× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: bb6d53233029a771452e66cb979c4386814658c1237723222bef8a6f211bd287
File name: bb6d53233029a771452e66cb979c4386814658c1237723222bef8a6f211bd287
Detection ratio: 34 / 66
Analysis date: 2019-04-16 06:04:48 UTC ( 1 month, 1 week ago ) View latest
Antivirus Result Update
Acronis suspicious 20190415
Ad-Aware Gen:Variant.Razy.492424 20190416
AegisLab Trojan.Win32.Generic.4!c 20190416
AhnLab-V3 Trojan/Win32.Emotet.C3154289 20190416
Alibaba Packed:Application/TrojanS.8b0a3a8a 20190402
Avast Win32:BankerX-gen [Trj] 20190416
AVG Win32:BankerX-gen [Trj] 20190416
BitDefender Gen:Variant.Graftor.578663 20190416
CrowdStrike Falcon (ML) win/malicious_confidence_90% (W) 20190212
Cybereason malicious.ff0b2b 20190403
Emsisoft Gen:Variant.Graftor.578663 (B) 20190416
Endgame malicious (high confidence) 20190403
FireEye Generic.mg.4ef3b00e145cfb8a 20190416
GData Gen:Variant.Graftor.578663 20190416
Sophos ML heuristic 20190313
K7AntiVirus Trojan ( 0054b5081 ) 20190416
K7GW Trojan ( 0054b5081 ) 20190416
Kaspersky UDS:DangerousObject.Multi.Generic 20190416
MAX malware (ai score=88) 20190416
McAfee Trojan-FQPI!4EF3B00E145C 20190416
McAfee-GW-Edition Artemis 20190416
Microsoft Trojan:Win32/Emotet.AC!bit 20190416
eScan Gen:Variant.Graftor.578663 20190416
Palo Alto Networks (Known Signatures) generic.ml 20190416
Panda Trj/GdSda.A 20190415
Qihoo-360 HEUR/QVM20.1.8E89.Malware.Gen 20190416
Rising Trojan.Emotet!8.B95 (RDM+:cmRtazreCPQE1PbELLerZsrFDNLK) 20190416
SentinelOne (Static ML) DFI - Suspicious PE 20190407
Sophos AV Mal/Emotet-Q 20190416
Trapmine malicious.high.ml.score 20190325
TrendMicro-HouseCall TrojanSpy.Win32.EMOTET.SMTHF 20190416
VBA32 Malware-Cryptor.Kirgudu 20190415
ViRobot Trojan.Win32.Z.Agent.119608.D 20190416
ZoneAlarm by Check Point UDS:DangerousObject.Multi.Generic 20190416
ALYac 20190416
Antiy-AVL 20190416
Arcabit 20190416
Avast-Mobile 20190415
Avira (no cloud) 20190416
Babable 20180918
Baidu 20190318
Bkav 20190412
CAT-QuickHeal 20190415
ClamAV 20190415
CMC 20190321
Comodo 20190416
Cyren 20190416
DrWeb 20190416
eGambit 20190416
ESET-NOD32 20190416
F-Secure 20190416
Fortinet 20190416
Ikarus 20190415
Jiangmin 20190416
Kingsoft 20190416
Malwarebytes 20190416
NANO-Antivirus 20190416
SUPERAntiSpyware 20190410
Symantec Mobile Insight 20190410
TACHYON 20190416
Tencent 20190416
TheHacker 20190411
TotalDefense 20190413
Trustlook 20190416
Yandex 20190415
Zillya 20190415
Zoner 20190416
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (c) 2003-2016 Glarysoft Ltd

