× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: e9cf705680c6207d6d7fc1dcfb30c26206665ee7e81e2906dab8f6bc95f0e56d
File name: UltraSearchSetup.exe
Detection ratio: 0 / 51
Analysis date: 2014-04-19 22:56:23 UTC ( 5 days, 8 hours ago )
Probably harmless! There are strong indicators suggesting that this file is safe to use.
Antivirus Result Update
AVG 20140419
Ad-Aware 20140420
AegisLab 20140420
Agnitum 20140419
AhnLab-V3 20140419
AntiVir 20140419
Antiy-AVL 20140419
Avast 20140420
Baidu-International 20140419
BitDefender 20140420
Bkav 20140418
ByteHero 20140420
CAT-QuickHeal 20140418
CMC 20140417
ClamAV 20140420
Commtouch 20140419
Comodo 20140419
DrWeb 20140420
ESET-NOD32 20140419
Emsisoft 20140420
F-Prot 20140420
F-Secure 20140419
Fortinet 20140419
GData 20140420
Ikarus 20140419
Jiangmin 20140419
K7AntiVirus 20140418
K7GW 20140418
Kaspersky 20140420
Kingsoft 20140420
Malwarebytes 20140420
McAfee 20140420
McAfee-GW-Edition 20140420
MicroWorld-eScan 20140420
Microsoft 20140420
NANO-Antivirus 20140420
Norman 20140419
Panda 20140419
Qihoo-360 20140420
Rising 20140419
SUPERAntiSpyware 20140419
Sophos 20140419
Symantec 20140420
TheHacker 20140419
TotalDefense 20140419
TrendMicro 20140420
TrendMicro-HouseCall 20140420
VBA32 20140418
VIPRE 20140420
ViRobot 20140419
nProtect 20140418
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block
Copyright
(c) 1996-2012 by Joachim Marder

Publisher JAM Software GmbH
Product UltraSearch
File version 1.7.1.239
Description UltraSearch Setup
Comments This installation was built with Inno Setup.
Signature verification Signed file, verified signature
Signing date 12:25 PM 10/25/2012
Signers
[+] JAM Software GmbH
Status Certificate out of its validity period
Valid from 1:00 AM 1/14/2010
Valid to 12:59 AM 1/14/2013
Valid usage Code Signing
Algorithm SHA1
Thumbrint 36B61C05779AB59A1948E6E4125BF43B0F1BDFB6
Serial number 55 E1 BF 2B 36 6A 98 B6 E8 C6 1D C8 44 1C BB 61
[+] VeriSign Class 3 Code Signing 2009-2 CA
Status Valid
Valid from 1:00 AM 5/21/2009
Valid to 12:59 AM 5/21/2019
Valid usage Client Auth, Code Signing
Algorithm SHA1
Thumbrint 12D4872BC3EF019E7E0B6F132480AE29DB5B1CA3
Serial number 65 52 26 E1 B2 2E 18 E1 59 0F 29 85 AC 22 E7 5C
[+] VeriSign Class 3 Public Primary Certification Authority (PCA3 G1 SHA1)
Status Valid
Valid from 1:00 AM 1/29/1996
Valid to 12:59 AM 8/3/2028
Valid usage Server Auth, Client Auth, Email Protection, Code Signing
Algorithm SHA1
Thumbrint A1DB6393916F17E4185509400415C70240B0AE6B
Serial number 3C 91 31 CB 1F F6 D0 1B 0E 9A B8 D0 44 BF 12 BE
Counter signers
[+] Symantec Time Stamping Services Signer - G3
Status Certificate out of its validity period
Valid from 1:00 AM 5/1/2012
Valid to 12:59 AM 1/1/2013
Valid usage Timestamp Signing
Algorithm SHA1
Thumbrint 8FD99D63FB3AFBD534A4F6E31DACD27F59504021
Serial number 79 A2 A5 85 F9 D1 15 42 13 D9 B8 3E F6 B6 8D ED
[+] VeriSign Time Stamping Services CA
Status Certificate out of its validity period
Valid from 1:00 AM 12/4/2003
Valid to 12:59 AM 12/4/2013
Valid usage Timestamp Signing
Algorithm SHA1
Thumbrint F46AC0C6EFBB8C6A14F55F09E2D37DF4C0DE012D
Serial number 47 BF 19 95 DF 8D 52 46 43 F7 DB 6D 48 0D 31 A4
[+] Thawte Timestamping CA
Status Valid
Valid from 1:00 AM 1/1/1997
Valid to 12:59 AM 1/1/2021
Valid usage Timestamp Signing
Algorithm MD5
Thumbrint BE36A4562FB2EE05DBB3D32323ADF445084ED656
Serial number 00
Packers identified
F-PROT INNO, appended, INNO, INNO, appended, INNO, INNO, appended, INNO, INNO, appended, INNO, INNO, appended, INNO, INNO, appended, INNO, INNO
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2011-12-20 14:16:50
Entry Point 0x00016478
Number of sections 8
PE sections
PE imports
RegCloseKey
OpenProcessToken
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
InitCommonControls
GetLastError
GetStdHandle
EnterCriticalSection
GetUserDefaultLangID
GetSystemInfo
GetModuleFileNameW
WaitForSingleObject
GetVersionExW
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetThreadLocale
VirtualProtect
GetFileAttributesW
RtlUnwind
lstrlenW
GetLocalTime
CreateProcessW
DeleteCriticalSection
GetStartupInfoA
SizeofResource
GetWindowsDirectoryW
LocalAlloc
LockResource
GetDiskFreeSpaceW
GetCommandLineW
SetErrorMode
UnhandledExceptionFilter
LoadLibraryExW
MultiByteToWideChar
EnumCalendarInfoW
GetCPInfo
DeleteFileW
GetProcAddress
GetDateFormatW
InterlockedCompareExchange
GetLocaleInfoW
lstrcpynW
CompareStringW
RaiseException
WideCharToMultiByte
RemoveDirectoryW
SetFilePointer
GetFullPathNameW
ReadFile
GetEnvironmentVariableW
InterlockedExchange
CreateDirectoryW
WriteFile
GetCurrentProcess
CloseHandle
FindFirstFileW
GetACP
GetModuleHandleW
SignalObjectAndWait
SetEvent
FormatMessageW
LoadLibraryW
CreateEventW
GetExitCodeProcess
GetVersion
InitializeCriticalSection
LoadResource
FindResourceW
CreateFileW
VirtualQuery
VirtualFree
FindClose
TlsGetValue
Sleep
SetEndOfFile
TlsSetValue
ExitProcess
GetCurrentThreadId
LeaveCriticalSection
VirtualAlloc
GetFileSize
SetLastError
ResetEvent
VariantChangeType
SafeArrayGetLBound
SafeArrayPtrOfIndex
SysAllocStringLen
VariantClear
SafeArrayCreate
SysReAllocStringLen
SafeArrayGetUBound
VariantCopy
SysFreeString
VariantInit
GetSystemMetrics
SetWindowLongW
MessageBoxW
PeekMessageW
LoadStringW
MessageBoxA
CreateWindowExW
MsgWaitForMultipleObjects
TranslateMessage
CharUpperBuffW
CallWindowProcW
CharNextW
GetKeyboardType
ExitWindowsEx
DispatchMessageW
DestroyWindow
Number of PE resources by type
RT_ICON 10
RT_STRING 6
RT_RCDATA 4
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 14
NEUTRAL 9
ExifTool file metadata
UninitializedDataSize
0

