Antivirus scan for b3e268d9e7c093dac6a90e12d53679351566ce914ff984254142f0465da7df19 at 2018-07-17 17:50:10 UTC

Antivirus	Result	Update
Ad-Aware	Gen:Variant.Razy.364297	20180717
AegisLab	Gen.Variant.Graftor!c	20180717
ALYac	Trojan.Agent.Emotet	20180717
Antiy-AVL	Trojan/Win32.Fuerboos	20180717
Arcabit	Trojan.Razy.D58F09	20180717
Avast	Win32:Malware-gen	20180717
AVG	Win32:Malware-gen	20180717
Avira (no cloud)	TR/Crypt.Agent.fxkqm	20180717
BitDefender	Gen:Variant.Razy.364297	20180717
Comodo	.UnclassifiedMalware	20180717
CrowdStrike Falcon (ML)	malicious_confidence_100% (W)	20180530
Cybereason	malicious.7852aa	20180225
Cylance	Unsafe	20180717
Cyren	W32/Trojan.RKFI-3868	20180717
Emsisoft	Gen:Variant.Razy.364297 (B)	20180717
Endgame	malicious (high confidence)	20180711
ESET-NOD32	a variant of Win32/Kryptik.GIVD	20180717
Fortinet	W32/EMOTET.SMZD35!tr	20180717
GData	Gen:Variant.Razy.364297	20180717
Ikarus	Trojan-Banker.Emotet	20180717
Sophos ML	heuristic	20180717
K7AntiVirus	Trojan ( 00537d371 )	20180717
K7GW	Trojan ( 00537d371 )	20180717
Kaspersky	Trojan.Win32.Dovs.phx	20180717
Malwarebytes	Spyware.Emotet	20180717
MAX	malware (ai score=98)	20180717
McAfee	Emotet-FHK!95E08AE7852A	20180717
McAfee-GW-Edition	BehavesLike.Win32.Generic.dm	20180717
Microsoft	Trojan:Win32/Emotet.AC!bit	20180717
eScan	Gen:Variant.Razy.364297	20180717
Palo Alto Networks (Known Signatures)	generic.ml	20180717
Panda	Trj/Genetic.gen	20180717
Qihoo-360	Win32/Trojan.32b	20180717
Rising	Trojan.Emotet!8.B95 (TFE:dGZlOgFH7BQRi+Js0g)	20180717
SentinelOne (Static ML)	static engine - malicious	20180701
Sophos AV	Mal/EncPk-ANX	20180717
Symantec	Trojan.Emotet	20180717
TrendMicro	TSPY_EMOTET.SMZD35	20180717
TrendMicro-HouseCall	TSPY_EMOTET.SMZD35	20180717
VBA32	BScope.Trojan.MTA.0230	20180717
ViRobot	Trojan.Win32.Z.Graftor.209920	20180717
Webroot	W32.Trojan.Emotet	20180717
ZoneAlarm by Check Point	Trojan.Win32.Dovs.phx	20180717
AhnLab-V3		20180717
Alibaba		20180713
Avast-Mobile		20180717
AVware		20180717
Babable		20180406
Baidu		20180717
Bkav		20180717
CAT-QuickHeal		20180717
ClamAV		20180717
CMC		20180716
DrWeb		20180717
eGambit		20180717
F-Prot		20180717
F-Secure		20180717
Jiangmin		20180717
Kingsoft		20180717
NANO-Antivirus		20180717
SUPERAntiSpyware		20180717
TACHYON		20180717
Tencent		20180717
TheHacker		20180716
TotalDefense		20180717
Trustlook		20180717
VIPRE		20180717
Yandex		20180717
Zillya		20180717
Zoner		20180717

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2009-09-30 17:12:08

Entry Point 0x00001898

Number of sections 7

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 11032 11264 6.15 7498a3670a87d90b93e96d1976560e57

