| SHA256: | 96f821789d900b0a718abb8236ceff36bc73084eabd2bcd4f9c207a5d225ef25 |
| File name: | 358927 |
| Detection ratio: | 1 / 58 |
| Analysis date: | 2016-03-27 03:41:04 UTC ( 2 years, 11 months ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| TheHacker | Backdoor/ProRat.ijy | 20160325 |
| Ad-Aware | 20160326 | |
| AegisLab | 20160327 | |
| Yandex | 20160316 | |
| AhnLab-V3 | 20160326 | |
| Alibaba | 20160323 | |
| ALYac | 20160327 | |
| Antiy-AVL | 20160327 | |
| Arcabit | 20160326 | |
| Avast | 20160327 | |
| AVG | 20160327 | |
| Avira (no cloud) | 20160326 | |
| AVware | 20160327 | |
| Baidu | 20160325 | |
| Baidu-International | 20160326 | |
| BitDefender | 20160327 | |
| Bkav | 20160327 | |
| ByteHero | 20160327 | |
| CAT-QuickHeal | 20160326 | |
| ClamAV | 20160326 | |
| CMC | 20160322 | |
| Comodo | 20160327 | |
| Cyren | 20160327 | |
| DrWeb | 20160327 | |
| Emsisoft | 20160327 | |
| ESET-NOD32 | 20160327 | |
| F-Prot | 20160327 | |
| F-Secure | 20160327 | |
| Fortinet | 20160327 | |
| GData | 20160327 | |
| Ikarus | 20160326 | |
| Jiangmin | 20160327 | |
| K7AntiVirus | 20160326 | |
| K7GW | 20160323 | |
| Kaspersky | 20160327 | |
| Kingsoft | 20160327 | |
| Malwarebytes | 20160327 | |
| McAfee | 20160327 | |
| McAfee-GW-Edition | 20160327 | |
| Microsoft | 20160327 | |
| eScan | 20160327 | |
| NANO-Antivirus | 20160327 | |
| nProtect | 20160325 | |
| Panda | 20160326 | |
| Qihoo-360 | 20160327 | |
| Rising | 20160327 | |
| Sophos AV | 20160327 | |
| SUPERAntiSpyware | 20160326 | |
| Symantec | 20160327 | |
| Tencent | 20160327 | |
| TotalDefense | 20160327 | |
| TrendMicro | 20160327 | |
| TrendMicro-HouseCall | 20160327 | |
| VBA32 | 20160326 | |
| VIPRE | 20160326 | |
| ViRobot | 20160327 | |
| Zillya | 20160326 | |
| Zoner | 20160327 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
All rights reserved
File version 1.0.0.6
Description DerivativeCalculatorReal45 Installation
Comments This installation was built with InstallAware: http://www.installaware.com
Packers identified
F-PROT 7Z
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2007-07-05 21:17:36
Entry Point 0x0001253D
Number of sections 4
PE sections
Overlays
MD5 b5203491a9db32867634ad9bc412574e
File type data
Offset 229888
Size 1158362
Entropy 8.00
PE imports
Number of PE resources by type
RT_STRING 105
RT_ICON 6
RT_DIALOG 2
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 12
HEBREW DEFAULT 3
SWEDISH 3
LATVIAN DEFAULT 3
VIETNAMESE DEFAULT 3
ESTONIAN DEFAULT 3
LITHUANIAN 3
FRENCH 3
CHINESE SIMPLIFIED 3
SLOVENIAN DEFAULT 3
DUTCH 3
PORTUGUESE 3
ITALIAN 3
CATALAN DEFAULT 3
PORTUGUESE BRAZILIAN 3
FINNISH DEFAULT 3
KOREAN 3
CZECH DEFAULT 3
BASQUE DEFAULT 3
HUNGARIAN DEFAULT 3
GERMAN 3
POLISH DEFAULT 3
JAPANESE DEFAULT 3
DANISH DEFAULT 3
SLOVAK DEFAULT 3
GREEK DEFAULT 3
TURKISH DEFAULT 3
NORWEGIAN BOKMAL 3
CHINESE TRADITIONAL 3
THAI DEFAULT 3
SERBIAN DEFAULT 3
ARABIC SAUDI ARABIA 3
SPANISH MODERN 3
ROMANIAN 3
RUSSIAN 3
NEUTRAL 2
PE resources
ExifTool file metadata
UninitializedDataSize
0
Comments
This installation was built with InstallAware: http://www.installaware.com
InitializedDataSize
131072
ImageVersion
0.0
FileVersionNumber
1.0.0.6
LanguageCode
English (U.S.)
FileFlagsMask
0x003f
ImageFileCharacteristics
No relocs, Executable, No line numbers, No symbols, 32-bit
CharacterSet
Windows, Latin1
LinkerVersion
7.1
FileTypeExtension
exe
MIMEType
application/octet-stream
TimeStamp
2007:07:05 22:17:36+01:00
FileType
Win32 EXE
PEType
PE32
SubsystemVersion
4.0
OSVersion
4.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CodeSize
97792
FileSubtype
0
ProductVersionNumber
0.0.0.0
EntryPoint
0x1253d
ObjectFileType
Executable application
File identification
MD5 3be4913888e327207376ac39fefea64c
SHA1 ab103a1794ec79c5e03eb4f20a9fc6f63ba68494
SHA256 96f821789d900b0a718abb8236ceff36bc73084eabd2bcd4f9c207a5d225ef25
ssdeep
24576:mg3Hg8/qAR0oHYc7cZFjSmOiUobpfw6HNZmQGXqTKNKNwAA5w+K1iqgA:mg3HgeTU9XhjuCN4qTKUNwAR+KEZA
File size
1.3 MB ( 1388250 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable MS Visual C++ (generic) (44.9%) Win64 Executable (generic) (39.8%) Win32 Executable (generic) (6.4%) OS/2 Executable (generic) (2.9%) Generic Win/DOS Executable (2.8%) |
Tags
peexe
overlay
VirusTotal metadata
First submission
2013-05-10 19:41:45 UTC ( 5 years, 9 months ago )
Last submission
2018-05-17 00:11:13 UTC ( 9 months, 1 week ago )
| File names |
96F821789D900B0A718ABB8236CEFF36BC73084EABD2BCD4F9C207A5D225EF25.exe 96f821789d900b0a718abb8236ceff36bc73084eabd2bcd4f9c207a5d225ef25 DerivativeCalculatorReal45.exe 358927 DerivativeCalculatorReal45.exe 96F821789D900B0A718ABB8236CEFF36BC73084EABD2BCD4F9C207A5D225EF25 96F821789D900B0A718ABB8236CEFF36BC73084EABD2BCD4F9C207A5D225EF25.exe |
Advanced heuristic and reputation engines
ClamAV
Possibly Unwanted Application. While not necessarily malicious, the
scanned file presents certain characteristics which depending on the
user policies and environment may or may not represent a threat. For
full details see:
https://www.clamav.net/documents/potentially-unwanted-applications-pua
.
Symantec reputation
Suspicious.Insight
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.