Antivirus scan for c2daaad0220fde4ba5753bf6ccca8ffcfc229946697304346f8250973f799629 at 2018-06-08 00:03:37 UTC

Antivirus	Result	Update
Ad-Aware	Trojan.GenericKD.30935997	20180608
AegisLab	Ml.Attribute.Gen!c	20180607
AhnLab-V3	Win-Trojan/Emotet.Exp	20180607
Arcabit	Trojan.Generic.D1D80BBD	20180608
Avast	FileRepMetagen [Malware]	20180608
AVG	FileRepMetagen [Malware]	20180608
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9998	20180607
CrowdStrike Falcon (ML)	malicious_confidence_90% (W)	20180530
Cylance	Unsafe	20180608
Endgame	malicious (high confidence)	20180507
Kaspersky	UDS:DangerousObject.Multi.Generic	20180607
Malwarebytes	Trojan.Emotet	20180608
MAX	malware (ai score=92)	20180608
McAfee	Artemis!DCF0D92897F7	20180607
McAfee-GW-Edition	Artemis	20180607
Palo Alto Networks (Known Signatures)	generic.ml	20180608
SentinelOne (Static ML)	static engine - malicious	20180225
Sophos AV	Mal/EncPk-ANR	20180607
Symantec	ML.Attribute.HighConfidence	20180607
Webroot	W32.Trojan.Emotet	20180608
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180608
Alibaba		20180607
ALYac		20180608
Antiy-AVL		20180608
Avast-Mobile		20180607
Avira (no cloud)		20180607
AVware		20180607
Babable		20180406
BitDefender		20180607
Bkav		20180607
CAT-QuickHeal		20180607
ClamAV		20180607
CMC		20180607
Comodo		20180607
Cybereason		20180225
Cyren		20180607
DrWeb		20180607
eGambit		20180608
Emsisoft		20180607
ESET-NOD32		20180607
F-Prot		20180607
F-Secure		20180607
Fortinet		20180607
GData		20180607
Sophos ML		20180601
Jiangmin		20180607
K7AntiVirus		20180607
K7GW		20180608
Kingsoft		20180608
Microsoft		20180607
eScan		20180607
NANO-Antivirus		20180607
Panda		20180607
Qihoo-360		20180608
Rising		20180607
SUPERAntiSpyware		20180607
Symantec Mobile Insight		20180605
TACHYON		20180608
Tencent		20180608
TheHacker		20180606
TotalDefense		20180607
TrendMicro		20180607
TrendMicro-HouseCall		20180607
Trustlook		20180608
VBA32		20180607
VIPRE		20180607
ViRobot		20180607
Yandex		20180529
Zillya		20180607
Zoner		20180607

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Product RTNicProp

Original name RTNicProp.dll

Internal name RTNicProp

File version 1, 2, 0, 6

Description About Page

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2018-06-07 20:40:54

Entry Point 0x0000100F

Number of sections 7

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 97442 98304 1.08 d5bad1b576c9743a4260034482a65b3b

