× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 8ec7f12f36643d6e99a3b33068f1fd6fdd54180d730f00b73708b720102c89df
File name: markdownpad2-setup.exe
Detection ratio: 1 / 69
Analysis date: 2019-02-03 15:50:40 UTC ( 1 month, 2 weeks ago ) View latest
Antivirus Result Update
VBA32 Trojan.SMSSend 20190201
Acronis 20190130
Ad-Aware 20190203
AegisLab 20190203
AhnLab-V3 20190203
Alibaba 20180921
ALYac 20190203
Antiy-AVL 20190203
Arcabit 20190203
Avast 20190203
Avast-Mobile 20190203
AVG 20190203
Avira (no cloud) 20190203
Babable 20180918
Baidu 20190202
BitDefender 20190203
Bkav 20190201
CAT-QuickHeal 20190203
ClamAV 20190203
CMC 20190203
Comodo 20190203
CrowdStrike Falcon (ML) 20181023
Cybereason 20190109
Cylance 20190203
Cyren 20190203
DrWeb 20190203
eGambit 20190203
Emsisoft 20190203
Endgame 20181108
ESET-NOD32 20190203
F-Prot 20190203
F-Secure 20190203
Fortinet 20190201
GData 20190203
Ikarus 20190203
Sophos ML 20181128
Jiangmin 20190203
K7AntiVirus 20190203
K7GW 20190203
Kaspersky 20190203
Kingsoft 20190203
Malwarebytes 20190203
MAX 20190203
McAfee 20190203
McAfee-GW-Edition 20190203
Microsoft 20190203
eScan 20190203
NANO-Antivirus 20190203
Palo Alto Networks (Known Signatures) 20190203
Panda 20190203
Qihoo-360 20190203
Rising 20190203
SentinelOne (Static ML) 20190124
Sophos AV 20190203
SUPERAntiSpyware 20190130
Symantec 20190203
TACHYON 20190203
Tencent 20190203
TheHacker 20190131
Trapmine 20190123
TrendMicro 20190203
TrendMicro-HouseCall 20190203
Trustlook 20190203
ViRobot 20190203
Webroot 20190203
Yandex 20190201
Zillya 20190201
ZoneAlarm by Check Point 20190203
Zoner 20190202
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (C) Apricity Software LLC

