion
9.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
3.0.0.0

UninitializedDataSize
0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

CharacterSet
Unicode

InitializedDataSize
635904

OriginalFileName
setup.exe

MIMEType
application/octet-stream

LegalCopyright
Copyright (C) QuickPad

FileVersion
3.0.0.0

TimeStamp
2012:12:20 16:32:04+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
setup

FileAccessDate
2015:02:05 13:51:25+01:00

ProductVersion
3.0.0.0

FileDescription
QuickPad, better than Notepad!

OSVersion
5.0

FileCreateDate
2015:02:05 13:51:25+01:00

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Klumbu

CodeSize
931840

ProductName
QuickPad

ProductVersionNumber
3.0.0.0

EntryPoint
0xaffc9

ObjectFileType
Dynamic link library

File identification
MD5 f26f67918444399632c3b6169662b4eb
SHA1 6d9990115196db1c342db779e79773c27b06c89a
SHA256 5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
ssdeep
196608:cyNX50r5Pqu4da6OUFuLpeOn5I7n9SiAYxCZocq:x5IclT2eC5I7n9Si5Cy

authentihash 26946d21f2d0d9c813204c5e83a0edfe4f50044309081a22fbc3ccf86df068fe
imphash 7f1244f86d79dd24218fbb9c549e2ed5
File size 6.8 MB ( 7137519 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (67.3%)
Win32 Dynamic Link Library (generic) (14.2%)
Win32 Executable (generic) (9.7%)
Generic Win/DOS Executable (4.3%)
DOS Executable Generic (4.3%)
Tags
peexe

VirusTotal metadata
First submission 2012-12-26 21:25:13 UTC ( 2 years, 8 months ago )
Last submission 2014-05-18 00:58:31 UTC ( 1 year, 3 months ago )
File names setup.exe
setup
5ba9d49481990d8468a20e498243401c65d192855a497e5fd35854290f0ccef1
Quickpad.exe
QuickPad.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Set keys
Deleted keys
Created mutexes
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.
UDP communications