Product Glary Utilities
Original name EncryptExe.exe
Internal name EncryptExe.exe
File version 5, 0, 0, 33
Description File Decrypter
Signature verification A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Signing date 10:53 PM 5/15/2019
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2019-04-16 01:01:55
Entry Point 0x00012A90
Number of sections 4
PE sections
Overlays
MD5 99f3d90b27e97808de00601028418053
File type data
Offset 116224
Size 3384
Entropy 7.32
PE imports
RegCreateKeyExW
RegDeleteKeyA
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExA
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueA
RegDeleteKeyW
RegOpenKeyExA
GetEnhMetaFileA
GetObjectA
FillRgn
OffsetViewportOrgEx
BRUSHOBJ_hGetColorTransform
AnyLinkedFonts
SetWindowOrgEx
CLIPOBJ_bEnum
GdiInitSpool
SaveDC
CreateSolidBrush
Escape
GdiIsMetaFileDC
CreateCompatibleDC
GetTextCharacterExtra
SetMagicColors
GetStdHandle
GetConsoleOutputCP
GetFileAttributesA
WaitForSingleObject
FreeEnvironmentStringsA
DeleteCriticalSection
GetCurrentProcess
GetConsoleMode
GetLocaleInfoA
FreeEnvironmentStringsW
SetStdHandle
GetCPInfo
GetStringTypeA
WriteFile
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetExitCodeProcess
FindClose
TlsGetValue
SetLastError
IsDebuggerPresent
ExitProcess
GetModuleFileNameA
GetVolumeInformationA
UnhandledExceptionFilter
InterlockedDecrement
MultiByteToWideChar
CreateMutexA
GetModuleHandleA
CreateThread
SetUnhandledExceptionFilter
SetEnvironmentVariableA
TerminateProcess
WriteConsoleA
GetCurrentThreadId
InterlockedIncrement
WriteConsoleW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
SetHandleCount
LoadLibraryW
GetOEMCP
QueryPerformanceCounter
GetTickCount
TlsAlloc
FlushFileBuffers
LoadLibraryA
RtlUnwind
GetStartupInfoA
DeleteFileA
GetProcAddress
CompareStringW
FindFirstFileA
CompareStringA
FindNextFileA
ExpandEnvironmentStringsA
GetFileType
TlsSetValue
CreateFileA
HeapAlloc
LeaveCriticalSection
GetLastError
LCMapStringW
GetConsoleCP
LCMapStringA
GetEnvironmentStringsW
RemoveDirectoryA
GetEnvironmentStrings
GetCurrentProcessId
WideCharToMultiByte
HeapSize
GetCommandLineA
TlsFree
SetFilePointer
ReadFile
CloseHandle
GetACP
GetModuleHandleW
CreateProcessA
IsValidCodePage
HeapCreate
VirtualFree
Sleep
VirtualAlloc
DragQueryFileW
SHQueryRecycleBinW
SHFileOperationW
SHPathPrepareForWriteA
SHGetDiskFreeSpaceA
ExtractAssociatedIconExA
SHQueryRecycleBinA
Shell_NotifyIcon
DragQueryFileA
Shell_NotifyIconA
SHGetFolderLocation
SHInvokePrinterCommandW
SHEmptyRecycleBinW
SHCreateDirectoryExW
ShellExecuteExW
ShellAboutW
SHLoadNonloadedIconOverlayIdentifiers
SHAppBarMessage
SHLoadInProc
ShellExecuteExA
ExtractAssociatedIconW
SHBrowseForFolder
SHFreeNameMappings
SHGetSpecialFolderPathA
SHCreateProcessAsUserW
SHGetSpecialFolderPathW
CheckEscapesW
FindExecutableA
SHGetFileInfo
DoEnvironmentSubstA
ShellExecuteW
SHGetSettings
SHGetInstanceExplorer
FindExecutableW
SHGetDataFromIDListA
SHFileOperationA
ShellExecuteA
StrRStrIA
StrChrIW
StrCmpNIA
StrChrIA
StrCmpNA
StrRStrIW
SetFocus
GetMessageA
SetDlgItemTextA
GetForegroundWindow
GetClassInfoExW
UpdateWindow
DrawTextExW
EndDialog
SetCaretPos
SetRectEmpty
PostQuitMessage
DefWindowProcA
ShowWindow
SetWindowPos
GetWindowThreadProcessId
EnumDisplaySettingsExA
ValidateRgn
DrawEdge
SendMessageCallbackA
SetMenuItemInfoA
GetDlgItemTextA
RegisterDeviceNotificationW
GetClipboardData
TranslateMessage
DialogBoxParamA
ActivateKeyboardLayout
DdeCmpStringHandles
RegisterClassExA
MapDialogRect
GetClipCursor
RegisterClassW
GetWindowLongW
CreateMDIWindowA
DdeNameService
UnloadKeyboardLayout
CallNextHookEx
SendMessageTimeoutA
CreateWindowExA
LoadCursorA
LoadIconA
TranslateAcceleratorA
AttachThreadInput
TileChildWindows
GetMenuState
DispatchMessageA
LoadIconW
CreateWindowExW
LoadMenuIndirectW
SetForegroundWindow
EnumPropsExA
GetUserObjectSecurity
DdeQueryStringA
CharToOemA
OleLockRunning
CoUninitialize
OleUninitialize
CoRegisterMessageFilter
StringFromGUID2
CreateStreamOnHGlobal
CoAddRefServerProcess
OleRegGetMiscStatus
ReadClassStm
StringFromCLSID
CoResumeClassObjects
CLSIDFromString
CreateOleAdviseHolder
CoGetClassObject
CoRegisterClassObject
OleRegGetUserType
OleInitialize
CoTaskMemRealloc
CoCreateInstance
OleRegEnumVerbs
CoInitializeEx
CoTaskMemAlloc
WriteClassStm
OleSaveToStream
CLSIDFromProgID
CoRevokeClassObject
CoReleaseServerProcess
CoTaskMemFree
Number of PE resources by type
RT_CURSOR 16
RT_GROUP_CURSOR 15
RT_STRING 14
RT_DIALOG 4
RT_ICON 4
RT_BITMAP 2
RT_RCDATA 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
CHINESE SIMPLIFIED 56
ENGLISH AUS 1
ENGLISH US 1
PE resources
ExifTool file metadata
UninitializedDataSize
0

