| SHA256: | b2ab87d5408a19b0d65d49b74c0f3d879ac55c3e57117e4117ff500394e2ad17 |
| File name: | 1.exe |
| Detection ratio: | 40 / 67 |
| Analysis date: | 2018-11-16 00:53:03 UTC ( 3 months ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| AegisLab | Trojan.Win32.TeamBot.4!c | 20181115 |
| AhnLab-V3 | Malware/Gen.Generic.C2614188 | 20181115 |
| ALYac | Trojan.Agent.TeamBot | 20181115 |
| Arcabit | Trojan.Agent.DHIL | 20181115 |
| Avast | Win32:Trojan-gen | 20181116 |
| AVG | Win32:Trojan-gen | 20181115 |
| Avira (no cloud) | TR/Crypt.XPACK.Gen | 20181115 |
| BitDefender | Trojan.Agent.DHIL | 20181115 |
| CAT-QuickHeal | Trojan.IGENERIC | 20181115 |
| CrowdStrike Falcon (ML) | malicious_confidence_80% (W) | 20181022 |
| Cyren | W32/Trojan.ZKYX-7979 | 20181115 |
| DrWeb | Trojan.MulDrop8.56077 | 20181115 |
| Emsisoft | Trojan.Agent.DHIL (B) | 20181115 |
| ESET-NOD32 | a variant of Win32/Packed.Themida.AYX | 20181115 |
| F-Secure | Trojan.Agent.DHIL | 20181115 |
| Fortinet | W32/TeamBot.HV!tr.bdr | 20181116 |
| GData | Trojan.Agent.DHIL | 20181115 |
| Ikarus | Trojan.Crypt | 20181115 |
| Sophos ML | heuristic | 20181108 |
| K7AntiVirus | Riskware ( 0040eff71 ) | 20181113 |
| K7GW | Riskware ( 0040eff71 ) | 20181115 |
| Kaspersky | Backdoor.Win32.TeamBot.hv | 20181115 |
| Malwarebytes | Trojan.Dropper.SFX | 20181115 |
| McAfee | Artemis!E1167CB7F373 | 20181115 |
| McAfee-GW-Edition | BehavesLike.Win32.AdwareLinkury.wc | 20181115 |
| Microsoft | Trojan:Win32/Zpevdo.A | 20181115 |
| eScan | Trojan.Agent.DHIL | 20181116 |
| NANO-Antivirus | Trojan.Win32.TeamBot.ffgzlo | 20181116 |
| Palo Alto Networks (Known Signatures) | generic.ml | 20181116 |
| Panda | Trj/CI.A | 20181115 |
| Qihoo-360 | Win32/Backdoor.BO.981 | 20181116 |
| Sophos AV | Mal/Generic-S | 20181115 |
| Symantec | Trojan.Gen.2 | 20181115 |
| Tencent | Win32.Backdoor.Teambot.Agao | 20181116 |
| TrendMicro | TROJ_GEN.R002C0WK918 | 20181115 |
| TrendMicro-HouseCall | TROJ_GEN.R002H07JL18 | 20181116 |
| VBA32 | Backdoor.TeamBot | 20181115 |
| VIPRE | Win32.Malware!Drop | None |
| Webroot | W32.Trojan.Gen | 20181116 |
| ZoneAlarm by Check Point | Backdoor.Win32.TeamBot.hv | 20181116 |
| Ad-Aware | 20181116 | |
| Alibaba | 20180921 | |
| Antiy-AVL | 20181115 | |
| Avast-Mobile | 20181115 | |
| Babable | 20180918 | |
| Baidu | 20181115 | |
| Bkav | 20181115 | |
| ClamAV | 20181116 | |
| CMC | 20181115 | |
| Cybereason | 20180225 | |
| Cylance | 20181116 | |
| eGambit | 20181116 | |
| Endgame | 20181108 | |
| F-Prot | 20181116 | |
| Jiangmin | 20181115 | |
| Kingsoft | 20181116 | |
| MAX | 20181116 | |
| Rising | 20181116 | |
| SentinelOne (Static ML) | 20181011 | |
| SUPERAntiSpyware | 20181114 | |
| Symantec Mobile Insight | 20181108 | |
| TACHYON | 20181115 | |
| TheHacker | 20181113 | |
| Trustlook | 20181116 | |
| ViRobot | 20181115 | |
| Yandex | 20181115 | |
| Zillya | 20181115 | |
| Zoner | 20181116 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2017-08-11 13:54:06
Entry Point 0x0001CEC9
Number of sections 6
PE sections
Overlays
MD5 dc79e2eb49ab05a0abb4defcb23f8c27
File type application/x-rar
Offset 259584
Size 3739007
Entropy 8.00
PE imports
Number of PE resources by type
RT_STRING 10
RT_DIALOG 6
RT_ICON 4
RT_MANIFEST 1
RT_BITMAP 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 23
PE resources
Debug information
ExifTool file metadata
MIMEType
application/octet-stream
Subsystem
Windows GUI
SubsystemVersion
5.1
MachineType
Intel 386 or later, and compatibles
TimeStamp
2017:08:11 06:54:06-07:00
FileType
Win32 EXE
PEType
PE32
CodeSize
188928
LinkerVersion
14.0
FileTypeExtension
exe
InitializedDataSize
194560
ImageFileCharacteristics
Executable, 32-bit
EntryPoint
0x1cec9
OSVersion
5.1
ImageVersion
0.0
UninitializedDataSize
0
Execution parents
File identification
MD5 e1167cb7f3735d4edec5f7219cea64ef
SHA1 9b32cbdba2f3f40f2072dbeb61b345c910e45b39
SHA256 b2ab87d5408a19b0d65d49b74c0f3d879ac55c3e57117e4117ff500394e2ad17
ssdeep
98304:SB/mSwJ/stDHmKRai2+DyAEJ9v00FabNuATit4QqKUiqIa4j1yj:SB/m1/Cfe+i9M0oMP//a48j
File size
3.8 MB ( 3998591 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win64 Executable (generic) (61.7%) Win32 Dynamic Link Library (generic) (14.6%) Win32 Executable (generic) (10.0%) OS/2 Executable (generic) (4.5%) Generic Win/DOS Executable (4.4%) |
Tags
peexe
overlay
VirusTotal metadata
First submission
2018-07-12 02:48:01 UTC ( 7 months, 1 week ago )
Last submission
2019-01-26 19:28:14 UTC ( 3 weeks, 4 days ago )
| File names |
1.exe 1.exe output.114388040.txt 4.exe 4.exe 1.exe 4.exe 4.exe 4.exe 1.exe 4.exe 3.exe 4.exe 1.exe 4.exe 4.exe 3.exe 4.exe 4.exe output.114382830.txt 4.exe 4.exe 4.exe 35.exe 1.exe |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.