Antivirus scan for 612c6fbfed670e1b684fe6a58b9074dacdfe1e958575b343cd20dd74439d4e94 at 2016-05-25 12:08:19 UTC

Antivirus	Result	Update
Avast	Win32:Malware-gen	20160525
Avira (no cloud)	TR/Agent.dvzs	20160525
Baidu	Win32.Trojan.Kryptik.aee	20160525
ESET-NOD32	a variant of Win32/Kryptik.EXAI	20160525
Qihoo-360	HEUR/QVM09.0.0000.Malware.Gen	20160525
Rising	Trojan.Kryptik!8.8-4rDVOE3lr9R (Cloud)	20160525
Sophos AV	Mal/Generic-S	20160525
Tencent	Win32.Trojan.Kryptik.Dypv	20160525
Ad-Aware		20160525
AegisLab		20160525
AhnLab-V3		20160525
Alibaba		20160525
ALYac		20160525
Antiy-AVL		20160525
Arcabit		20160525
AVG		20160525
AVware		20160525
Baidu-International		20160525
BitDefender		20160525
Bkav		20160524
CAT-QuickHeal		20160525
ClamAV		20160525
CMC		20160523
Comodo		20160525
Cyren		20160525
DrWeb		20160525
Emsisoft		20160525
F-Prot		20160525
F-Secure		20160525
Fortinet		20160525
GData		20160525
Ikarus		20160525
Jiangmin		20160525
K7AntiVirus		20160525
K7GW		20160525
Kaspersky		20160525
Kingsoft		20160525
Malwarebytes		20160525
McAfee		20160525
McAfee-GW-Edition		20160524
Microsoft		20160525
eScan		20160525
NANO-Antivirus		20160525
nProtect		20160525
Panda		20160524
SUPERAntiSpyware		20160525
Symantec		20160525
TheHacker		20160523
TotalDefense		20160525
TrendMicro		20160525
TrendMicro-HouseCall		20160525
VBA32		20160525
VIPRE		20160525
ViRobot		20160525
Yandex		20160524
Zillya		20160525
Zoner		20160525

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Product Cyotek WebCopy

Original name lnkchkgui.exe

Internal name lnkchkgui.exe

File version 1.0.0.0

Description Cyotek Link Checker

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2016-05-23 14:01:25

Entry Point 0x0000454F

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 37988 38400 6.36 4278e98a4070e4afb9cdf6d07a31c0af

.rdata 45056 159952 160256 4.80 5992134c47cdfd69bff7fc857eb7f35c

.data 208896 78364 10240 1.01 0b2b94029db8b00a9e3153df92a0f404

.rsrc 290816 3168 3584 4.15 0d18eb82c39dafb06303fc3b464b0d5a

PE imports

Number of PE resources by type

RT_MENU 3

RT_ACCELERATOR 1

RT_MANIFEST 1

RT_VERSION 1

Number of PE resources by language

ENGLISH US 4

NEUTRAL 1

FRENCH 1

PE resources

15c880aae447a979394eb5799a61290847f8b0dadbe5a382910fe3cc3e61dc21 data

30bc9a301646ac867697cd9f32cb0fb83455df0d135a832041703b3bcf7448ab data

49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e ASCII text

53e656764230b77e7f45e221701dbaf6b0071a1bc5eae2377e201489343d44f9 data

aa41678ae8c2b0c544788b9003244a29d16c5c22a61f7d08b182f074c43cc2a6 data

f473ec049d2ace8bce476abd0222c0f5e7c01b1621da5976eb2813d9dd341c26 data

ExifTool file metadata

UninitializedDataSize

LinkerVersion

9.0

ImageVersion

0.0

ProductName

Cyotek WebCopy

FileVersionNumber

1.0.0.0

LanguageCode

Neutral

FileFlagsMask

0x003f

FileDescription

Cyotek Link Checker

CharacterSet

Unicode

InitializedDataSize

174080

FileTypeExtension

exe

OriginalFileName

lnkchkgui.exe

MIMEType

application/octet-stream

Subsystem

Windows GUI

FileVersion

1.0.0.0

TimeStamp

2016:05:23 15:01:25+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

lnkchkgui.exe

ProductVersion

1.1.0.1

SubsystemVersion

5.0

OSVersion

5.0

FileOS

Win32

LegalCopyright

MachineType

Intel 386 or later, and compatibles

CompanyName

Cyotek Ltd

CodeSize

38400

FileSubtype

ProductVersionNumber

1.1.0.1

EntryPoint

0x454f

ObjectFileType

Executable application

AssemblyVersion

1.0.0.0

File identification

MD5 8263e8e6c95ffbfefbdc0bb7d3a04cdd

SHA1 fdac40e5102b38bf62b50e44ae1d040fbbd2c624

SHA256 612c6fbfed670e1b684fe6a58b9074dacdfe1e958575b343cd20dd74439d4e94

ssdeep

3072:tVx/FhuzeO+k22Kdq5F66lmMur5DLsP+7aK4x+yA61:t7fvXkW8Fip5/sW7q

authentihash fbe4e03afc0b0eb9380c80df9d3abf7e9963f0ed8b21716fb91c3ab20b5460c2

imphash d00a986e912d3c84b0922f09fb4ef3d9

File size 208.5 KB ( 213504 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (42.2%) Win64 Executable (generic) (37.3%) Win32 Dynamic Link Library (generic) (8.8%) Win32 Executable (generic) (6.0%) Generic Win/DOS Executable (2.7%)

VirusTotal metadata

First submission 2016-05-25 12:08:19 UTC ( 2 years, 8 months ago )

Last submission 2016-05-25 12:08:19 UTC ( 2 years, 8 months ago )

File names

lnkchkgui.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

\\.\PIPE\lsarpc (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

Read files

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab7.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar8.tmp (successful)

Created processes

C:\612c6fbfed670e1b684fe6a58b9074dacdfe1e958575b343cd20dd74439d4e94" kjywraxbgbpdbhvdzpih" (successful)

Code injections in the following processes

612c6fbfed670e1b684fe6a58b9074dacdfe1e958575b343cd20dd74439d4e94 (successful)

svchost.exe (successful)

Created mutexes

Global\215f0da4-f753-4afb-a535-75cb59e6c260 (successful)

<USER>_SiInstallAndStartServiceThread (successful)

RasPbFile (failed)

Opened mutexes

ShimCacheMutex (successful)

RasPbFile (successful)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

CryptSvc (successful)

RASMAN (successful)

Runtime DLLs

msvcrt.dll (successful)

kernel32.dll (successful)

user32.dll (successful)

ntdll.dll (successful)

rpcrt4.dll (successful)

advapi32.dll (successful)

secur32.dll (successful)

c:\windows\system32\mswsock.dll (successful)

dnsapi.dll (successful)

c:\windows\system32\winrnr.dll (successful)

HTTP requests

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

DNS requests

stworke.com (148.100.111.208)

www.download.windowsupdate.com (8.253.82.62)

TCP connections

148.100.111.208:80

2.18.213.42:80

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	612c6fbfed670e1b684fe6a58b9074dacdfe1e958575b343cd20dd74439d4e94
File name:	8263e8e6c95ffbfefbdc0bb7d3a04cdd
Detection ratio:	8 / 57
Analysis date:	2016-05-25 12:08:19 UTC ( 2 years, 8 months ago )

Ciphered bundle

FileVersionInfo properties

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Deleted files

Created processes

Code injections in the following processes

Created mutexes

Opened mutexes

Opened service managers

Opened services

Runtime DLLs

HTTP requests

DNS requests

TCP connections

UDP communications

Recover your password

Join VirusTotal Community

Sign in