× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: db74bc26f4782e3e3f9a6dafa341d6942a0f7d82f8570250f4cec12e5a12c3d3
File name: free-iphone-data-recovery.exe
Detection ratio: 0 / 68
Analysis date: 2018-06-12 01:16:02 UTC ( 5 months, 1 week ago ) View latest
Antivirus Result Update
Ad-Aware 20180611
AegisLab 20180611
AhnLab-V3 20180611
Alibaba 20180611
ALYac 20180612
Antiy-AVL 20180612
Arcabit 20180611
Avast 20180611
Avast-Mobile 20180611
AVG 20180611
Avira (no cloud) 20180612
AVware 20180612
Babable 20180406
Baidu 20180611
BitDefender 20180611
Bkav 20180611
CAT-QuickHeal 20180611
ClamAV 20180611
CMC 20180611
Comodo 20180611
CrowdStrike Falcon (ML) 20180530
Cybereason 20180225
Cylance 20180612
Cyren 20180611
DrWeb 20180611
eGambit 20180612
Emsisoft 20180611
Endgame 20180507
ESET-NOD32 20180612
F-Prot 20180611
F-Secure 20180611
Fortinet 20180611
GData 20180611
Ikarus 20180611
Sophos ML 20180601
Jiangmin 20180612
K7AntiVirus 20180611
K7GW 20180612
Kaspersky 20180611
Kingsoft 20180612
Malwarebytes 20180612
MAX 20180612
McAfee 20180611
McAfee-GW-Edition 20180611
Microsoft 20180611
eScan 20180611
NANO-Antivirus 20180612
Palo Alto Networks (Known Signatures) 20180612
Panda 20180611
Qihoo-360 20180612
Rising 20180611
SentinelOne (Static ML) 20180225
Sophos AV 20180611
SUPERAntiSpyware 20180612
Symantec 20180611
Symantec Mobile Insight 20180605
TACHYON 20180612
Tencent 20180612
TheHacker 20180608
TotalDefense 20180611
TrendMicro 20180611
TrendMicro-HouseCall 20180611
Trustlook 20180612
VBA32 20180611
VIPRE 20180612
ViRobot 20180611
Webroot 20180612
Yandex 20180609
Zillya 20180611
ZoneAlarm by Check Point 20180612
Zoner 20180612
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright

