| SHA256: | e557d5e799a7b96100e8b9a6098f8a4bae3276c6a04fb2c8d3b6adcdfef16c47 |
| File name: | serial_port_monitor.exe |
| Detection ratio: | 0 / 67 |
| Analysis date: | 2018-11-09 00:16:09 UTC ( 3 months, 1 week ago ) |
| Antivirus | Result | Update |
|---|---|---|
| Ad-Aware | 20181109 | |
| AegisLab | 20181108 | |
| AhnLab-V3 | 20181108 | |
| Alibaba | 20180921 | |
| ALYac | 20181109 | |
| Antiy-AVL | 20181108 | |
| Arcabit | 20181108 | |
| Avast | 20181109 | |
| Avast-Mobile | 20181108 | |
| AVG | 20181109 | |
| Avira (no cloud) | 20181108 | |
| Babable | 20180918 | |
| Baidu | 20181108 | |
| BitDefender | 20181108 | |
| Bkav | 20181108 | |
| CAT-QuickHeal | 20181108 | |
| ClamAV | 20181108 | |
| CMC | 20181108 | |
| CrowdStrike Falcon (ML) | 20181022 | |
| Cybereason | 20180225 | |
| Cylance | 20181109 | |
| Cyren | 20181109 | |
| DrWeb | 20181109 | |
| Emsisoft | 20181108 | |
| Endgame | 20181108 | |
| ESET-NOD32 | 20181108 | |
| F-Prot | 20181108 | |
| F-Secure | 20181108 | |
| Fortinet | 20181108 | |
| GData | 20181108 | |
| Ikarus | 20181108 | |
| Sophos ML | 20181108 | |
| Jiangmin | 20181108 | |
| K7AntiVirus | 20181108 | |
| K7GW | 20181108 | |
| Kaspersky | 20181108 | |
| Kingsoft | 20181109 | |
| Malwarebytes | 20181108 | |
| MAX | 20181109 | |
| McAfee | 20181108 | |
| McAfee-GW-Edition | 20181108 | |
| Microsoft | 20181108 | |
| eScan | 20181108 | |
| NANO-Antivirus | 20181108 | |
| Palo Alto Networks (Known Signatures) | 20181109 | |
| Panda | 20181108 | |
| Qihoo-360 | 20181109 | |
| Rising | 20181108 | |
| SentinelOne (Static ML) | 20181011 | |
| Sophos AV | 20181108 | |
| SUPERAntiSpyware | 20181107 | |
| Symantec | 20181108 | |
| Symantec Mobile Insight | 20181108 | |
| TACHYON | 20181108 | |
| Tencent | 20181109 | |
| TheHacker | 20181108 | |
| TotalDefense | 20181108 | |
| TrendMicro | 20181108 | |
| TrendMicro-HouseCall | 20181109 | |
| Trustlook | 20181109 | |
| VBA32 | 20181108 | |
| VIPRE | 20181107 | |
| ViRobot | 20181108 | |
| Webroot | 20181109 | |
| Yandex | 20181108 | |
| Zillya | 20181108 | |
| ZoneAlarm by Check Point | 20181109 | |
| Zoner | 20181109 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
Copyright © 2000-2015 ELTIMA Software. All rights reserved.
Product Serial Port Monitor
File version 6.0.235
Description Serial Port Monitor
Comments This installation was built with Inno Setup.
Signature verification
Signed file, verified signature
Signing date 3:30 PM 7/16/2015
| Signers |
| Counter signers |
Packers identified
F-PROT INNO, Armadillo
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2013-10-13 08:19:32
Entry Point 0x000113BC
Number of sections 8
PE sections
Overlays
MD5 48df38253ea19a7c8d1e23abe8523756
File type data
Offset 119296
Size 5364696
Entropy 8.00
PE imports
Number of PE resources by type
RT_STRING 6
RT_ICON 4
RT_RCDATA 4
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 9
ENGLISH US 4
DUTCH 4
PE resources
ExifTool file metadata
SubsystemVersion
5.0
Comments
This installation was built with Inno Setup.
LinkerVersion
2.25
ImageVersion
6.0
FileSubtype
0
FileVersionNumber
6.0.235.0
LanguageCode
Neutral
FileFlagsMask
0x003f
FileDescription
Serial Port Monitor
ImageFileCharacteristics
No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
CharacterSet
Unicode
InitializedDataSize
53248
EntryPoint
0x113bc
MIMEType
application/octet-stream
LegalCopyright
Copyright 2000-2015 ELTIMA Software. All rights reserved.
FileVersion
6.0.235
TimeStamp
2013:10:13 09:19:32+01:00
FileType
Win32 EXE
PEType
PE32
ProductVersion
6.0.235
UninitializedDataSize
0
OSVersion
5.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
ELTIMA Software
CodeSize
65024
ProductName
Serial Port Monitor
ProductVersionNumber
6.0.235.0
FileTypeExtension
exe
ObjectFileType
Executable application
CarbonBlack
CarbonBlack acts as a surveillance camera for computers
While monitoring an end-user machine in-the-wild, CarbonBlack noticed the
following files in execution wrote this sample to disk.
While monitoring an end-user machine in-the-wild, CarbonBlack noticed this
sample wrote the following files to disk.
Execution parents
Compressed bundles
File identification
MD5 dfe68af32009ca80028e411bee2202c4
SHA1 b0d5c0a61379ba3a92151b12fa114ff53e518e4e
SHA256 e557d5e799a7b96100e8b9a6098f8a4bae3276c6a04fb2c8d3b6adcdfef16c47
ssdeep
98304:6ejnQQn0Iaad+kIN2fju8pN2bSPTwhC5TOHeDgacGSeGuylCiHwwnUAs9BmB2QXm:VQYaad3zpNCgwgkHeDllGuylSbDBmFXm
File size
5.2 MB ( 5483992 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable Delphi generic (42.4%) Win32 Dynamic Link Library (generic) (19.7%) Win32 Executable (generic) (13.5%) Win16/32 Executable Delphi generic (6.2%) OS/2 Executable (generic) (6.0%) |
Tags
peexe
armadillo
signed
overlay
VirusTotal metadata
First submission
2015-07-19 11:07:28 UTC ( 3 years, 7 months ago )
Last submission
2017-07-01 16:41:26 UTC ( 1 year, 7 months ago )
| File names |
serial_port_monitor.exe serialport_monitor.exe e557d5e799a7b96100e8b9a6098f8a4bae3276c6a04fb2c8d3b6adcdfef16c47.bin Setup.exe serial_port_monitor.exe serial_port_monitor.exe sub_serial_port_monitor.exe serial_port_monitor.exe filename serial_port_monitor.exe serial_port_monitor.exe rs232_monitor.exe serial_port_monitor20170701-15470-wpc3jk.exe serial_port_monitor.exe B E557D5E799A7B96100E8B9A6098F8A4BAE3276C6A04FB2C8D3B6ADCDFEF16C47 701635 serial_port_monitor.exe sub_serial_port_monitor.exe unconfirmed 334063.crdownload unconfirmed 869769.crdownload serial_port_monitor.exe serial_port_monitor.exe |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.