Antivirus scan for 8e3766bdb8363af0c76e1aad9f7f93f45d48bb02e4a063aae0a95d53195a0bce at 2018-04-30 17:04:33 UTC

Antivirus	Result	Update
Baidu	Multi.Threats.InArchive	20180428
Cylance	Unsafe	20180430
Endgame	malicious (high confidence)	20180403
Ad-Aware		20180430
AegisLab		20180430
AhnLab-V3		20180430
Alibaba		20180428
ALYac		20180430
Antiy-AVL		20180430
Arcabit		20180430
Avast		20180430
Avast-Mobile		20180430
AVG		20180430
Avira (no cloud)		20180430
AVware		20180428
Babable		20180406
BitDefender		20180430
Bkav		20180426
CAT-QuickHeal		20180430
ClamAV		20180430
CMC		20180430
Comodo		20180430
CrowdStrike Falcon (ML)		20180418
Cybereason		None
Cyren		20180430
DrWeb		20180430
eGambit		20180430
Emsisoft		20180430
ESET-NOD32		20180430
F-Prot		20180430
F-Secure		20180430
Fortinet		20180430
GData		20180430
Ikarus		20180430
Sophos ML		20180121
Jiangmin		20180430
K7AntiVirus		20180430
K7GW		20180430
Kaspersky		20180430
Kingsoft		20180430
Malwarebytes		20180430
MAX		20180430
McAfee		20180430
McAfee-GW-Edition		20180425
Microsoft		20180430
eScan		20180430
NANO-Antivirus		20180430
nProtect		20180430
Palo Alto Networks (Known Signatures)		20180430
Panda		20180430
Qihoo-360		20180430
Rising		20180430
SentinelOne (Static ML)		20180225
Sophos AV		20180430
SUPERAntiSpyware		20180430
Symantec		20180430
Symantec Mobile Insight		20180429
Tencent		20180430
TheHacker		20180430
TotalDefense		20180430
TrendMicro		20180430
TrendMicro-HouseCall		20180430
Trustlook		20180430
VBA32		20180428
VIPRE		20180430
ViRobot		20180430
Webroot		20180430
Yandex		20180428
Zillya		20180430
ZoneAlarm by Check Point		20180430
Zoner		20180429

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Packers identified

F-PROT NSIS

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2009-04-09 12:19:38

Entry Point 0x00003415

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 26396 26624 6.50 cb807804553819b70f6e16b8a094d327

.rdata 32768 6614 6656 5.03 161b329b4c70ce4fbd9c1143e738896b

.data 40960 463772 512 1.74 140876ba314e7bc36379ee5c6db80876

.ndata 507904 774144 0 0.00 d41d8cd98f00b204e9800998ecf8427e

.rsrc 1282048 17368000 70656 4.43 58fccf3a5e29795645f23d1abc1e18a1

Overlays

MD5 a0d46f5e3ccfcbc9b32dcc812164163b

File type font/x-snf

Offset 105472

Size 6421270

Entropy 8.00

PE imports

Number of PE resources by type

RT_DIALOG 5

RT_ICON 1

RT_GROUP_ICON 1

RT_MANIFEST 1

Number of PE resources by language

ENGLISH US 8

PE resources

18466509968c3c0bf92ba410fea075def2b257a5a799a113cbc60f13e75f4b01 data

425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014 data

4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 data

7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50 data

bbd6669a4bd400dc85e269f44b68b579440fa24864352372d2e97bb0975874e3 data

c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016 data

cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba ASCII text

e07d7fa88eac47bf707d9cabd85df18a4696a209750a5e6ad1401b0dc2db31bf ASCII text

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2009:04:09 14:19:38+02:00

FileType

Win32 EXE

PEType

PE32

CodeSize

26624

LinkerVersion

9.0

ImageFileCharacteristics

No relocs, Executable, 32-bit

EntryPoint

0x3415

InitializedDataSize

475136

SubsystemVersion

5.0

ImageVersion

6.0

OSVersion

5.0

UninitializedDataSize

16896

File identification

MD5 64e44b4cf622bb9136566654d0036f3f

SHA1 f9dedd5c808d5662e8ee9d3118054d5e776407b1

SHA256 8e3766bdb8363af0c76e1aad9f7f93f45d48bb02e4a063aae0a95d53195a0bce

ssdeep

196608:Bp2AA1aiGtm63rd1Y779F7eIF5/xpVfRW6NlsKpc:Bp2FfX67s7LrVl/7c

authentihash 9344730ca89f131166c9e0b337a175af88c35eaa22a2b742fa4046a890081658

imphash bf95d1fc1d10de18b32654b123ad5e1f

File size 6.2 MB ( 6526742 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (41.0%) Win64 Executable (generic) (36.3%) Win32 Dynamic Link Library (generic) (8.6%) Win32 Executable (generic) (5.9%) OS/2 Executable (generic) (2.6%)

VirusTotal metadata

First submission 2018-04-30 17:04:33 UTC ( 9 months, 3 weeks ago )

Last submission 2018-05-09 00:08:02 UTC ( 9 months, 2 weeks ago )

File names

update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
output.113029646.txt
update.exe
output.113029636.txt
update.exe
output.113029638.txt
Setup.exe?REDACTED
update.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

\\.\PIPE\lsarpc (successful)

\\.\MountPointManager (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsd3.tmp (successful)

C:\8e3766bdb8363af0c76e1aad9f7f93f45d48bb02e4a063aae0a95d53195a0bce (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\yLsQ.mp3 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\iFwIAhhsDAo.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\MTkxbIjuVhG.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\System.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\System.dll (failed)

Read files

C:\8e3766bdb8363af0c76e1aad9f7f93f45d48bb02e4a063aae0a95d53195a0bce (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\yLsQ.mp3 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsv6.tmp (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\yLsQ.mp3 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\iFwIAhhsDAo.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\MTkxbIjuVhG.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\System.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\IHlmjfvAhfk.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsv6.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp\System.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp\md5dll.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp\brh.dat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp\nsExec.dll (successful)

Copied files

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp\nsExec.dll
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp\ns8.tmp (successful)

Moved files

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\IHlmjfvAhfk.dll
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\System.dll
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\
DST: (null) (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsd3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\iFwIAhhsDAo.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\MTkxbIjuVhG.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\System.dll (failed)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn4.tmp\yLsQ.mp3 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsa5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp (successful)

Created processes

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsf7.tmp\ns8.tmp" sc create -- binPath= ""C:\8e3766bdb8363af0c76e1aad9f7f93f45d48bb02e4a063aae0a95d53195a0bce" /wl 1"" (successful)

Created mutexes

oleacc-msaa-loaded (successful)

Runtime DLLs

shfolder (successful)

ole32.dll (successful)

setupapi.dll (successful)

rpcrt4.dll (successful)

shell32.dll (successful)

kernel32.dll (successful)

oleaut32.dll (successful)

user32.dll (successful)

gdi32.dll (successful)

advapi32.dll (successful)

SHA256:	8e3766bdb8363af0c76e1aad9f7f93f45d48bb02e4a063aae0a95d53195a0bce
File name:	Setup.exe?REDACTED
Detection ratio:	3 / 67
Analysis date:	2018-04-30 17:04:33 UTC ( 9 months, 3 weeks ago ) View latest

Ciphered bundle

FileVersionInfo properties

Packers identified

PE header basic information

PE sections

Overlays

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Copied files

Moved files

Deleted files

Created processes

Created mutexes

Runtime DLLs

Recover your password

Join VirusTotal Community

Sign in