Antivirus scan for a376351dcb6694679c423b81a48181e76b314a819b4e0b31fd49f5a1b4f6dea1 at 2018-05-31 12:23:41 UTC

Antivirus	Result	Update
Ad-Aware	Gen:Variant.Razy.336191	20180531
AhnLab-V3	Trojan/Win32.Emotet.R229188	20180531
ALYac	Gen:Variant.Razy.336191	20180531
Arcabit	Trojan.Razy.D5213F	20180531
Avast	Win32:GenX	20180531
AVG	Win32:GenX	20180531
Avira (no cloud)	TR/Crypt.XPACK.Gen	20180531
Cylance	Unsafe	20180531
Emsisoft	Gen:Variant.Razy.336191 (B)	20180531
Endgame	malicious (high confidence)	20180507
ESET-NOD32	a variant of Win32/Kryptik.GHDT	20180531
F-Secure	Gen:Variant.Razy.336191	20180531
Fortinet	W32/Kryptik.GHDT!tr	20180531
Sophos ML	heuristic	20180503
Kaspersky	Trojan-Banker.Win32.Emotet.apss	20180531
Malwarebytes	Trojan.Emotet	20180531
MAX	malware (ai score=80)	20180531
McAfee	Emotet-FHK!5B9645ECF754	20180530
McAfee-GW-Edition	Emotet-FHK!5B9645ECF754	20180531
Microsoft	Trojan:Win32/Cloxer.D!cl	20180531
eScan	Gen:Variant.Razy.336191	20180531
Qihoo-360	HEUR/QVM20.1.87D5.Malware.Gen	20180531
Sophos AV	Mal/EncPk-ANX	20180531
Symantec	ML.Attribute.HighConfidence	20180531
TrendMicro	TSPY_HPEMOTET.SMAL8	20180531
TrendMicro-HouseCall	TSPY_HPEMOTET.SMAL8	20180531
VBA32	BScope.Trojan.Agent	20180531
Webroot	W32.Trojan.Emotet	20180531
ZoneAlarm by Check Point	Trojan-Banker.Win32.Emotet.apss	20180531
AegisLab		20180531
Alibaba		20180530
Antiy-AVL		20180531
Avast-Mobile		20180531
AVware		20180531
BitDefender		20180531
Bkav		20180531
CAT-QuickHeal		20180531
ClamAV		20180531
CMC		20180529
Comodo		20180531
CrowdStrike Falcon (ML)		20180202
Cybereason		None
Cyren		20180531
DrWeb		20180531
eGambit		20180531
F-Prot		20180531
GData		20180531
Ikarus		20180531
Jiangmin		20180531
K7AntiVirus		20180530
K7GW		20180531
Kingsoft		20180531
NANO-Antivirus		20180531
nProtect		20180531
Palo Alto Networks (Known Signatures)		20180531
Panda		20180530
Rising		20180531
SentinelOne (Static ML)		20180225
SUPERAntiSpyware		20180531
Symantec Mobile Insight		20180525
Tencent		20180531
TheHacker		20180531
TotalDefense		20180531
Trustlook		20180531
VIPRE		20180531
ViRobot		20180531
Yandex		20180529
Zillya		20180530
Zoner		20180530

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2018-05-28 11:15:16

Entry Point 0x00001479

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 8616 12288 4.94 6a2fc5f646e6745fd6472690d9786b8c

.rdata 16384 104096 106496 6.69 3d32d7ba4843997f21f48151a4ef2f46

.data 122880 34560 32768 3.92 4b539b29c1489f50c8fdb55aba2b10ea

.rsrc 159744 6432 8192 2.80 6c1dbb47c2b2617586393e1fd5a0d2a3

.reloc 167936 7552 8192 5.82 71df222e9a1c046b0845f0fdc1d1260d

PE imports

Number of PE resources by type

RT_STRING 6

RT_DIALOG 1

Number of PE resources by language

NEUTRAL 7

PE resources

04429e1602376b17c0d657437837396d540c24ad6285f3b750333eef28a9491a ASCII text

4127919034cf833f80fb4a27503640533f9ea37b85745cffb666a58f199af3d5 ASCII text

57b550be22e41c9006898353bb0d57195cfa0a9e46f29f69ce6bd4b14aedbc51 data

8ef2cb11605de3baa89af09944c73fcc81235c1c684fb99c47c81d7add8b88a0 ASCII text

8f330d0d77ea9fcc6276a096a251a1192c52401cf0e9dda8ae4edac519c2947d ASCII text

f19acd5a46d79a6ca568d722316468fb040a66b94e6bbdf55363e9e4aaff6d4f ASCII text

fc44d52b5339bd88e2a4a651e5b1537c4b28eefd6735875e2152b10b9d83b739 ASCII text

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2018:05:28 12:15:16+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

12288

LinkerVersion

15.0

EntryPoint

0x1479

InitializedDataSize

SubsystemVersion

5.0

ImageVersion

0.0

OSVersion

5.0

UninitializedDataSize

135168

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

0fde18bcc6e5925ba0d8fffa61885c123bd6b2f338fed21868666bea533ccf82

File identification

MD5 5b9645ecf754a6a35b718a1318d2bcf3

SHA1 1b3a39ef782760f1fde3800860105ffc02745475

SHA256 a376351dcb6694679c423b81a48181e76b314a819b4e0b31fd49f5a1b4f6dea1

ssdeep

3072:ESOxCROUhJPJkjGzwNESit3DrCAjikZpu88qjcWkiFJOVkl5X4:ES/OU3Tsvi1/FrZpuhSOe

authentihash 0bc329ec33986686f6e034271aaebe8d1a119de2b075db9dda6341059224151b

imphash bed8be83c53ea02640ac238fae46ada4

File size 168.0 KB ( 172032 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (38.4%) Win32 Executable (generic) (26.3%) OS/2 Executable (generic) (11.8%) Generic Win/DOS Executable (11.6%) DOS Executable Generic (11.6%)

VirusTotal metadata

First submission 2018-05-31 12:23:41 UTC ( 8 months, 2 weeks ago )

Last submission 2018-05-31 12:23:41 UTC ( 8 months, 2 weeks ago )

File names

7582.TMP

SHA256:	a376351dcb6694679c423b81a48181e76b314a819b4e0b31fd49f5a1b4f6dea1
File name:	7582.TMP
Detection ratio:	29 / 64
Analysis date:	2018-05-31 12:23:41 UTC ( 8 months, 2 weeks ago )

Ciphered bundle