Antivirus scan for d7d78ae85d3e7ac1408e36529d0a26c47ef611dfdc7009110081cb0193f8c950 at 2018-06-08 03:16:59 UTC

Antivirus	Result	Update
AhnLab-V3	Win-Trojan/Emotet.Exp	20180607
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9999	20180607
Bkav	W32.eHeur.Malware14	20180607
CrowdStrike Falcon (ML)	malicious_confidence_80% (D)	20180530
Cylance	Unsafe	20180608
Endgame	malicious (high confidence)	20180507
Ikarus	Trojan-Banker.Emotet	20180607
Malwarebytes	Trojan.Emotet	20180608
Qihoo-360	HEUR/QVM20.1.B2DD.Malware.Gen	20180608
SentinelOne (Static ML)	static engine - malicious	20180225
Sophos AV	Mal/EncPk-ANR	20180608
Symantec	ML.Attribute.HighConfidence	20180607
Ad-Aware		20180608
AegisLab		20180608
Alibaba		20180608
ALYac		20180608
Antiy-AVL		20180608
Arcabit		20180608
Avast		20180608
Avast-Mobile		20180607
AVG		20180608
Avira (no cloud)		20180607
AVware		20180608
Babable		20180406
BitDefender		20180608
CAT-QuickHeal		20180607
ClamAV		20180607
CMC		20180607
Comodo		20180607
Cybereason		20180225
Cyren		20180608
DrWeb		20180608
eGambit		20180608
Emsisoft		20180608
ESET-NOD32		20180608
F-Prot		20180608
F-Secure		20180607
Fortinet		20180608
GData		20180608
Sophos ML		20180601
Jiangmin		20180607
K7AntiVirus		20180607
K7GW		20180608
Kaspersky		20180608
Kingsoft		20180608
MAX		20180608
McAfee		20180608
McAfee-GW-Edition		20180608
Microsoft		20180608
eScan		20180608
NANO-Antivirus		20180608
Palo Alto Networks (Known Signatures)		20180608
Panda		20180607
Rising		20180608
SUPERAntiSpyware		20180608
Symantec Mobile Insight		20180605
TACHYON		20180608
Tencent		20180608
TheHacker		20180606
TotalDefense		20180607
TrendMicro		20180608
TrendMicro-HouseCall		20180608
Trustlook		20180608
VBA32		20180607
VIPRE		20180608
ViRobot		20180607
Webroot		20180608
Yandex		20180529
Zillya		20180607
ZoneAlarm by Check Point		20180608
Zoner		20180607

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Product RTNicProp

Original name RTNicProp.dll

Internal name RTNicProp

File version 1, 2, 0, 6

Description About Page

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2018-06-08 03:12:15

Entry Point 0x0000100F

Number of sections 7

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 96266 98304 1.06 c4bef63f9e8f0f71e17f39067df153a6

