| SHA256: | 8d8d3c15556d1487477fabb7a650ee912e63a3d06d8f6a2175d03f54e99584a7 |
| File name: | 2b480ac8c403440e0013dda2a692b7a8b2827962 |
| Detection ratio: | 35 / 57 |
| Analysis date: | 2016-04-13 05:42:14 UTC ( 2 years, 10 months ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| Ad-Aware | Trojan.GenericKD.3149233 | 20160413 |
| AegisLab | Uds.Dangerousobject.Multi!c | 20160413 |
| ALYac | Trojan.GenericKD.3149233 | 20160413 |
| Antiy-AVL | Trojan[Backdoor]/Win32.Androm | 20160413 |
| Arcabit | Trojan.Generic.D300DB1 | 20160413 |
| Avast | Win32:Malware-gen | 20160413 |
| AVG | Inject3.AJIG | 20160412 |
| Avira (no cloud) | TR/Crypt.ZPACK.okcv | 20160412 |
| AVware | Trojan.Win32.Generic!BT | 20160413 |
| Baidu | Win32.Trojan.WisdomEyes.151026.9950.9999 | 20160412 |
| BitDefender | Trojan.GenericKD.3149233 | 20160413 |
| Cyren | W32/PWS.YEYM-7793 | 20160413 |
| DrWeb | Trojan.DownLoader21.11025 | 20160413 |
| Emsisoft | Trojan.GenericKD.3149233 (B) | 20160413 |
| ESET-NOD32 | Win32/PSW.Papras.EH | 20160413 |
| F-Secure | Trojan.GenericKD.3149233 | 20160413 |
| GData | Trojan.GenericKD.3149233 | 20160413 |
| Ikarus | Backdoor.Win32.Androm | 20160412 |
| K7AntiVirus | Password-Stealer ( 004c893a1 ) | 20160412 |
| Kaspersky | Backdoor.Win32.Androm.jkxm | 20160413 |
| Malwarebytes | Trojan.Usrnif | 20160413 |
| McAfee | Artemis!BACCE0540E1E | 20160413 |
| McAfee-GW-Edition | Artemis | 20160413 |
| Microsoft | Backdoor:Win32/Drixed | 20160413 |
| eScan | Trojan.GenericKD.3149233 | 20160413 |
| NANO-Antivirus | Trojan.Win32.DownLoader21.ebnpgy | 20160413 |
| Panda | Trj/GdSda.A | 20160412 |
| Qihoo-360 | HEUR/QVM20.1.Malware.Gen | 20160413 |
| Rising | PE:Malware.Generic/QRS!1.9E2D [F] | 20160413 |
| Sophos AV | Troj/Gozi-CK | 20160413 |
| Symantec | Trojan.Gen.2 | 20160413 |
| Tencent | Win32.Trojan.Inject.Auto | 20160413 |
| TrendMicro | TSPY_DRIDEX.YYSTA | 20160413 |
| TrendMicro-HouseCall | TSPY_DRIDEX.YYSTA | 20160413 |
| VIPRE | Trojan.Win32.Generic!BT | 20160413 |
| AhnLab-V3 | 20160412 | |
| Alibaba | 20160413 | |
| Baidu-International | 20160412 | |
| Bkav | 20160412 | |
| CAT-QuickHeal | 20160413 | |
| ClamAV | 20160412 | |
| CMC | 20160412 | |
| Comodo | 20160413 | |
| F-Prot | 20160413 | |
| Fortinet | 20160404 | |
| Jiangmin | 20160413 | |
| K7GW | 20160404 | |
| Kingsoft | 20160413 | |
| nProtect | 20160412 | |
| SUPERAntiSpyware | 20160413 | |
| TheHacker | 20160412 | |
| TotalDefense | 20160412 | |
| VBA32 | 20160412 | |
| ViRobot | 20160413 | |
| Yandex | 20160412 | |
| Zillya | 20160412 | |
| Zoner | 20160413 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
© 2005-2010 Adobe Systems Incorporated. All rights reserved.
Product Adobe Setup
Original name AdobeHelperx86.exe
Internal name AdobeHelperx86.exe
File version 3,0,121,0
Description AdobeHelperx86 Utility Application
Signature verification
A certificate was explicitly revoked by its issuer.
Signing date 12:01 AM 4/11/2016
| Signers |
| Counter signers |
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2016-04-10 23:57:04
Entry Point 0x00001000
Number of sections 8
PE sections
Overlays
MD5 607fd74b0b2175b8f8b0505aee05a2e1
File type data
Offset 794112
Size 4536
Entropy 7.32
PE imports
Number of PE resources by type
RT_MANIFEST 1
RT_VERSION 1
Number of PE resources by language
ENGLISH US 2
PE resources
ExifTool file metadata
SubsystemVersion
5.0
LinkerVersion
9.0
ImageVersion
0.0
FileSubtype
0
FileVersionNumber
3.0.121.0
UninitializedDataSize
0
LanguageCode
English (U.S.)
FileFlagsMask
0x003f
CharacterSet
Windows, Latin1
InitializedDataSize
772096
EntryPoint
0x1000
OriginalFileName
AdobeHelperx86.exe
MIMEType
application/octet-stream
LegalCopyright
2005-2010 Adobe Systems Incorporated. All rights reserved.
FileVersion
3,0,121,0
TimeStamp
2016:04:11 00:57:04+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
AdobeHelperx86.exe
ProductVersion
3,0,121,0
FileDescription
AdobeHelperx86 Utility Application
OSVersion
5.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
Adobe Systems Incorporated
CodeSize
20992
ProductName
Adobe Setup
ProductVersionNumber
3.0.121.0
FileTypeExtension
exe
ObjectFileType
Executable application
File identification
MD5 bacce0540e1e0e3b374e3155b194357a
SHA1 fe188e9cd6025ee85c753030e5f365aca2e47dbc
SHA256 8d8d3c15556d1487477fabb7a650ee912e63a3d06d8f6a2175d03f54e99584a7
ssdeep
6144:O4rc/mRB6rFAL0cdQK0k0F7nhc8K1wEMjbRO7pmZwCTWxlwduZ9hEsLy/MUsIMEp:O4QOAr6L6G0k8LE4gF9jwkZ97Ly/iBEp
File size
779.9 KB ( 798648 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Dynamic Link Library (generic) (43.5%) Win32 Executable (generic) (29.8%) Generic Win/DOS Executable (13.2%) DOS Executable Generic (13.2%) |
Tags
revoked-cert
peexe
signed
overlay
VirusTotal metadata
First submission
2016-04-11 02:04:27 UTC ( 2 years, 10 months ago )
Last submission
2016-04-12 06:35:04 UTC ( 2 years, 10 months ago )
| File names |
office.exe AdobeHelperx86.exe 2b480ac8c403440e0013dda2a692b7a8b2827962 |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.