Antivirus scan for 6dd61d14045d39be4c3c871175c060eb4247aef0f53249e767ee6f1fb039f770 at 2018-08-15 07:47:36 UTC

Antivirus	Result	Update
Avast	FileRepMalware	20180815
AVG	FileRepMalware	20180815
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9999	20180815
CrowdStrike Falcon (ML)	malicious_confidence_100% (D)	20180723
Cylance	Unsafe	20180815
Endgame	malicious (high confidence)	20180730
ESET-NOD32	a variant of Win32/GenKryptik.CIEV	20180815
Sophos ML	heuristic	20180717
Microsoft	Trojan:Win32/Emotet.AC!bit	20180815
Palo Alto Networks (Known Signatures)	generic.ml	20180815
Qihoo-360	HEUR/QVM20.1.31BD.Malware.Gen	20180815
Rising	Malware.Heuristic!ET#93% (RDM+:cmRtazq7DO2hYZPqT7pNztmCyzCY)	20180815
SentinelOne (Static ML)	static engine - malicious	20180701
Symantec	ML.Attribute.HighConfidence	20180815
Webroot	W32.Trojan.Emotet	20180815
Ad-Aware		20180815
AegisLab		20180815
AhnLab-V3		20180814
Alibaba		20180713
ALYac		20180815
Antiy-AVL		20180815
Arcabit		20180815
Avast-Mobile		20180815
Avira (no cloud)		20180814
AVware		20180815
BitDefender		20180815
Bkav		20180814
CAT-QuickHeal		20180814
ClamAV		20180815
CMC		20180812
Comodo		20180815
Cybereason		20180225
Cyren		20180815
DrWeb		20180815
eGambit		20180815
Emsisoft		20180815
F-Prot		20180815
F-Secure		20180815
Fortinet		20180815
GData		20180815
Ikarus		20180814
Jiangmin		20180815
K7AntiVirus		20180815
K7GW		20180815
Kaspersky		20180815
Kingsoft		20180815
Malwarebytes		20180815
MAX		20180815
McAfee		20180815
McAfee-GW-Edition		20180815
eScan		20180815
NANO-Antivirus		20180815
Panda		20180814
Sophos AV		20180815
SUPERAntiSpyware		20180815
Symantec Mobile Insight		20180814
TACHYON		20180815
Tencent		20180815
TheHacker		20180815
TotalDefense		20180815
TrendMicro		20180815
TrendMicro-HouseCall		20180815
Trustlook		20180815
VBA32		20180814
VIPRE		20180815
ViRobot		20180815
Yandex		20180814
Zillya		20180814
ZoneAlarm by Check Point		20180815
Zoner		20180814

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Product Microsoft® Windows® Operating S

Original name qwfew

Internal name TimeDateMUICal

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2018-08-15 07:31:07

Entry Point 0x0000A5DB

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 149996 150016 6.99 13c4b1cd44d52307bb6f995edfac2acb

.text 155648 183396 178176 3.78 7315586ad2dc2f6999a2e7038aea2f3b

.idata 339968 1400 1536 4.54 35a119ee9ef385bbe198774e32edc1f1

.rsrc 344064 2040 2048 4.83 3ebebb8a14f4ab8109e0dbab89cd9097

.reloc 348160 13360 13824 5.90 582b745ece890d7be682f58d9662d645

PE imports

Number of PE resources by type

RT_MANIFEST 1

RT_VERSION 1

Number of PE resources by language

ENGLISH US 2

PE resources

48b0c3f03caa59aa39c2d19149a38d3b8bb81864b966c01711a1fe41d8e120b3 ASCII text

6a64c4f66c534532e690470b3ba9ffd69abdc227b24080f86258e6d7aa043432 data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Wed Aug 15 07:31:07 2018 36192 43 Bytes

12 (12) Wed Aug 15 07:31:07 2018 36316 20 Bytes

ExifTool file metadata

UninitializedDataSize

LinkerVersion

13.0

ImageVersion

0.0

FileSubtype

FileVersionNumber

6.1.7600.16385

LanguageCode

English (U.S.)

FileFlagsMask

0x003f

ImageFileCharacteristics

No relocs, Executable, 32-bit

CharacterSet

Unicode

InitializedDataSize

201216

EntryPoint

0xa5db

OriginalFileName

qwfew

MIMEType

application/octet-stream

LegalCopyright

Microsoft Corporation. All rights reserv

TimeStamp

2018:08:15 09:31:07+02:00

FileType

Win32 EXE

PEType

PE32

InternalName

TimeDateMUICal

ProductVersion

6.1.7600.1638

SubsystemVersion

5.0

OSVersion

5.0

FileOS

Windows NT 32-bit

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Microsoft Corporati

CodeSize

150016

ProductName

Microsoft Windows Operating S

ProductVersionNumber

6.1.7600.16385

FileTypeExtension

exe

ObjectFileType

Executable application

File identification

MD5 7a95c0f846f6dc781d322fe7891e9bbc

SHA1 9820a4628e57da82fff3e350d692f48873e133bc

SHA256 6dd61d14045d39be4c3c871175c060eb4247aef0f53249e767ee6f1fb039f770

ssdeep

6144:SF4/cCWv/vvpCYDdZ7zQKYZpbL7evdSgZI2E1za4CyE:SF4ovhCYPsNDbnevdSgZI2uza

authentihash 3b8fe007dd599a00dddc31e52b83f3afe4b3646db8dca1d05d4c354038050f61

imphash 56a0ef9c22ad82fa01fb67d1266b7372

File size 338.5 KB ( 346624 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable (generic) (42.7%) OS/2 Executable (generic) (19.2%) Generic Win/DOS Executable (18.9%) DOS Executable Generic (18.9%)

VirusTotal metadata

First submission 2018-08-15 07:43:47 UTC ( 6 months, 1 week ago )

Last submission 2018-08-15 07:47:36 UTC ( 6 months, 1 week ago )

File names

qwfew
23849432.exe
22800736.exe
21031384.exe
18213336.exe
TimeDateMUICal

Advanced heuristic and reputation engines

F-Secure Deepguard Suspicious:W32/Malware!Online

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\system32\xAC\ (failed)

C:\WINDOWS\system32\ (successful)

C:\WINDOWS\ (successful)

\\.\MountPointManager (successful)

\\.\PIPE\lsarpc (successful)

Runtime DLLs

feclient.dll (successful)

rpcrt4.dll (successful)

SHA256:	6dd61d14045d39be4c3c871175c060eb4247aef0f53249e767ee6f1fb039f770
File name:	7a95c0f846f6dc781d322fe7891e9bbc
Detection ratio:	15 / 67
Analysis date:	2018-08-15 07:47:36 UTC ( 6 months, 1 week ago ) View latest

Ciphered bundle