Product MarkdownPad 2
Original name markdownpad2-setup.exe
Internal name markdownpad2-setup
File version 2.5.0.27920
Description This installer database contains the logic and data required to install MarkdownPad 2.
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2014-11-17 15:09:06
Entry Point 0x000C8DAC
Number of sections 5
PE sections
Overlays
MD5 ca6b61471cd4793f75fcdeade267fa43
File type application/x-ms-dos-executable
Offset 1538560
Size 36345978
Entropy 7.99
PE imports
RegCreateKeyExW
RegDeleteKeyA
RegCloseKey
LookupAccountSidW
RegQueryValueExA
RegCreateKeyW
OpenServiceW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
RegCreateKeyA
UnlockServiceDatabase
RegQueryValueExW
SetSecurityDescriptorDacl
CloseServiceHandle
RegOpenKeyA
EqualSid
OpenProcessToken
QueryServiceStatus
RegOpenKeyExW
RegOpenKeyW
RegOpenKeyExA
RegEnumValueA
GetTokenInformation
GetUserNameW
RegQueryInfoKeyW
GetSecurityDescriptorDacl
RegDeleteValueW
LockServiceDatabase
RegEnumKeyExW
SetEntriesInAclW
StartServiceW
RegSetValueExW
FreeSid
OpenSCManagerW
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegSetValueExA
RegDeleteValueA
InitCommonControlsEx
ImageList_Destroy
_TrackMouseEvent
ImageList_AddMasked
ImageList_SetBkColor
ImageList_ReplaceIcon
DestroyPropertySheetPage
CreatePropertySheetPageW
ImageList_Create
PropertySheetW
ImageList_GetIcon
ImageList_LoadImageW
ImageList_Add
GetSaveFileNameW
GetOpenFileNameW
CreatePolygonRgn
CreateFontIndirectW
CreatePen
GetRgnBox
CreateRectRgnIndirect
CombineRgn
GetBitmapBits
Rectangle
GetLayout
GetBrushOrgEx
ExcludeClipRect
CreateCompatibleDC
DeleteDC
SetBkMode
GetObjectW
BitBlt
CreateDIBSection
CreateBitmapIndirect
SetTextColor
CreatePatternBrush
GetDeviceCaps
FillRgn
ExtTextOutW
EqualRgn
GetStockObject
SelectClipRgn
SetViewportOrgEx
CreateFontW
SetBrushOrgEx
CreateRectRgn
SelectObject
CreateSolidBrush
SetBkColor
DeleteObject
CreateCompatibleBitmap
GetStdHandle
GetDriveTypeW
GetConsoleOutputCP
WaitForSingleObject
HeapDestroy
GetFileAttributesW
DuplicateHandle
GetLocalTime
DeleteCriticalSection
GetCurrentProcess
GetConsoleMode
GetLocaleInfoA
LocalAlloc
LoadLibraryExW
FreeEnvironmentStringsW
GetLocaleInfoW
SetStdHandle
GetTempPathA
GetCPInfo
GetProcAddress
GetStringTypeA
InterlockedExchange
GetTempPathW
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetOEMCP
LocalFree
FormatMessageW
ConnectNamedPipe
GetExitCodeProcess
InitializeCriticalSection
OutputDebugStringW
GetLogicalDriveStringsW
FindClose
TlsGetValue
MoveFileW
SetFileAttributesW
GetEnvironmentVariableW
SetLastError
PeekNamedPipe
CopyFileW
GetUserDefaultLangID
LoadResource
GetModuleFileNameW
IsDebuggerPresent
HeapAlloc
GetModuleFileNameA
lstrcmpiW
EnumSystemLocalesA
EnumResourceLanguagesW
UnhandledExceptionFilter
InterlockedDecrement
MultiByteToWideChar
FlushInstructionCache
SetFilePointer
GetFullPathNameW
CreateThread
GetSystemDirectoryW
GetExitCodeThread
SetUnhandledExceptionFilter
MulDiv
IsProcessorFeaturePresent
GlobalMemoryStatus
SearchPathW
WriteConsoleA
SetCurrentDirectoryW
GlobalAlloc
GetDiskFreeSpaceExW
SetEndOfFile
GetVersion
LeaveCriticalSection
WriteConsoleW
CreateToolhelp32Snapshot
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
GetSystemTime
SetHandleCount
TerminateThread
LoadLibraryW
GetVersionExW
SetEvent
QueryPerformanceCounter
GetTickCount
SetConsoleTextAttribute
TlsAlloc
FlushFileBuffers
LoadLibraryA
RtlUnwind
FreeLibrary
GetStartupInfoA
UnlockFile
GetWindowsDirectoryW
GetFileSize
DeleteFileA
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GlobalLock
GetConsoleScreenBufferInfo
GetSystemInfo
GetProcessHeap
GetTempFileNameW
CompareStringW
WriteFile
RemoveDirectoryW
FindNextFileW
ResetEvent
GetTempFileNameA
FindFirstFileW
IsValidLocale
lstrcmpW
WaitForMultipleObjects
GetUserDefaultLCID
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
ExitProcess