Product
File version 7.3.30
Description
Comments This installation was built with Inno Setup.
Signature verification Signed file, verified signature
Signing date 4:47 AM 1/3/2017
Signers
[+] OKWare Co., Ltd
Status This certificate or one of the certificates in the certificate chain is not time valid.
Issuer GlobalSign CodeSigning CA - G3
Valid from 2:54 AM 6/17/2016
Valid to 2:21 PM 11/4/2017
Valid usage Code Signing
Algorithm sha1RSA
Thumbprint E51FDC088EE1F52D0EEAA9FC4E2F11C8A3E9D299
Serial number 06 85 5C 8D 6E D1 CE BF 8D 69 9C 1F
[+] GlobalSign CodeSigning CA - G3
Status Valid
Issuer GlobalSign Root CA
Valid from 1:00 AM 3/16/2016
Valid to 1:00 AM 3/16/2024
Valid usage Code Signing, OCSP Signing
Algorithm sha1RSA
Thumbprint F1E7B6C0C10DA9436ECC04FF5FC3B6916B46CF4C
Serial number 47 C3 0F FE FC 22 BB 28 0F 96 FE A7 52 51
[+] GlobalSign Root CA - R1
Status Valid
Issuer GlobalSign Root CA
Valid from 1:00 PM 9/1/1998
Valid to 1:00 PM 1/28/2028
Valid usage Server Auth, Client Auth, Code Signing, Email Protection, Timestamp Signing, OCSP Signing, EFS, IPSEC Tunnel, IPSEC User, IPSEC IKE Intermediate
Algorithm sha1RSA
Thumbprint B1BC968BD4F49D622AA89A81F2150152A41D829C
Serial number 04 00 00 00 00 01 15 4B 5A C3 94
Counter signers
[+] GlobalSign TSA for MS Authenticode - G2
Status Valid
Issuer GlobalSign Timestamping CA - G2
Valid from 1:00 AM 5/24/2016
Valid to 1:00 AM 6/24/2027
Valid usage Timestamp Signing
Algorithm sha1RSA
Thumbrint 63B82FAB61F583909695050B00249C502933EC79
Serial number 11 21 D6 99 A7 64 97 3E F1 F8 42 7E E9 19 CC 53 41 14
[+] GlobalSign Timestamping CA - G2
Status Valid
Issuer GlobalSign Root CA
Valid from 11:00 AM 4/13/2011
Valid to 1:00 PM 1/28/2028
Valid usage All
Algorithm sha1RSA
Thumbrint C0E49D2D7D90A5CD427F02D9125694D5D6EC5B71
Serial number 04 00 00 00 00 01 2F 4E E1 52 D7
[+] GlobalSign Root CA - R1
Status Valid
Issuer GlobalSign Root CA
Valid from 1:00 PM 9/1/1998
Valid to 1:00 PM 1/28/2028
Valid usage Server Auth, Client Auth, Code Signing, Email Protection, Timestamp Signing, OCSP Signing, EFS, IPSEC Tunnel, IPSEC User, IPSEC IKE Intermediate
Algorithm sha1RSA
Thumbrint B1BC968BD4F49D622AA89A81F2150152A41D829C
Serial number 04 00 00 00 00 01 15 4B 5A C3 94
Packers identified
F-PROT INNO, appended, UTF-8
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2013-11-28 12:22:21
Entry Point 0x000173D4
Number of sections 8
PE sections
Overlays
MD5 4ab01fbe99ab512603ab963a27759da7
File type data
Offset 237056
Size 21248560
Entropy 7.99
PE imports
RegCloseKey
OpenProcessToken
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
InitCommonControls
GetUserDefaultUILanguage
GetLastError
GetStdHandle
EnterCriticalSection
GetUserDefaultLangID
GetSystemInfo
lstrcmpiA
WaitForSingleObject
GetVersionExW
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetThreadLocale
VirtualProtect
LoadLibraryA
GetCommandLineW
RtlUnwind
lstrlenW
GetExitCodeProcess
CreateProcessW
DeleteCriticalSection
GetStartupInfoA
SizeofResource
GetWindowsDirectoryW
LocalAlloc
LockResource
GetDiskFreeSpaceW
GetModuleHandleW
SetErrorMode
UnhandledExceptionFilter
LoadLibraryExW
MultiByteToWideChar
EnumCalendarInfoW
GetCPInfo
DeleteFileW
GetProcAddress
InterlockedCompareExchange
GetLocaleInfoW
lstrcpynW
RemoveDirectoryW
CompareStringW
RaiseException
WideCharToMultiByte
GetModuleFileNameW
SetFilePointer
GetSystemDefaultUILanguage
GetFullPathNameW
ReadFile
GetEnvironmentVariableW
InterlockedExchange
CreateDirectoryW
WriteFile
GetCurrentProcess
CloseHandle
ResetEvent
FindFirstFileW
IsValidLocale
GetACP
GetCurrentThreadId
SignalObjectAndWait
SetEvent
LocalFree
FormatMessageW
GetFileAttributesW
LoadLibraryW
CreateEventW
InitializeCriticalSection
LoadResource
FindResourceW
CreateFileW
VirtualQuery
VirtualFree
FindClose
TlsGetValue
Sleep
SetEndOfFile
TlsSetValue
ExitProcess
GetVersion
VirtualAlloc
GetFileSize
SetLastError
LeaveCriticalSection
SysReAllocStringLen
SysFreeString
SysAllocStringLen
GetSystemMetrics
SetWindowLongW
MessageBoxW
PeekMessageW
LoadStringW
MessageBoxA
CreateWindowExW
MsgWaitForMultipleObjects
TranslateMessage
CharUpperBuffW
CallWindowProcW
CharNextW
ExitWindowsEx
DispatchMessageW
DestroyWindow
Number of PE resources by type
RT_STRING 6
RT_ICON 4
RT_RCDATA 4
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 9
ENGLISH US 8
PE resources
ExifTool file metadata
UninitializedDataSize
0

Comments
This installation was built with Inno Setup.

InitializedDataSize
143872

ImageVersion
6.0

FileVersionNumber
7.3.30.0

LanguageCode
Neutral

FileFlagsMask
0x003f

CharacterSet
Unicode

LinkerVersion
2.25

EntryPoint
0x173d4

MIMEType
application/octet-stream

FileVersion
7.3.30

TimeStamp
2013:11:28 13:22:21+01:00

FileType
Win32 EXE

PEType
PE32

ProductVersion
7.3.30

SubsystemVersion
5.0

OSVersion
5.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
AnyMP4 Studio

CodeSize
92160

FileSubtype
0

ProductVersionNumber
7.3.30.0

FileTypeExtension
exe

ObjectFileType
Executable application

File identification
MD5 9a607897e619623ab4f046c5c4238680
SHA1 9efeeaa40d6c69308e2d3c49fa7bae3bd348416a
SHA256 db74bc26f4782e3e3f9a6dafa341d6942a0f7d82f8570250f4cec12e5a12c3d3
ssdeep
393216:J4tcXF6ejGve1WLEIgbu+IDizeVT3rwQ9V+leTlASr/hkgts6jRg1w:mtcXsIGmW4Il+ID8eVb794oTlAW/hhsO

authentihash d7caa6e02166e3317f986c13c575536d44b220aed6715efe10cd19c51dfbb6bf
imphash edfd53923a80fa45309099d71acee533
File size 20.5 MB ( 21485616 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 EXE PECompact compressed (generic) (64.7%)
DOS Borland compiled Executable (generic) (15.5%)
Win32 Executable (generic) (7.0%)
Win16/32 Executable Delphi generic (3.2%)
OS/2 Executable (generic) (3.1%)
Tags
peexe signed overlay

VirusTotal metadata
First submission 2017-10-23 22:42:07 UTC ( 1 year ago )
Last submission 2018-05-22 23:33:02 UTC ( 6 months ago )
File names free-iphone-data-recovery.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!