Antivirus scan for d132d0850b182eaa954deeb2d525ea781fffd03a92fc198468c01cb037d9c27e at 2018-09-23 06:10:39 UTC

Antivirus	Result	Update
AegisLab	Packer.W32.Krap.ljju	20180923
AhnLab-V3	Trojan/Win32.Emotet.R234758	20180922
Avast	FileRepMalware	20180923
AVG	FileRepMalware	20180923
Bkav	HW32.Packed.	20180921
CAT-QuickHeal	Trojan.Emotet.X4	20180922
CrowdStrike Falcon (ML)	malicious_confidence_100% (D)	20180723
Cybereason	malicious.145c8b	20180225
Cylance	Unsafe	20180923
Cyren	W32/Emotet.WZLA-7375	20180923
Endgame	malicious (high confidence)	20180730
F-Prot	W32/Emotet.UI	20180923
Sophos ML	heuristic	20180717
K7AntiVirus	Trojan ( 0053b6a31 )	20180923
K7GW	Trojan ( 0053b6a31 )	20180923
Kaspersky	UDS:DangerousObject.Multi.Generic	20180923
McAfee	Artemis!E982654145C8	20180922
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch	20180923
Microsoft	Trojan:Win32/Emotet.AC!bit	20180923
Palo Alto Networks (Known Signatures)	generic.ml	20180923
Qihoo-360	Win32/Trojan.88c	20180923
Rising	Trojan.Emotet!8.B95 (TFE:dGZlOgML+gwBuPBD4Q)	20180923
SentinelOne (Static ML)	static engine - malicious	20180830
Symantec	Packed.Generic.517	20180922
Webroot	W32.Trojan.Emotet	20180923
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180923
Ad-Aware		20180923
Alibaba		20180921
ALYac		20180923
Antiy-AVL		20180922
Arcabit		20180923
Avast-Mobile		20180923
Avira (no cloud)		20180922
AVware		20180923
Babable		20180918
Baidu		20180914
BitDefender		20180923
ClamAV		20180923
CMC		20180922
Comodo		20180923
DrWeb		20180923
eGambit		20180923
Emsisoft		20180923
ESET-NOD32		20180923
F-Secure		20180923
Fortinet		20180923
GData		20180923
Ikarus		20180922
Jiangmin		20180922
Kingsoft		20180923
Malwarebytes		20180923
MAX		20180923
eScan		20180923
NANO-Antivirus		20180923
Panda		20180922
Sophos AV		20180923
SUPERAntiSpyware		20180907
Symantec Mobile Insight		20180918
TACHYON		20180922
Tencent		20180923
TheHacker		20180920
TotalDefense		20180923
TrendMicro		20180923
TrendMicro-HouseCall		20180923
Trustlook		20180923
VBA32		20180921
VIPRE		20180923
ViRobot		20180922
Yandex		20180922
Zillya		20180922
Zoner		20180922

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2018-09-23 03:46:28

Entry Point 0x000015ED

Number of sections 6

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.crt 4096 8930 12288 5.22 52185b593074bd6f0b6517d2c525b0c1

.rdata 16384 1376 4096 2.22 40691099605f7ec245288f44e09bc67e

.data 20480 4896 4096 0.73 a45e53bd3d3fb41b63f1b4cfb8ab4475

CONST 28672 90288 94208 7.87 35939ccd650bff7a92d405f0a9540dbb

.rsrc 122880 12504 16384 3.11 5be8db03eea456f043a664237990310d

.reloc 139264 220 4096 0.55 642239f1920a3b4b2a23e01fb2bac710

PE imports

Number of PE resources by type

RT_STRING 13

RT_BITMAP 12

Number of PE resources by language

NEUTRAL 18

CHINESE TRADITIONAL 6

ITALIAN 1

PE resources

0f5248f16fe2b1e73aa9be760a6f0bef933dc09e3cc6d8a8958eae1ce0bd0f97 data

17b07efdaa0a29047984ccc097bbbe258ffcb76dad8ea803f14e5473ec77791c ASCII text

2cb60d7d674640457497f54b82b42afaa8a2cbd7c28a1aae35f128b4471cfaaa data

369c5223029ea6d1b17b7f24a8d84c10f528457e79be3349a6c55efd0e8f0e02 ASCII text

3cf8dd24fcb6e2b44ee8af90436ccf5ff6876969031ee19d62ca7b6040b9675a ASCII text

4ae8b4d06d5719e7f792fafdb8ecb1772862ca78d4747dbe7c17903c25f2f580 ASCII text

4f72c53f3bac49ce0b7c248152479a14e383a90c9fe95edbddec9f03784ca698 data

5900c9daca1375fddf459eb1fc3766d130f0354bc3f2c09964994baec048feb2 ASCII text

5bea8ae9edb158f767d478703ce5153b8773e1e0390fa2c4af83f063c6c2f1fa data

6b97877cdd547e6ba6467f86055f1fc7b06660b034439f0da4c137538ef14a83 data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Sun Sep 23 03:46:28 2018 16788 56 Bytes

12 (12) Sun Sep 23 03:46:28 2018 16912 20 Bytes

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2018:09:23 05:46:28+02:00

FileType

Win32 EXE

PEType

PE32

CodeSize

12288

LinkerVersion

14.0

ImageFileCharacteristics

Executable, 32-bit

EntryPoint

0x15ed

InitializedDataSize

126976

SubsystemVersion

5.0

ImageVersion

0.0

OSVersion

5.0

UninitializedDataSize

File identification

MD5 e982654145c8bf27a2a14d6c7e3ddc8a

SHA1 730fe02c68c652699623f6a621ba0ebd6ce4bb03

SHA256 d132d0850b182eaa954deeb2d525ea781fffd03a92fc198468c01cb037d9c27e

ssdeep

1536:tGzc1OeQOAlMel7/m51mNCVASH0g0bMXqyTHUmC51zYyUmUZO7E4c7gtkuTr9i/I:jPIb/F0LHmbwJTwMwUo7PcU9g42

authentihash 0d375258618993c8417403024d8d6d635206952c11418f7f5f4b1d0dae359397

imphash 07f6411c85ecc42c7bb49783aec3a8c2

File size 136.0 KB ( 139264 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (38.3%) Win32 Executable (generic) (26.2%) OS/2 Executable (generic) (11.8%) Generic Win/DOS Executable (11.6%) DOS Executable Generic (11.6%)

VirusTotal metadata

First submission 2018-09-23 03:51:35 UTC ( 4 months, 4 weeks ago )

Last submission 2018-09-23 12:45:37 UTC ( 4 months, 4 weeks ago )

File names

30861456.exe
60482048.exe
zoCzyjZgnx.exe
qaVcH237Z0.exe
KVZseBX2AObf.exe

SHA256:	d132d0850b182eaa954deeb2d525ea781fffd03a92fc198468c01cb037d9c27e
File name:	zoCzyjZgnx.exe
Detection ratio:	26 / 69
Analysis date:	2018-09-23 06:10:39 UTC ( 4 months, 4 weeks ago ) View latest

Ciphered bundle