× Cookies are disabled! This site requires cookies to be enabled to work properly
VirusTotal
SHA256: 90eb88ce602a38df8e27e05e5bb4198a2fd22b635e5de49dab18abacb6e3a683
File name: cwwkj0IdJzegN77.exe
Detection ratio: 43 / 66
Analysis date: 2018-11-11 02:02:05 UTC ( 3 months, 1 week ago ) View latest
Antivirus Result Update
Ad-Aware Trojan.GenericKD.40657863 20181111
AhnLab-V3 Trojan/Win32.Emotet.R242369 20181110
Antiy-AVL Trojan[Banker]/Win32.Emotet 20181111
Avast Win32:MalwareX-gen [Trj] 20181111
AVG Win32:MalwareX-gen [Trj] 20181111
BitDefender Trojan.GenericKD.40657863 20181111
CAT-QuickHeal Trojan.IGENERIC 20181108
CrowdStrike Falcon (ML) malicious_confidence_100% (W) 20181022
Cybereason malicious.aa3fc7 20180225
Cylance Unsafe 20181111
Cyren W32/Emotet.GZRV-5317 20181110
Emsisoft Trojan.Emotet (A) 20181111
Endgame malicious (high confidence) 20181108
ESET-NOD32 a variant of Win32/Kryptik.GMBW 20181111
F-Prot W32/Emotet.WF 20181111
F-Secure Trojan.GenericKD.40657863 20181111
Fortinet W32/GenKryptik.CPHX!tr 20181110
GData Win32.Trojan-Spy.Emotet.TL 20181111
Ikarus Trojan-Banker.Emotet 20181110
Sophos ML heuristic 20181108
K7AntiVirus Trojan ( 0053b6a31 ) 20181110
K7GW Trojan ( 0053b6a31 ) 20181109
Kaspersky Trojan-Banker.Win32.Emotet.blda 20181111
Malwarebytes Trojan.Emotet 20181111
MAX malware (ai score=100) 20181111
McAfee RDN/Generic.dx 20181111
McAfee-GW-Edition BehavesLike.Win32.Emotet.cc 20181110
Microsoft Trojan:Win32/Emotet.AC!bit 20181111
eScan Trojan.GenericKD.40657863 20181110
NANO-Antivirus Trojan.Win32.Emotet.fjsykd 20181111
Palo Alto Networks (Known Signatures) generic.ml 20181111
Panda Trj/Genetic.gen 20181110
Qihoo-360 Win32/Trojan.Multi.c78 20181111
Rising Trojan.Fuerboos!8.EFC8 (CLOUD) 20181110
SentinelOne (Static ML) static engine - malicious 20181011
Sophos AV Mal/EncPk-AOF 20181110
Symantec Trojan.Emotet 20181110
Tencent Win32.Trojan-banker.Emotet.Hvaa 20181111
TrendMicro TSPY_EMOTET.THAOCOAH 20181111
TrendMicro-HouseCall TSPY_EMOTET.THAOCOAH 20181111
Webroot W32.Trojan.Emotet 20181111
Zillya Trojan.Emotet.Win32.6787 20181109
ZoneAlarm by Check Point Trojan-Banker.Win32.Emotet.blda 20181111
AegisLab 20181111
Alibaba 20180921
Arcabit 20181111
Avast-Mobile 20181110
Avira (no cloud) 20181110
Babable 20180918
Baidu 20181109
Bkav 20181110
ClamAV 20181111
CMC 20181110
DrWeb 20181111
Jiangmin 20181111
Kingsoft 20181111
SUPERAntiSpyware 20181107
Symantec Mobile Insight 20181108
TACHYON 20181110
TheHacker 20181108
TotalDefense 20181110
Trustlook 20181111
VBA32 20181109
VIPRE 20181110
ViRobot 20181110
Yandex 20181109
Zoner 20181111
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (c) 2001