LinkerVersion
9.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
5.0.0.33

LanguageCode
Chinese (Simplified)

FileFlagsMask
0x003f

FileDescription
File Decrypter

ImageFileCharacteristics
No relocs, Executable, 32-bit

CharacterSet
Windows, Chinese (Simplified)

InitializedDataSize
41472

EntryPoint
0x12a90

OriginalFileName
EncryptExe.exe

MIMEType
application/octet-stream

LegalCopyright
Copyright (c) 2003-2016 Glarysoft Ltd

FileVersion
5, 0, 0, 33

TimeStamp
2019:04:16 03:01:55+02:00

FileType
Win32 EXE

PEType
PE32

InternalName
EncryptExe.exe

ProductVersion
5.0.0.1

SubsystemVersion
5.0

OSVersion
5.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Glarysoft Ltd

CodeSize
74240

ProductName
Glary Utilities

ProductVersionNumber
5.0.0.1

FileTypeExtension
exe

ObjectFileType
Executable application

File identification
MD5 4ef3b00e145cfb8a777ce9f74c7f6829
SHA1 b656082ff0b2bf3b259546a2d832dd6a45354356
SHA256 bb6d53233029a771452e66cb979c4386814658c1237723222bef8a6f211bd287
ssdeep
3072:o8ENSRg5KrR52iOG7jWXlnYNav5KLdIIPst5tKR2:o8KSRg5KPHOGErRKL6Ggl

authentihash fa80eda1d10c2b3d9ec49f93ed37076d12ce8788159bcf11e3b2b69d0320ba18
imphash 1ec3bfe8eec34e810d7e68de32d124a7
File size 116.8 KB ( 119608 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (64.5%)
Win32 Dynamic Link Library (generic) (13.6%)
Win32 Executable (generic) (9.3%)
OS/2 Executable (generic) (4.1%)
Generic Win/DOS Executable (4.1%)
Tags
peexe overlay

VirusTotal metadata
First submission 2019-04-16 01:06:14 UTC ( 1 month, 1 week ago )
Last submission 2019-04-16 01:06:14 UTC ( 1 month, 1 week ago )
File names EncryptExe.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Moved files
Deleted files
Created processes
Created mutexes
Opened mutexes
Opened service managers
Opened services
Runtime DLLs