| SHA256: | 912bb57cfb1aaa1d57bca0dffa9c6ecedadfdf2fe9ee830abfa19ffe0db447cb |
| File name: | f87d940f8bc924af5bdc7639e3407a3a01e5381b |
| Detection ratio: | 38 / 54 |
| Analysis date: | 2014-12-09 10:15:35 UTC ( 4 years, 2 months ago ) |
| Antivirus | Result | Update |
|---|---|---|
| Ad-Aware | Trojan.GenericKD.1644534 | 20141209 |
| AhnLab-V3 | Trojan/Win32.Zbot | 20141209 |
| ALYac | Trojan.GenericKD.1644534 | 20141209 |
| Avast | AutoIt:Agent-AIS [Trj] | 20141209 |
| AVG | Autoit | 20141209 |
| Avira (no cloud) | TR/Llac.dcrjx | 20141209 |
| Baidu-International | Trojan.Win32.Zbot.AAO | 20141209 |
| BitDefender | Trojan.GenericKD.1644534 | 20141209 |
| CAT-QuickHeal | TrojanPWS.AutoIt.Zbot.A | 20141209 |
| CMC | Trojan.Win32.Generic!O | 20141208 |
| Comodo | TrojWare.Win32.UMal.~A | 20141209 |
| Cyren | W32/GenBl.E1C87ED8!Olympus | 20141209 |
| DrWeb | Trojan.PWS.Panda.655 | 20141209 |
| ESET-NOD32 | Win32/Spy.Zbot.AAO | 20141209 |
| F-Secure | Trojan.GenericKD.1644534 | 20141209 |
| Fortinet | W32/Injector_Autoit.AGT!tr | 20141209 |
| GData | Trojan.GenericKD.1644534 | 20141209 |
| Ikarus | Trojan.Autoit | 20141209 |
| K7AntiVirus | Spyware ( 004abbe21 ) | 20141208 |
| K7GW | Spyware ( 004abbe21 ) | 20141208 |
| Kaspersky | Trojan.Win32.Buzus.omtc | 20141209 |
| Malwarebytes | Spyware.Zbot.AI | 20141209 |
| McAfee | Artemis!E1C87ED85E9B | 20141209 |
| McAfee-GW-Edition | BehavesLike.Win32.Dropper.tc | 20141208 |
| Microsoft | PWS:Win32/Zbot | 20141209 |
| eScan | Trojan.GenericKD.1644534 | 20141209 |
| NANO-Antivirus | Trojan.Script.Autoit.debvkc | 20141209 |
| Norman | Troj_Generic.TOOOT | 20141209 |
| nProtect | Trojan.GenericKD.1644534 | 20141209 |
| Panda | Trj/CI.A | 20141209 |
| Qihoo-360 | Win32/Trojan.2a0 | 20141209 |
| Sophos AV | Troj/AutoIt-AJR | 20141209 |
| Symantec | WS.Reputation.1 | 20141209 |
| Tencent | Win32.Trojan.Buzus.Akey | 20141209 |
| TrendMicro | TROJ_SPNV.01DJ14 | 20141209 |
| TrendMicro-HouseCall | TROJ_SPNV.01DJ14 | 20141209 |
| VBA32 | Backdoor.Autoit.RAT | 20141209 |
| VIPRE | Trojan.Win32.Generic!BT | 20141209 |
| AegisLab | 20141209 | |
| Yandex | 20141208 | |
| Antiy-AVL | 20141209 | |
| Bkav | 20141209 | |
| ByteHero | 20141209 | |
| ClamAV | 20141209 | |
| F-Prot | 20141209 | |
| Jiangmin | 20141208 | |
| Kingsoft | 20141209 | |
| Rising | 20141208 | |
| SUPERAntiSpyware | 20141209 | |
| TheHacker | 20141208 | |
| TotalDefense | 20141208 | |
| ViRobot | 20141208 | |
| Zillya | 20141209 | |
| Zoner | 20141208 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Publisher 71720563AA
File version 3, 3, 8, 1
Signature verification
A certificate chain could not be built to a trusted root authority.
Packers identified
F-PROT AutoIt, UTF-8
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2012-01-29 21:32:28
Entry Point 0x000165C1
Number of sections 4
PE sections
PE imports
Number of PE resources by type
RT_ICON 12
RT_STRING 7
RT_GROUP_ICON 4
RT_DIALOG 1
RT_MANIFEST 1
RT_MENU 1
RT_VERSION 1
Number of PE resources by language
ENGLISH UK 25
ENGLISH US 2
PE resources
ExifTool file metadata
UninitializedDataSize
0
InitializedDataSize
121856
ImageVersion
0.0
FileVersionNumber
3.3.8.1
LanguageCode
English (British)
FileFlagsMask
0x0017
CharacterSet
Unicode
LinkerVersion
10.0
MIMEType
application/octet-stream
FileVersion
3, 3, 8, 1
TimeStamp
2012:01:29 22:32:28+01:00
FileType
Win32 EXE
PEType
PE32
FileAccessDate
2014:12:09 12:01:19+01:00
SubsystemVersion
5.0
OSVersion
5.0
FileCreateDate
2014:12:09 12:01:19+01:00
FileOS
Win32
Subsystem
Windows GUI
CompiledScript
AutoIt v3 Script: 3, 3, 8, 1
MachineType
Intel 386 or later, and compatibles
CodeSize
526336
FileSubtype
0
ProductVersionNumber
3.3.8.1
EntryPoint
0x165c1
ObjectFileType
Unknown
File identification
MD5 e1c87ed85e9b0f2d9b2691ef14f59c2f
SHA1 51a3e59475693228b90f8133417d47ca2d235816
SHA256 912bb57cfb1aaa1d57bca0dffa9c6ecedadfdf2fe9ee830abfa19ffe0db447cb
ssdeep
24576:yRmJkcoQricOIQxiZY1iaC5FZ6oQ13FBP71uJD0c1lWjuHyJEgAyYBMPm0:nJZoQrbTFZY1iaC5FQoQJFxZcD0slWLt
File size
1.2 MB ( 1289808 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable MS Visual C++ (generic) (67.3%) Win32 Dynamic Link Library (generic) (14.2%) Win32 Executable (generic) (9.7%) Generic Win/DOS Executable (4.3%) DOS Executable Generic (4.3%) |
Tags
peexe
VirusTotal metadata
First submission
2014-04-16 17:41:04 UTC ( 4 years, 10 months ago )
Last submission
2014-04-19 00:52:08 UTC ( 4 years, 10 months ago )
| File names |
uk.exe E1C87ED85E9B0F2D9B2691EF14F59C2F.ViR aa EaOSN.pps 51a3e59475693228b90f8133417d47ca2d235816 f87d940f8bc924af5bdc7639e3407a3a01e5381b 25169949 |
Advanced heuristic and reputation engines
F-Secure Deepguard
Suspicious:W32/Malware!Online
Symantec reputation
Suspicious.Insight
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Created processes
Code injections in the following processes
Opened mutexes
Runtime DLLs
Additional details
The file uses the
IsDebuggerPresent Windows API function in order to see whether it is being debugged.
The file sends control codes directly to certain device drivers making use of the
DeviceIoControl
Windows API function.