.rdata 102400 1372 4096 1.11 93d794ff2ab979a9df38e96881cc2307

.xZ 106496 11623 8192 1.73 317061c77d52e98b35208afefce2bd21

.idata 118784 1326 4096 0.95 ccb82897549555181c1ff4e83c68c9f6

lsEsvnz 122880 135947 139264 5.91 4f262b58e0a448439ad656f06d53e93a

.rsrc 262144 24140 24576 3.29 233fbcdd9fbf1eaf5d1d69abbfc00860

.reloc 286720 1888 4096 2.21 af92f1cc5100fbd20fee222906bbbb98

PE imports

Number of PE resources by type

RT_DIALOG 32

RT_MANIFEST 1

RT_VERSION 1

Number of PE resources by language

ENGLISH US 2

HEBREW DEFAULT 1

PORTUGUESE NEUTRAL 1

HUNGARIAN DEFAULT 1

VIETNAMESE DEFAULT 1

CHINESE SIMPLIFIED 1

FRENCH NEUTRAL 1

CZECH DEFAULT 1

SPANISH NEUTRAL 1

DUTCH NEUTRAL 1

FINNISH DEFAULT 1

KOREAN 1

NEUTRAL DEFAULT 1

PORTUGUESE 1

ITALIAN NEUTRAL 1

SWEDISH NEUTRAL 1

BULGARIAN DEFAULT 1

POLISH DEFAULT 1

JAPANESE DEFAULT 1

DANISH DEFAULT 1

ARABIC NEUTRAL 1

SLOVAK DEFAULT 1

GREEK DEFAULT 1

TURKISH DEFAULT 1

CHINESE TRADITIONAL 1

THAI DEFAULT 1

SERBIAN DEFAULT 1

NEUTRAL 1

SLOVENIAN DEFAULT 1

ROMANIAN 1

RUSSIAN 1

NORWEGIAN NEUTRAL 1

GERMAN NEUTRAL 1

PE resources

04a996eba648a3625572df91e920bdebd3cb3a6a85fdf915cf39e7cc19402083 data

0abc7004ed789223b95787c40a31a73628c56bf107893e3717d886f3f44b3f30 data

0cddc2e1c4668d0d011499d3bc924243dda64c512c01a7b2b5d4a5a86aa99009 data

127b28c1db100928587ed5df37bad91783cbf758b45e92fbe0eb3ef17701d81d data

19a7a1da7f9d70a37126f8627aa6f2b33debec0569f6145942b54b3ad7538c5e data

1cc21e501af578cf31816c51e4acb7744fa33d32ba66a42aced687ef42c12325 data

2557fce698c7478ad0c6aa6300ba36d4250578f637cd66a9ed36a24c06028b46 data

261bb880056d6b961343fc1618828618ff09e4f16b0b3fdee6d191f27b432301 data

30c8ed24ed66369af16d7e6e51e65583a7c29df6ef4464032473913355c0fa07 data

388f75e900f0c15fd66249d7b2e7edf6e14eeefb859e6f766b75058e44f27af6 ASCII text

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Fri Jun 8 03:12:15 2018 103344 29 Bytes

12 (12) Fri Jun 8 03:12:15 2018 103468 20 Bytes

ExifTool file metadata

UninitializedDataSize

LinkerVersion

12.0

ImageVersion

0.0

FileSubtype

FileVersionNumber

1.2.0.6

LanguageCode

Neutral

FileFlagsMask

0x0017

FileDescription

About Page

ImageFileCharacteristics

Executable, 32-bit

CharacterSet

Unicode

InitializedDataSize

188416

EntryPoint

0x100f

OriginalFileName

RTNicProp.dll

MIMEType

application/octet-stream

LegalCopyright

FileVersion

1, 2, 0, 6

TimeStamp

2018:06:07 20:12:15-07:00

FileType

Win32 EXE

PEType

PE32

InternalName

RTNicProp

ProductVersion

1, 2, 0, 6

SubsystemVersion

5.0

OSVersion

5.0

FileOS

Win32

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Realtek Semiconductor Corporation

CodeSize

ProductName

RTNicProp

ProductVersionNumber

1.2.0.6

FileTypeExtension

exe

ObjectFileType

Dynamic link library

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

9f546a03d8b204bae3bc45a4829dc99da7db94d6fdd9b01dd62f540e56d25186

ca0cc609b646598814a7725102c2d41bd5aa4000eb3bdd5431938e6c5827e1e1

File identification

MD5 713aa4c9133e3ee50daae053ea963e45

SHA1 dfc8dcf98948976f1cdaa712f8d5a79a95efcd16

SHA256 d7d78ae85d3e7ac1408e36529d0a26c47ef611dfdc7009110081cb0193f8c950

ssdeep

1536:HpCTyM1E9a/i8D8Yy6twabmRHuWY4oF2CJtHYa9DlQwJ1FcODN0zDxCKT:HpqQZgaBab4ueo3Jl88FvN03x

authentihash a3654a347bad00893d4874f60390466c2bddb0fc5a5a2eaf6e2f3e7fcccb4d35

imphash be6c3ab4324d2dd5c3de8247c79b32f4

File size 280.0 KB ( 286720 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	OS/2 Executable (generic) (33.6%) Generic Win/DOS Executable (33.1%) DOS Executable Generic (33.1%)

VirusTotal metadata

First submission 2018-06-08 03:16:59 UTC ( 8 months, 2 weeks ago )

Last submission 2018-06-08 03:16:59 UTC ( 8 months, 2 weeks ago )

File names

RTNicProp
RTNicProp.dll
fhItc7w3WKYyX4fg.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\d7d78ae85d3e7ac1408e36529d0a26c47ef611dfdc7009110081cb0193f8c950 (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\system32\winsock.dll (successful)

C:\WINDOWS\system32\drwtsn32.exe (successful)

C:\WINDOWS\system32\netmsg.dll (successful)

Read files

C:\WINDOWS\system32\winsock.dll (successful)

Created processes

C:\WINDOWS\system32\drwtsn32 -p 412 -e 180 -g (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

rpcrt4.dll (successful)

shlwapi.dll (successful)

version.dll (successful)

shell32.dll (successful)

advapi32.dll (successful)

ntdll.dll (successful)

kernel32.dll (successful)

SHA256:	d7d78ae85d3e7ac1408e36529d0a26c47ef611dfdc7009110081cb0193f8c950
File name:	fhItc7w3WKYyX4fg.exe
Detection ratio:	12 / 68
Analysis date:	2018-06-08 03:16:59 UTC ( 8 months, 2 weeks ago ) View latest

Ciphered bundle