Product Sola Plug-in
Original name NPJava13.dll
Internal name Aban Plug-in
File version 1, 4, 2, 50
Description Aban Plug-in 1.4.2_05 for Netscape Navigator (DLL Helper)
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2018-10-29 03:00:16
Entry Point 0x000014F9
Number of sections 6
PE sections
PE imports
[+] ADVAPI32.dll
OpenSCManagerW
[+] CFGMGR32.dll
CM_Get_Child
CM_Query_Resource_Conflict_List
[+] COMDLG32.dll
ChooseFontW
GetSaveFileNameW
[+] CRYPT32.dll
CryptRegisterDefaultOIDFunction
CertCompareCertificate
PFXImportCertStore
CryptImportPublicKeyInfo
CryptMsgVerifyCountersignatureEncoded
[+] ESENT.dll
JetSetIndexRange
[+] GDI32.dll
GetCurrentObject
GetSystemPaletteEntries
SetDCPenColor
MoveToEx
SetColorSpace
SetICMMode
SetBkColor
[+] KERNEL32.dll
GetTempFileNameW
GetNativeSystemInfo
GlobalGetAtomNameW
GetLargePageMinimum
InterlockedPushEntrySList
GetModuleFileNameW
WritePrivateProfileSectionW
GlobalAlloc
GetProcessPriorityBoost
SetConsoleTitleA
GetConsoleTitleW
GetSystemTimeAsFileTime
GetCommandLineA
GetDynamicTimeZoneInformation
FindFirstFileNameTransactedW
GetCommState
Process32FirstW
[+] MPRAPI.dll
MprAdminMIBEntryGetFirst
[+] MSACM32.dll
acmFormatEnumW
[+] RASAPI32.dll
RasGetConnectStatusA
[+] RPCRT4.dll
RpcNetworkIsProtseqValidA
RpcBindingSetOption
[+] SETUPAPI.dll
SetupDiSetDeviceRegistryPropertyW
[+] SHELL32.dll
CommandLineToArgvW
[+] SHLWAPI.dll
SHCreateStreamOnFileW
[+] USER32.dll
ToUnicodeEx
GetListBoxInfo
HiliteMenuItem
IsWindow
GetRegisteredRawInputDevices
GetLastActivePopup
SendMessageCallbackA
IsCharLowerA
DrawIcon
WaitForInputIdle
SetRectEmpty
GetDesktopWindow
SetWindowsHookExW
OemToCharW
DestroyWindow
[+] VERSION.dll
GetFileVersionInfoW
VerQueryValueA
[+] WINMM.dll
midiStreamPosition
waveOutSetPitch
midiOutReset
midiInGetDevCapsA
waveOutGetNumDevs
[+] WINSPOOL.DRV
FreePrinterNotifyInfo
[+] WINTRUST.dll
WintrustSetRegPolicyFlags
CryptCATCDFEnumMembers
[+] WinSCard.dll
SCardEndTransaction
[+] ole32.dll
OleMetafilePictFromIconAndLabel
OleSaveToStream
PropVariantCopy
StgOpenStorage
[+] urlmon.dll
HlinkSimpleNavigateToString
Number of PE resources by type
RT_DIALOG 20
RT_STRING 10
RT_VERSION 1
Number of PE resources by language
ENGLISH US 4
ITALIAN NEUTRAL 3
SWEDISH NEUTRAL 3
CHINESE TRADITIONAL 3
SPANISH NEUTRAL 3
GERMAN NEUTRAL 3
CHINESE SIMPLIFIED 3
JAPANESE DEFAULT 3
FRENCH NEUTRAL 3
KOREAN 3
PE resources
Debug information
ExifTool file metadata
UninitializedDataSize
0

InitializedDataSize
131072

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
1.4.2.50

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

FileDescription
Aban Plug-in 1.4.2_05 for Netscape Navigator (DLL Helper)

ImageFileCharacteristics
No relocs, Executable, 32-bit

CharacterSet
Windows, Latin1

LinkerVersion
12.0

EntryPoint
0x14f9

OriginalFileName
NPJava13.dll

MIMEType
application/x-java-applet;version=1.3.1|application/x-java-bean;version=1.3.1|application/x-java-applet;version=1.4|application/x-java-bean;version=1.4|application/x-java-applet;version=1.4.1|application/x-java-bean;version=1.4.1

LegalCopyright
Copyright (c) 2001

FileExtents
|||||

FileOpenName
Aban Applet|JavaBeans|Sola Applet|SolaBeans|Sola Applet|SolaBeans

FileVersion
1, 4, 2, 50

TimeStamp
2018:10:29 04:00:16+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
Aban Plug-in

ProductVersion
1, 4, 2, 50

SubsystemVersion
5.0

OSVersion
5.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
AbanSoft / Sun Microsystems, Inc.

CodeSize
8192

ProductName
Sola Plug-in

ProductVersionNumber
1.4.2.50

FileTypeExtension
exe

ObjectFileType
Dynamic link library

File identification
MD5 2cccdc7aa3fc7137486f03db735cb145
SHA1 b0707a6bed1c54a0c8b010eedf98d97e28ef72a2
SHA256 90eb88ce602a38df8e27e05e5bb4198a2fd22b635e5de49dab18abacb6e3a683
ssdeep
1536:QZzfhw5xicj4hkVFc8sTrX1YwI1MHpCYMk8O8SU/aDBKsdtwlBnacuC0MwpRc/i:A7hmH4AKYwRtMk4jaV7wHacuXzRc/i

authentihash 2d20361aebc65256c3d52380d895b3ff1f2574b4328c00f18c453ebf4f6ae228
imphash 9282994e02db32b77d2814d81a61ad91
File size 140.0 KB ( 143360 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Windows screen saver (43.3%)
Win32 Dynamic Link Library (generic) (21.7%)
Win32 Executable (generic) (14.9%)
OS/2 Executable (generic) (6.7%)
Generic Win/DOS Executable (6.6%)
Tags
peexe

VirusTotal metadata
First submission 2018-10-29 03:11:05 UTC ( 3 months, 3 weeks ago )
Last submission 2018-10-29 03:11:05 UTC ( 3 months, 3 weeks ago )
File names NPJava13.dll
Aban Plug-in
cwwkj0IdJzegN77.exe
Advanced heuristic and reputation engines
F-Secure Deepguard Suspicious:W32/Malware!Online
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!
More comments

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

Sign in Join the community
No votes. No one has voted on this item yet, be the first one to do so!
More votes
Blog | Twitter | Contact us | ToS | Privacy policy