× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: be01fca446b1571e434b9bd0b945d0d4f664ae17361c833b2350f2d4fae1b1a8
File name: xara-online-microsoft-frontpage-add-on.exe
Detection ratio: 0 / 67
Analysis date: 2018-08-21 21:26:25 UTC ( 1 month ago )
Antivirus Result Update
Ad-Aware 20180821
AegisLab 20180821
AhnLab-V3 20180821
ALYac 20180821
Antiy-AVL 20180821
Arcabit 20180821
Avast 20180821
Avast-Mobile 20180820
AVG 20180821
Avira (no cloud) 20180821
AVware 20180821
Babable 20180725
Baidu 20180820
BitDefender 20180821
Bkav 20180821
CAT-QuickHeal 20180821
ClamAV 20180821
CMC 20180821
Comodo 20180821
CrowdStrike Falcon (ML) 20180723
Cybereason 20180225
Cylance 20180821
Cyren 20180821
DrWeb 20180821
eGambit 20180821
Emsisoft 20180821
Endgame 20180730
ESET-NOD32 20180821
F-Prot 20180821
F-Secure 20180821
Fortinet 20180821
GData 20180821
Ikarus 20180821
Sophos ML 20180717
Jiangmin 20180821
K7AntiVirus 20180821
K7GW 20180821
Kaspersky 20180821
Kingsoft 20180821
Malwarebytes 20180821
MAX 20180821
McAfee 20180821
McAfee-GW-Edition 20180821
Microsoft 20180821
eScan 20180821
NANO-Antivirus 20180821
Palo Alto Networks (Known Signatures) 20180821
Panda 20180820
Qihoo-360 20180821
Rising 20180821
SentinelOne (Static ML) 20180701
Sophos AV 20180821
SUPERAntiSpyware 20180821
Symantec 20180821
Symantec Mobile Insight 20180814
TACHYON 20180821
Tencent 20180821
TheHacker 20180821
TotalDefense 20180821
TrendMicro 20180821
TrendMicro-HouseCall 20180821
Trustlook 20180821
VBA32 20180821
VIPRE 20180821
ViRobot 20180821
Webroot 20180821
Zillya 20180821
ZoneAlarm by Check Point 20180821
Zoner 20180820
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright Xara Online 2001