.rdata 16384 9562 9728 4.35 532667f3cd93328184e16d4672e8a581

.data 28672 82500 78848 1.60 41f42280fea7a036d5d6c731560dc85a

CODE 114688 60376 60416 7.44 1529aeddef1cf889e15777b36eddd5bb

.CRT 176128 28415 28672 7.52 3ecac8008f6bdb6795def7255d280570

.rsrc 204800 15992 16384 3.86 013fc781898bd8f88e17ad36f93fb3f9

.reloc 221184 3488 3584 5.91 ac9c01cbc9d37c6d50c05a265c2b8163

PE imports

[+] GDI32.dll

[+] KERNEL32.dll

[+] USER32.dll

Number of PE resources by type

RT_BITMAP 16

RT_STRING 16

RT_DIALOG 1

Number of PE resources by language

NEUTRAL 32

CHINESE SIMPLIFIED 1

PE resources

0d3137dd56cde6d3d1fd0a6e4aa514928ce0eb20cd0a43fdb18ab8cd0bf63b9f ASCII text

0f5248f16fe2b1e73aa9be760a6f0bef933dc09e3cc6d8a8958eae1ce0bd0f97 data

1393255f51eb7f6ba1846c66ef93761f14661368eba6f110d2e34903e3653d2e ASCII text

17b07efdaa0a29047984ccc097bbbe258ffcb76dad8ea803f14e5473ec77791c ASCII text

2cb60d7d674640457497f54b82b42afaa8a2cbd7c28a1aae35f128b4471cfaaa data

2eb32b22864492284e8e79498562d10f3ea89ea7bda27ee58b7960e8810e8ce8 ASCII text

369c5223029ea6d1b17b7f24a8d84c10f528457e79be3349a6c55efd0e8f0e02 ASCII text

3a0969803f248355c08a55fb93099ab7616142cd95b50750d3d0fb461e319448 ASCII text

3cf8dd24fcb6e2b44ee8af90436ccf5ff6876969031ee19d62ca7b6040b9675a ASCII text

4a217ca811d9c29363ead1d67b7ffa0f6e8b8e1d1a068730f4f7d557c3710b44 data

Debug information

Type Timestamp Offset Size

3402287818 (3402287818) Sun Oct 24 07:56:58 2077 4189389210 2315307722 Bytes

2218668493 (2218668493) Sun Feb 15 01:52:12 1998 1649752592 1132766635 Bytes

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2009:09:30 18:12:08+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

11264

LinkerVersion

14.0

ImageFileCharacteristics

Executable, 32-bit

EntryPoint

0x1898

InitializedDataSize

201728

SubsystemVersion

5.1

ImageVersion

0.0

OSVersion

5.0

UninitializedDataSize

File identification

MD5 95e08ae7852aaaf35e2a85715e0c89ba

SHA1 65c03f4cc45b2aaa15f9d7a9d807db548939d09d

SHA256 b3e268d9e7c093dac6a90e12d53679351566ce914ff984254142f0465da7df19

ssdeep

1536:wUuy/C6N0FZEBXq1TlStHccXN5hVnw9rOa0EMTJIbaiwuWjN9i5HCMS7UUVheBnZ:z/CuXZBFNVQv0EMWalfiwMS7teX92py

authentihash 579afba248e0d888f46d590691d9c151802221c1accb718052502aab76824ede

imphash c8840b453c67f40d940059fab0dea0ca

File size 205.0 KB ( 209920 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (38.4%) Win32 Executable (generic) (26.3%) OS/2 Executable (generic) (11.8%) Generic Win/DOS Executable (11.6%) DOS Executable Generic (11.6%)

VirusTotal metadata

First submission 2018-07-16 15:11:18 UTC ( 7 months, 1 week ago )

Last submission 2018-07-16 15:11:18 UTC ( 7 months, 1 week ago )

File names

2875.exe
4122.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\b3e268d9e7c093dac6a90e12d53679351566ce914ff984254142f0465da7df19 (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\system32\winsock.dll (successful)

C:\WINDOWS\system32\drwtsn32.exe (successful)

C:\WINDOWS\system32\netmsg.dll (successful)

Read files

C:\WINDOWS\system32\winsock.dll (successful)

Created processes

C:\WINDOWS\system32\drwtsn32 -p 372 -e 168 -g (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

rpcrt4.dll (successful)

shlwapi.dll (successful)

version.dll (successful)

shell32.dll (successful)

advapi32.dll (successful)

ntdll.dll (successful)

kernel32.dll (successful)

SHA256:	b3e268d9e7c093dac6a90e12d53679351566ce914ff984254142f0465da7df19
File name:	2875.exe
Detection ratio:	43 / 68
Analysis date:	2018-07-17 17:50:10 UTC ( 7 months, 1 week ago ) View latest

Ciphered bundle