InterlockedIncrement
GetLastError
LCMapStringW
GetShortPathNameW
CreateNamedPipeW
GlobalFree
GetConsoleCP
FindResourceW
LCMapStringA
GetEnvironmentStringsW
GlobalUnlock
LockFile
lstrlenW
Process32NextW
CreateProcessW
SizeofResource
GetCurrentProcessId
LockResource
GetCommandLineW
WideCharToMultiByte
HeapSize
InterlockedCompareExchange
Process32FirstW
GetCurrentThread
lstrcpynW
GetSystemDefaultLangID
RaiseException
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
GetACP
GetModuleHandleW
GetCurrentThreadId
FindResourceExW
CreateProcessA
IsValidCodePage
HeapCreate
OpenEventW
VirtualFree
Sleep
TerminateProcess
VirtualAlloc
TransparentBlt
AlphaBlend
NetUserGetLocalGroups
NetLocalGroupGetMembers
NetApiBufferFree
VarUI4FromStr
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VariantClear
SysStringByteLen
LoadRegTypeLib
SysAllocString
VariantCopy
VariantInit
VarDateFromStr
LoadTypeLib
SysFreeString
SysAllocStringByteLen
OleLoadPicture
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW
SHGetMalloc
PathAddBackslashW
PathIsUNCW
PathIsDirectoryW
PathFileExistsW
GetUserNameExW
RedrawWindow
GetMessagePos
SetWindowRgn
LoadBitmapW
SetRectEmpty
DestroyMenu
PostQuitMessage
GetForegroundWindow
DrawStateW
SetWindowPos
GetNextDlgTabItem
IsWindow
EndPaint
IntersectRect
CopyRect
DispatchMessageW
GetAsyncKeyState
ReleaseDC
GetDlgCtrlID
SendMessageW
UnregisterClassA
SendMessageA
GetClientRect
DrawTextW
SetScrollPos
LoadImageW
ClientToScreen
GetActiveWindow
GetWindowTextW
GetWindowTextLengthW
MsgWaitForMultipleObjects
InvalidateRgn
DestroyWindow
DrawEdge
GetParent
UpdateWindow
GetPropW
EqualRect
EnumWindows
GetMessageW
ShowWindow
DrawFrameControl
SetPropW
GetDesktopWindow
PeekMessageW
EnableWindow
GetSystemMenu
TranslateMessage
IsWindowEnabled
GetWindow
CreateIconFromResourceEx
GetIconInfo
SetClipboardData
IsZoomed
LoadStringW
EnableMenuItem
DrawFocusRect
SetTimer
IsDialogMessageW
FillRect
CreateAcceleratorTableW
GetSysColorBrush
CreateWindowExW
GetWindowLongW
CharNextW
IsChild
MapWindowPoints
RegisterWindowMessageW
GetMonitorInfoW
EmptyClipboard
BeginPaint
OffsetRect
DefWindowProcW
GetScrollPos
KillTimer
TrackMouseEvent
GetComboBoxInfo
GetClassInfoExW
GetSystemMetrics
SetWindowLongW
GetWindowRect
InflateRect
SetCapture
ReleaseCapture
GetScrollRange
PostMessageW
EndDialog
CreateDialogParamW
CreatePopupMenu
GetSubMenu
PtInRect
DrawIconEx
SetWindowTextW
GetDlgItem
RemovePropW
ScreenToClient
TrackPopupMenu
DialogBoxIndirectParamW
DestroyAcceleratorTable
ValidateRect
LoadCursorW
LoadIconW
GetDC
SetForegroundWindow
ExitWindowsEx
OpenClipboard
GetCursorPos
DrawTextExW
GetScrollInfo
FindWindowW
GetCapture
MessageBeep
LoadMenuW
SetFocus
GetWindowThreadProcessId
MessageBoxW
RegisterClassExW
MoveWindow
DialogBoxParamW
AppendMenuW
GetWindowDC
DestroyCursor
LookupIconIdFromDirectoryEx
SendMessageTimeoutW
GetSysColor
SetScrollInfo
GetKeyState
GetWindowRgn
DestroyIcon
IsWindowVisible
SetCursorPos
SystemParametersInfoW
UnionRect
MonitorFromWindow
SetRect
InvalidateRect
CallWindowProcW
GetClassNameW
ModifyMenuW
IsRectEmpty
GetFocus
CloseClipboard
SetCursor
TranslateAcceleratorW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SymGetLineFromAddr
StackWalk
SymSetOptions
SymCleanup
SymInitialize
SymFunctionTableAccess
SymGetModuleBase
SymSetSearchPath
CreateStreamOnHGlobal
OleLockRunning
CoTaskMemFree
CoInitialize
OleInitialize
StgCreateDocfileOnILockBytes
CoCreateInstance
CoCreateGuid
CoTaskMemRealloc
CLSIDFromProgID
OleUninitialize
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CLSIDFromString
StringFromGUID2
CreateILockBytesOnHGlobal
CoGetClassObject
Number of PE resources by type
RT_DIALOG 13
RT_STRING 13
RT_ICON 12
RT_BITMAP 6
RTF_FILE 2
RT_MENU 2
IMAGE_FILE 2
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 53
PE resources
Debug information
ExifTool file metadata
UninitializedDataSize
0