Product Xara Modules FrontPage Add-in
Original name stub32i.exe
Internal name stub32i.exe
File version 1.0
Description Xara Modules FrontPage Add-in
Signature verification Signed file, verified signature
Signing date 4:21 PM 9/26/2001
Signers
[+] Xara Ltd
Status This certificate or one of the certificates in the certificate chain is not time valid., The certificate or one of the certificates in the certificate chain does not have a valid signature., The revocation status of the certificate or one of the certificates in the certificate chain is unknown., The certificate has not been strong signed..
Issuer Thawte Server CA
Valid from 1:32 PM 9/25/2001
Valid to 1:32 PM 9/25/2002
Valid usage Code Signing, 1.3.6.1.4.1.311.2.1.22
Algorithm md5RSA
Thumbprint 4175509DA0F4BD1424C723B61CE0BDD39410882C
Serial number 08 58 C4
[+] thawte
Status Valid
Issuer Thawte Server CA
Valid from 1:00 AM 8/1/1996
Valid to 12:59 AM 1/1/2021
Valid usage Server Auth, Code Signing
Algorithm md5RSA
Thumbprint 23E594945195F2414803B4D564D2A3A3F5D88B8C
Serial number 01
Counter signers
[+] VeriSign Time Stamping Service
Status This certificate or one of the certificates in the certificate chain is not time valid., The revocation status of the certificate or one of the certificates in the certificate chain is unknown., The revocation status of the certificate or one of the certificates in the certificate chain is either offline or stale.
Issuer NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
Valid from 1:00 AM 2/28/2001
Valid to 12:59 AM 1/7/2004
Valid usage Timestamp Signing
Algorithm md5RSA
Thumbrint 23348A128A2A9ABA478C9AAD1EC275F444F078D3
Serial number 08 7A 6D 5C 6F 62 93 4F BA C4 FD 43 E1 14 18 9D
[+] VeriSign Time Stamping CA
Status This certificate or one of the certificates in the certificate chain is not time valid.
Issuer NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
Valid from 1:00 AM 5/12/1997
Valid to 12:59 AM 1/8/2004
Valid usage Timestamp Signing
Algorithm md5RSA
Thumbrint 18F7C1FCC3090203FD5BAA2F861A754976C8DD25
Serial number 4A 19 D2 38 8C 82 59 1C A5 5D 73 5F 15 5D DC A3
Packers identified
F-PROT CAB, MSLZ
PEiD Armadillo v1.71
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2000-03-27 18:09:58
Entry Point 0x000083F7
Number of sections 4
PE sections
Overlays
MD5 2ae4231204768dcd0b6ca0c3ba9e255c
File type data
Offset 163840
Size 1076232
Entropy 8.00
PE imports
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetDeviceCaps
GetObjectA
CreateCompatibleDC
DeleteDC
SetBkMode
GetTextExtentPointA
BitBlt
CreatePalette
GetStockObject
CreateDIBitmap
SelectPalette
CreateFontIndirectA
CreateSolidBrush
SelectObject
SetBkColor
TextOutA
EnumFontFamiliesExA
DeleteObject
RealizePalette
SetTextColor
GetStdHandle
GetFileAttributesA
WaitForSingleObject
HeapDestroy
FreeEnvironmentStringsA
GetCurrentProcess
LocalAlloc
lstrcatA
UnhandledExceptionFilter
FreeEnvironmentStringsW
SetStdHandle
GetTempPathA
WideCharToMultiByte
GetStringTypeA
WriteFile
GetDiskFreeSpaceA
GetStringTypeW
SetFileAttributesA
GetOEMCP
LocalFree
LoadResource
FindClose
FormatMessageA
HeapAlloc
RemoveDirectoryA
GetPrivateProfileStringA
GetSystemDefaultLCID
MultiByteToWideChar
WritePrivateProfileSectionA
GetModuleHandleA
SetUnhandledExceptionFilter
MulDiv
GetSystemDirectoryA
MoveFileExA
TerminateProcess
GlobalAlloc
LocalFileTimeToFileTime
GetVersion
HeapFree
SetHandleCount
lstrcmpiA
FreeLibrary
IsBadWritePtr
FlushFileBuffers
LoadLibraryA
RtlUnwind
GetStartupInfoA
GetFileSize
CreateDirectoryA
DeleteFileA
GetWindowsDirectoryA
GetProcAddress
GetProcessHeap
FindFirstFileA
lstrcpyA
CompareStringA
GetTempFileNameA
CreateFileMappingA
FindNextFileA
GlobalLock
GetFileType
GetPrivateProfileSectionA
CreateFileA
ExitProcess
GetLastError
DosDateTimeToFileTime
LCMapStringW
HeapCreate
lstrlenA
GlobalFree
LCMapStringA
HeapReAlloc
GetEnvironmentStringsW
GlobalUnlock
IsDBCSLeadByte
GetModuleFileNameA
GetShortPathNameA
SizeofResource
WritePrivateProfileStringA
LockResource
SetFileTime
GetCPInfo
GetCommandLineA
MapViewOfFile
SetFilePointer
ReadFile
CloseHandle
lstrcpynA
GetACP
GetEnvironmentStrings
CreateProcessA
UnmapViewOfFile
VirtualFree
Sleep
IsBadReadPtr
IsBadCodePtr
FindResourceA
VirtualAlloc
LZCopy
LZClose
LZOpenFileA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
ShellExecuteA
SetFocus
GetParent
MapDialogRect
DrawTextA
BeginPaint
CharNextA
CreateDialogIndirectParamA
CheckRadioButton
ShowWindow
SetWindowPos
SendDlgItemMessageA
IsWindow
LoadIconA
GetWindowRect
DispatchMessageA
EnableWindow
SetDlgItemTextA
PostMessageA
MoveWindow
GetDlgItemTextA
MessageBoxA
PeekMessageA
SetWindowLongA
GetWindowLongA
TranslateMessage
IsWindowEnabled
GetWindow
GetSysColor
SetActiveWindow
GetDC
ReleaseDC
SetWindowTextA
LoadStringA
SetParent
SendMessageA
GetClientRect
GetDlgItem
CreateDialogParamA
GetNextDlgTabItem
ScreenToClient
InvalidateRect
wsprintfA
UpdateWindow
GetActiveWindow
FillRect
IsDlgButtonChecked
GetSysColorBrush
GetDesktopWindow
LoadImageA
EndPaint
GetWindowTextA
IsDialogMessageA
DestroyWindow
Number of PE resources by type
RT_DIALOG 9
RT_STRING 7
RT_ICON 4
RT_BITMAP 2
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 24
PE resources
ExifTool file metadata
SubsystemVersion
4.0