.rdata 102400 1372 4096 1.11 aac34875871339d03399c2a09efd2a63

.xZ 106496 11763 8192 1.75 a7094a57064e4667ea43f2eb9eb5c49e

.idata 118784 1326 4096 0.95 8d3eab2c295d4674f43367b5e717a63b

lsEsvnz 122880 135949 139264 5.83 d3c8f1a6a696700d58185618d9598fcf

.rsrc 262144 24140 24576 3.29 233fbcdd9fbf1eaf5d1d69abbfc00860

.reloc 286720 1923 4096 2.28 9a62460fd23fc5d6472a83f6d7e9ec0a

PE imports

Number of PE resources by type

RT_DIALOG 32

RT_MANIFEST 1

RT_VERSION 1

Number of PE resources by language

ENGLISH US 2

HEBREW DEFAULT 1

PORTUGUESE NEUTRAL 1

HUNGARIAN DEFAULT 1

VIETNAMESE DEFAULT 1

CHINESE SIMPLIFIED 1

FRENCH NEUTRAL 1

CZECH DEFAULT 1

SPANISH NEUTRAL 1

DUTCH NEUTRAL 1

FINNISH DEFAULT 1

KOREAN 1

NEUTRAL DEFAULT 1

PORTUGUESE 1

ITALIAN NEUTRAL 1

SWEDISH NEUTRAL 1

BULGARIAN DEFAULT 1

POLISH DEFAULT 1

JAPANESE DEFAULT 1

DANISH DEFAULT 1

ARABIC NEUTRAL 1

SLOVAK DEFAULT 1

GREEK DEFAULT 1

TURKISH DEFAULT 1

CHINESE TRADITIONAL 1

THAI DEFAULT 1

SERBIAN DEFAULT 1

NEUTRAL 1

SLOVENIAN DEFAULT 1

ROMANIAN 1

RUSSIAN 1

NORWEGIAN NEUTRAL 1

GERMAN NEUTRAL 1

PE resources

04a996eba648a3625572df91e920bdebd3cb3a6a85fdf915cf39e7cc19402083 data

0abc7004ed789223b95787c40a31a73628c56bf107893e3717d886f3f44b3f30 data

0cddc2e1c4668d0d011499d3bc924243dda64c512c01a7b2b5d4a5a86aa99009 data

127b28c1db100928587ed5df37bad91783cbf758b45e92fbe0eb3ef17701d81d data

19a7a1da7f9d70a37126f8627aa6f2b33debec0569f6145942b54b3ad7538c5e data

1cc21e501af578cf31816c51e4acb7744fa33d32ba66a42aced687ef42c12325 data

2557fce698c7478ad0c6aa6300ba36d4250578f637cd66a9ed36a24c06028b46 data

261bb880056d6b961343fc1618828618ff09e4f16b0b3fdee6d191f27b432301 data

30c8ed24ed66369af16d7e6e51e65583a7c29df6ef4464032473913355c0fa07 data

388f75e900f0c15fd66249d7b2e7edf6e14eeefb859e6f766b75058e44f27af6 ASCII text

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Thu Jun 7 20:40:54 2018 103344 29 Bytes

12 (12) Thu Jun 7 20:40:54 2018 103468 20 Bytes

ExifTool file metadata

SubsystemVersion

5.0

LinkerVersion

12.0

ImageVersion

0.0

FileSubtype

FileVersionNumber

1.2.0.6

UninitializedDataSize

LanguageCode

Neutral

FileFlagsMask

0x0017

CharacterSet

Unicode

InitializedDataSize

188416

EntryPoint

0x100f

OriginalFileName

RTNicProp.dll

MIMEType

application/octet-stream

LegalCopyright

FileVersion

1, 2, 0, 6

TimeStamp

2018:06:07 21:40:54+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

RTNicProp

ProductVersion

1, 2, 0, 6

FileDescription

About Page

OSVersion

5.0

FileOS

Win32

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Realtek Semiconductor Corporation

CodeSize

ProductName

RTNicProp

ProductVersionNumber

1.2.0.6

FileTypeExtension

exe

ObjectFileType

Dynamic link library

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

be5615f8a1404c96c30d898def8afc46483eea3e82a9084d3f5fd35d5491bc33

File identification

MD5 dcf0d92897f7147ce9629302c40a6ba9

SHA1 15980442f1d56ae8063f9d1561ce9dc39a02b807

SHA256 c2daaad0220fde4ba5753bf6ccca8ffcfc229946697304346f8250973f799629

ssdeep

1536:wZlv/vb13RKbehVaG2c9tJAz6poYWEiiBCtNtKA86CKTC:wZlv/vZLlX2z6poYWjigpKA8M

authentihash 50d9eff1d690a37133197c6f669adabf730b36e1bfc60673733561ff85f5d016

imphash 7b2f3ea6560af78235d71f9448e55cd7

File size 280.0 KB ( 286720 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	OS/2 Executable (generic) (33.6%) Generic Win/DOS Executable (33.1%) DOS Executable Generic (33.1%)

VirusTotal metadata

First submission 2018-06-07 20:48:45 UTC ( 8 months, 2 weeks ago )

Last submission 2018-06-09 00:24:31 UTC ( 8 months, 2 weeks ago )

File names

WATCHNEVADA.EXE
RTNicProp
RTNicProp.dll

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\c2daaad0220fde4ba5753bf6ccca8ffcfc229946697304346f8250973f799629 (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\system32\winsock.dll (successful)

C:\WINDOWS\system32\drwtsn32.exe (successful)

C:\WINDOWS\system32\netmsg.dll (successful)

Read files

C:\WINDOWS\system32\winsock.dll (successful)

Created processes

C:\WINDOWS\system32\drwtsn32 -p 2032 -e 180 -g (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

rpcrt4.dll (successful)

shlwapi.dll (successful)

version.dll (successful)

shell32.dll (successful)

advapi32.dll (successful)

ntdll.dll (successful)

kernel32.dll (successful)

SHA256:	c2daaad0220fde4ba5753bf6ccca8ffcfc229946697304346f8250973f799629
File name:	WATCHNEVADA.EXE
Detection ratio:	21 / 67
Analysis date:	2018-06-08 00:03:37 UTC ( 8 months, 2 weeks ago ) View latest

Ciphered bundle