LinkerVersion
9.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
2.5.0.27920

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

FileDescription
This installer database contains the logic and data required to install MarkdownPad 2.

ImageFileCharacteristics
Executable, 32-bit

CharacterSet
Unicode

InitializedDataSize
489472

EntryPoint
0xc8dac

OriginalFileName
markdownpad2-setup.exe

MIMEType
application/octet-stream

LegalCopyright
Copyright (C) Apricity Software LLC

FileVersion
2.5.0.27920

TimeStamp
2014:11:17 16:09:06+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
markdownpad2-setup

ProductVersion
2.5.0.27920

SubsystemVersion
5.0

OSVersion
5.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Apricity Software LLC

CodeSize
1048064

ProductName
MarkdownPad 2

ProductVersionNumber
2.5.0.27920

FileTypeExtension
exe

ObjectFileType
Dynamic link library

CarbonBlack CarbonBlack acts as a surveillance camera for computers
While monitoring an end-user machine in-the-wild, CarbonBlack noticed the following files in execution wrote this sample to disk.
While monitoring an end-user machine in-the-wild, CarbonBlack noticed this sample wrote the following files to disk.
Overlay parents
Compressed bundles
File identification
MD5 261214a892afdd276e4a2c893e5e6fb8
SHA1 94c1e612e3901f45233c03a5c034aef5f7ab3420
SHA256 8ec7f12f36643d6e99a3b33068f1fd6fdd54180d730f00b73708b720102c89df
ssdeep
786432:p7FA4wvObQR5rsGrdIYzu1zJLEqexxq30XO0UoWB6g5NRZbW:p7F3YOUvoskGqeS30NWBr5NRZbW

authentihash b609ec2a52e3b69cbbc201def45021dccf6592c7317193b739d7008b9a445fa1
imphash 9eff7a1b294d31fdb90f8bb40cef7a47
File size 36.1 MB ( 37884538 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID InstallShield setup (23.7%)
Win32 EXE PECompact compressed (generic) (22.9%)
Win32 Executable MS Visual C++ (generic) (17.2%)
Win64 Executable (generic) (15.2%)
UPX compressed Win32 Executable (14.9%)
Tags
peexe overlay

VirusTotal metadata
First submission 2014-12-25 23:19:51 UTC ( 4 years, 2 months ago )
Last submission 2019-01-18 01:01:24 UTC ( 2 months ago )
File names 34_20#T1#9189
markdownpad2-setup.exe
markdownpad2-setup.exe
markdownpad2-setup.exe
markdownpad2-setup.exe
MarkdownPad.exe
markdownpad2-setup
markdownpad2-setup_2.5.exe
markdownpad2-setup.exe
unconfirmed 378532.crdownload
607776
markdownpad2-setup.exe
markdownpad2-setup.exe
markdownpad2-setup.exe
markdownpad2-setup.exe
markdownpad2 2.5.exe
markdownpad2-setup.exe
markdownpad2-setup (1).exe
markdownpad2-setup.exe
markdownpad2-setup.exe
markdownpad2-setup(1).exe
markdownpad2install.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!