| SHA256: | e586fd35a580868fb9f4ca3bb406c80e3b327c9375a02eb5b9e417d4c4d44e88 |
| File name: | aidfile_recovery_setup.exe |
| Detection ratio: | 2 / 45 |
| Analysis date: | 2013-08-23 08:27:40 UTC ( 4 years ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| Symantec | WS.Reputation.1 | 20130823 |
| TrendMicro-HouseCall | TROJ_GEN.F47V0630 | 20130823 |
| Yandex | 20130822 | |
| AhnLab-V3 | 20130823 | |
| AntiVir | 20130823 | |
| Antiy-AVL | 20130823 | |
| Avast | 20130823 | |
| AVG | 20130822 | |
| BitDefender | 20130823 | |
| ByteHero | 20130814 | |
| CAT-QuickHeal | 20130823 | |
| ClamAV | 20130823 | |
| Commtouch | 20130823 | |
| Comodo | 20130823 | |
| DrWeb | 20130823 | |
| Emsisoft | 20130823 | |
| ESET-NOD32 | 20130822 | |
| F-Prot | 20130823 | |
| F-Secure | 20130823 | |
| Fortinet | 20130823 | |
| GData | 20130823 | |
| Ikarus | 20130823 | |
| Jiangmin | 20130823 | |
| K7AntiVirus | 20130822 | |
| K7GW | 20130822 | |
| Kaspersky | 20130823 | |
| Kingsoft | 20130723 | |
| Malwarebytes | 20130822 | |
| McAfee | 20130823 | |
| McAfee-GW-Edition | 20130823 | |
| Microsoft | 20130823 | |
| eScan | 20130823 | |
| NANO-Antivirus | 20130823 | |
| Norman | 20130823 | |
| nProtect | 20130823 | |
| Panda | 20130822 | |
| PCTools | 20130823 | |
| Rising | 20130823 | |
| Sophos AV | 20130823 | |
| SUPERAntiSpyware | 20130823 | |
| TheHacker | 20130822 | |
| TotalDefense | 20130822 | |
| TrendMicro | 20130823 | |
| VBA32 | 20130822 | |
| VIPRE | 20130823 | |
| ViRobot | 20130823 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright © 2010-2013 Mitusoft
Publisher http://www.aidfile.com/
Product Aidfile recovery software
File version 3.6.3.2
Description Aidfile recovery software
Comments This installation was built with Inno Setup.
Packers identified
F-PROT INNO, appended, Aspack, Unicode
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 1992-06-19 22:22:17
Entry Point 0x00009C40
Number of sections 8
PE sections
PE imports
Number of PE resources by type
RT_STRING 6
RT_ICON 4
RT_MANIFEST 1
RT_RCDATA 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 7
DUTCH 4
ENGLISH US 3
PE resources
ExifTool file metadata
SubsystemVersion
4.0
Comments
This installation was built with Inno Setup.
InitializedDataSize
17920
ImageVersion
6.0
ProductName
Aidfile recovery software
FileVersionNumber
3.6.3.2
UninitializedDataSize
0
LanguageCode
Neutral
FileFlagsMask
0x003f
CharacterSet
Unicode
LinkerVersion
2.25
MIMEType
application/octet-stream
Subsystem
Windows GUI
FileVersion
3.6.3.2
TimeStamp
1992:06:19 23:22:17+01:00
FileType
Win32 EXE
PEType
PE32
FileAccessDate
2014:11:04 06:22:58+01:00
ProductVersion
3.6.3.2
FileDescription
Aidfile recovery software
OSVersion
1.0
FileCreateDate
2014:11:04 06:22:58+01:00
FileOS
Win32
LegalCopyright
Copyright 2010-2013 Mitusoft
MachineType
Intel 386 or later, and compatibles
CompanyName
http://www.aidfile.com/
CodeSize
37888
FileSubtype
0
ProductVersionNumber
3.6.3.2
EntryPoint
0x9c40
ObjectFileType
Executable application
Compressed bundles
File identification
MD5 00320c005c3f67524ac75283c0a99cb3
SHA1 c876586860389675bfb51504f6a545ee70952bb3
SHA256 e586fd35a580868fb9f4ca3bb406c80e3b327c9375a02eb5b9e417d4c4d44e88
ssdeep
98304:Q0BZJGBNdiD/VzTWkwn6CWiuFD2ihvtY3kYdgJkCPlACUw37emvqRgJ:vFqID/VzK56YiD2ihK0YdgJkeACUwLeY
File size
4.8 MB ( 4981391 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Inno Setup installer (86.4%) Win32 Dynamic Link Library (generic) (5.1%) Win32 Executable (generic) (3.5%) Win16/32 Executable Delphi generic (1.6%) Generic Win/DOS Executable (1.5%) |
Tags
peexe
aspack
VirusTotal metadata
First submission
2013-06-07 19:16:28 UTC ( 4 years, 2 months ago )
Last submission
2014-02-26 12:11:39 UTC ( 3 years, 5 months ago )
| File names |
aidfile_recovery_setup.exe aidfile_recovery_setup.exe U_pLB.xltm wl1j2qaO8p.tar.gz aa pq4kYMrCf.dll البرنامج الرائع فى استعادة المحذوفات والملفات المفقودة.exe aidfile_recovery_setup.exe 2Gl3uwkX.tar.bz2 |
Advanced heuristic and reputation engines
ClamAV
Possibly Unwanted Application. While not necessarily malicious, the
scanned file presents certain characteristics which depending on the
user policies and environment may or may not represent a threat. For
full details see:
https://www.clamav.net/documents/potentially-unwanted-applications-pua
.
F-Secure Deepguard
Suspicious:W32/Malware!Online
Symantec reputation
Suspicious.Insight
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Written files
Deleted files
Set keys
Created processes
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the
DeviceIoControl
Windows API function.