InitializedDataSize
98304

ImageVersion
0.0

ProductName
Xara Modules FrontPage Add-in

FileVersionNumber
2.11.15.0

UninitializedDataSize
0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

ImageFileCharacteristics
No relocs, Executable, No line numbers, No symbols, 32-bit

CharacterSet
Unicode

LinkerVersion
6.0

FileTypeExtension
exe

OriginalFileName
stub32i.exe

MIMEType
application/octet-stream

Subsystem
Windows GUI

FileVersion
1.0

TimeStamp
2000:03:27 19:09:58+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
stub32i.exe

ProductVersion
1.0

FileDescription
Xara Modules FrontPage Add-in

OSVersion
4.0

FileOS
Windows 32-bit

LegalCopyright
Copyright Xara Online 2001

MachineType
Intel 386 or later, and compatibles

CompanyName
Xara Online Ltd

CodeSize
69632

FileSubtype
0

ProductVersionNumber
2.11.15.0

EntryPoint
0x83f7

ObjectFileType
Executable application

File identification
MD5 1184ed4db193f016289163c509701c6b
SHA1 eda1059e859e49fe8320b3d4e267e5df1fe542be
SHA256 be01fca446b1571e434b9bd0b945d0d4f664ae17361c833b2350f2d4fae1b1a8
ssdeep

authentihash c5fb9d7cfe92af1a473b979ab13661f8d4607dcf159b6ca96eab24e50ac386d9
imphash 690c9e79bb34f8d71799aa65a51d3c5d
File size 1.2 MB ( 1240072 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (64.5%)
Win32 Dynamic Link Library (generic) (13.6%)
Win32 Executable (generic) (9.3%)
OS/2 Executable (generic) (4.1%)
Generic Win/DOS Executable (4.1%)
Tags
peexe software-collection armadillo overlay

VirusTotal metadata
First submission 2009-03-16 06:14:56 UTC ( 9 years, 6 months ago )
Last submission 2018-08-21 21:26:25 UTC ( 1 month ago )
File names xara-online-microsoft-frontpage-add-on.exe
1184ed4db193f016289163c509701c6b
1184ed4db193f016289163c509701c6b-2010.txt
stub32i.exe
BE01FCA446B1571E434B9BD0B945D0D4F664AE17361C833B2350F2D4FAE1B1A8
XolFrontPageAddin-1-0.exe
XolFrontPageAddin-1-0.exe
1360556028-XolFrontPageAddin-1-0.exe
1184ed4db193f016289163c509701c6b.eda1059e859e49fe8320b3d4e267e5df1fe542be
1184ed4db193f016289163c509701c6b
xara-online-microsoft-frontpage-add-on.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!