× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 78fb018c47e6b86eeafab333cfe4437affe714beabcc8ede453aa2a89393df09
File name: lessmsi-gui.exe
Detection ratio: 0 / 64
Analysis date: 2018-05-09 11:05:00 UTC ( 2 months, 1 week ago )
Antivirus Result Update
Ad-Aware 20180509
AegisLab 20180509
AhnLab-V3 20180509
Alibaba 20180509
ALYac 20180509
Antiy-AVL 20180509
Arcabit 20180509
Avast 20180509
Avast-Mobile 20180509
AVG 20180509
Avira (no cloud) 20180509
AVware 20180428
Babable 20180406
Baidu 20180509
BitDefender 20180509
Bkav 20180509
CAT-QuickHeal 20180509
ClamAV 20180509
Comodo 20180509
CrowdStrike Falcon (ML) 20180418
Cybereason 20180225
Cylance 20180509
Cyren 20180509
DrWeb 20180509
eGambit 20180509
Emsisoft 20180509
Endgame 20180507
ESET-NOD32 20180509
F-Prot 20180509
F-Secure 20180509
Fortinet 20180509
GData 20180509
Ikarus 20180509
Sophos ML 20180503
Jiangmin 20180509
K7AntiVirus 20180509
K7GW 20180509
Kaspersky 20180509
Kingsoft 20180509
Malwarebytes 20180509
MAX 20180509
McAfee 20180509
Microsoft 20180509
eScan 20180509
NANO-Antivirus 20180509
nProtect 20180509
Palo Alto Networks (Known Signatures) 20180509
Panda 20180508
Qihoo-360 20180509
Rising 20180509
SentinelOne (Static ML) 20180225
Sophos AV 20180509
SUPERAntiSpyware 20180509
Symantec 20180509
Symantec Mobile Insight 20180509
Tencent 20180509
TheHacker 20180509
TrendMicro 20180509
TrendMicro-HouseCall 20180509
Trustlook 20180509
VBA32 20180508
VIPRE 20180509
ViRobot 20180509
Webroot 20180509
Yandex 20180508
ZoneAlarm by Check Point 20180509
Zoner 20180508
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright Scott Willeke © 2004-2013

Product Less MSIérables (lessmsi)
Original name lessmsi-gui.exe
Internal name lessmsi-gui.exe
File version 1.6.1
Description Less MSIérables (lessmsi) GUI interface
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2017-04-13 07:37:31
Entry Point 0x0001A8BE
Number of sections 3
.NET details
Module Version ID f4b12387-22b3-4dcd-9a97-598d71e44af5
PE sections
PE imports
_CorExeMain
Number of PE resources by type
RT_MANIFEST 1
RT_VERSION 1
Number of PE resources by language
NEUTRAL 2
PE resources
Debug information
ExifTool file metadata
SubsystemVersion
4.0

LinkerVersion
11.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
1.6.1.0

UninitializedDataSize
0

LanguageCode
Neutral

FileFlagsMask
0x003f

CharacterSet
Unicode

InitializedDataSize
2048

EntryPoint
0x1a8be

OriginalFileName
lessmsi-gui.exe

MIMEType
application/octet-stream

LegalCopyright
Copyright Scott Willeke 2004-2013

FileVersion
1.6.1

TimeStamp
2017:04:13 08:37:31+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
lessmsi-gui.exe

ProductVersion
1.6.1

FileDescription
Less MSI rables (lessmsi) GUI interface

OSVersion
4.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CodeSize
100864

ProductName
Less MSI rables (lessmsi)

ProductVersionNumber
1.6.1.0

FileTypeExtension
exe

ObjectFileType
Executable application

AssemblyVersion
1.6.1.0

CarbonBlack CarbonBlack acts as a surveillance camera for computers
While monitoring an end-user machine in-the-wild, CarbonBlack noticed this sample wrote the following files to disk.
Compressed bundles
File identification
MD5 534f1d49cac78e0c6ee456a6ed12bc5e
SHA1 6ee9ce5271e2cb4627603959c526a12bc5dea7f2
SHA256 78fb018c47e6b86eeafab333cfe4437affe714beabcc8ede453aa2a89393df09
ssdeep
3072:xrG9MiB+u32GhNvxRRxcSPWptFMdqtUX0:xrG9MiB+82GhNZRfQPqdQU

authentihash 42275ce1eccac45e50c81460dab7f10dbd1d4711dd28a31f78fd82caceb2923f
imphash f34d5f2d4577ed6d9ceec516c1f5a744
File size 101.0 KB ( 103424 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly

TrID Generic CIL Executable (.NET, Mono, etc.) (55.8%)
Win64 Executable (generic) (21.0%)
Windows screen saver (9.9%)
Win32 Dynamic Link Library (generic) (5.0%)
Win32 Executable (generic) (3.4%)
Tags
peexe assembly

VirusTotal metadata
First submission 2017-04-13 08:23:27 UTC ( 1 year, 3 months ago )
Last submission 2018-05-09 11:05:00 UTC ( 2 months, 1 week ago )
File names lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
lessmsi-gui.exe
Behaviour characterization
Zemana
dll-injection

No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!