Comments
This installation was built with Inno Setup.

LinkerVersion
2.25

ImageVersion
6.0

FileSubtype
0

FileVersionNumber
1.7.1.239

LanguageCode
Neutral

FileFlagsMask
0x003f

CharacterSet
Unicode

InitializedDataSize
130560

MIMEType
application/octet-stream

LegalCopyright
(c) 1996-2012 by Joachim Marder

FileVersion
1.7.1.239

TimeStamp
2011:12:20 15:16:50+01:00

FileType
Win32 EXE

PEType
PE32

SubsystemVersion
5.0

FileAccessDate
2014:04:20 03:06:41+01:00

ProductVersion
1.7.1

FileDescription
UltraSearch Setup

OSVersion
5.0

FileCreateDate
2014:04:20 03:06:41+01:00

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
JAM Software

CodeSize
86016

ProductName
UltraSearch

ProductVersionNumber
1.7.1.239

EntryPoint
0x16478

ObjectFileType
Executable application

Compressed bundles
File identification
MD5 2d9959396da4f8d029b284282e05651f
SHA1 466f4d6f76374125f7a423ba0e6a829b233ba294
SHA256 e9cf705680c6207d6d7fc1dcfb30c26206665ee7e81e2906dab8f6bc95f0e56d
ssdeep
49152:4Jxjx3Ypa5ymSCifj0RuDZ7TuHOknywsMVbbkOKZDJ+gLP3YucegYZsYRYN9mpHI:w3YpbS80utGbiMVbSNvYcTm8KG0R/Nf

imphash 483f0c4259a9148c34961abbda6146c1
File size 3.2 MB ( 3317464 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Inno Setup installer (91.1%)
Win32 Executable (generic) (3.7%)
Win16/32 Executable Delphi generic (1.7%)
Generic Win/DOS Executable (1.6%)
DOS Executable Generic (1.6%)
Tags
peexe signed

VirusTotal metadata
First submission 2012-10-26 11:03:41 UTC ( 1 year, 6 months ago )
Last submission 2014-04-01 12:24:09 UTC ( 3 weeks, 2 days ago )
File names 2d9959396da4f8d029b284282e05651f
12800483.exe
UltraSearchSetup1.7.exe
UltraSearch v1.71 setup.exe
samples_analysis_platform
test.exe
UltraSearchSetup1.7.1-uni.exe
output.9269336.txt
UltraSearchSetup.exe
UltraSearchSetup_v1.71.exe
file-4929063_exe
octet-stream
9269336
UltraSearchSetup.exe
ultrasearchsetup.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Written files
Deleted files
Created processes
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.