| SHA256: | f737c5ddcca85a4f52f69c3682e6d6922f5e703a6dccd9b5a147df5022348482 |
| File name: | 888poker_installer.exe |
| Detection ratio: | 2 / 46 |
| Analysis date: | 2013-04-23 10:17:48 UTC ( 5 years, 9 months ago ) |
| Antivirus | Result | Update |
|---|---|---|
| Ikarus | not-a-virus:CasinoOnline | 20130423 |
| Symantec | WS.Reputation.1 | 20130423 |
| Yandex | 20130422 | |
| AhnLab-V3 | 20130422 | |
| AntiVir | 20130423 | |
| Antiy-AVL | 20130423 | |
| Avast | 20130423 | |
| AVG | 20130423 | |
| BitDefender | 20130423 | |
| ByteHero | 20130418 | |
| CAT-QuickHeal | 20130423 | |
| ClamAV | 20130423 | |
| Commtouch | 20130423 | |
| Comodo | 20130423 | |
| DrWeb | 20130423 | |
| Emsisoft | 20130423 | |
| eSafe | 20130423 | |
| ESET-NOD32 | 20130423 | |
| F-Prot | 20130423 | |
| F-Secure | 20130423 | |
| Fortinet | 20130423 | |
| GData | 20130423 | |
| Jiangmin | 20130423 | |
| K7AntiVirus | 20130422 | |
| K7GW | 20130422 | |
| Kaspersky | 20130423 | |
| Kingsoft | 20130422 | |
| Malwarebytes | 20130423 | |
| McAfee | 20130423 | |
| McAfee-GW-Edition | 20130423 | |
| Microsoft | 20130423 | |
| eScan | 20130423 | |
| NANO-Antivirus | 20130423 | |
| Norman | 20130423 | |
| nProtect | 20130423 | |
| Panda | 20130423 | |
| PCTools | 20130423 | |
| Sophos AV | 20130423 | |
| SUPERAntiSpyware | 20130423 | |
| TheHacker | 20130422 | |
| TotalDefense | 20130423 | |
| TrendMicro | 20130423 | |
| TrendMicro-HouseCall | 20130423 | |
| VBA32 | 20130422 | |
| VIPRE | 20130423 | |
| ViRobot | 20130423 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2012-07-08 08:57:50
Entry Point 0x00016693
Number of sections 4
PE sections
PE imports
Number of PE resources by type
RT_DIALOG 1
RT_ICON 1
RT_MANIFEST 1
RT_ACCELERATOR 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 4
HEBREW DEFAULT 2
PE resources
ExifTool file metadata
SubsystemVersion
4.0
LinkerVersion
8.0
ImageVersion
0.0
FileSubtype
0
FileVersionNumber
3.7.0.22
UninitializedDataSize
0
LanguageCode
English (U.S.)
FileFlagsMask
0x003f
CharacterSet
Unicode
InitializedDataSize
49152
FileOS
Windows NT 32-bit
MIMEType
application/octet-stream
LegalCopyright
Copyright 2004
FileVersion
3, 7, 0, 22
TimeStamp
2012:07:08 09:57:50+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
Installer
FileAccessDate
2013:04:23 11:18:17+01:00
ProductVersion
3, 7, 0, 22
FileDescription
Installer
OSVersion
4.0
FileCreateDate
2013:04:23 11:18:17+01:00
OriginalFilename
Installer.exe
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
Random-Logic
CodeSize
237568
ProductName
Random-Logic Installer
ProductVersionNumber
3.7.0.22
EntryPoint
0x16693
ObjectFileType
Executable application
File identification
MD5 5bc2061796feab53f464e1e725a0ca8c
SHA1 a1f0d0db7a611c3931614722f5b064e99c041223
SHA256 f737c5ddcca85a4f52f69c3682e6d6922f5e703a6dccd9b5a147df5022348482
ssdeep
3072:aTVn+n6ibD75+xWM4+4RZ19f9pzxwHw1JdLiUKn94cMwLB5AZKhu8v5hQ8NHJOiQ:keb/RZhwHUm4cmDkPnhd
File size
291.5 KB ( 298520 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win64 Executable (generic) (51.4%) Win32 Executable MS Visual C++ (generic) (31.3%) Win32 Dynamic Link Library (generic) (6.6%) Win32 Executable (generic) (6.5%) Generic Win/DOS Executable (2.0%) |
Tags
peexe
VirusTotal metadata
First submission
2012-12-04 11:40:08 UTC ( 6 years, 1 month ago )
Last submission
2013-04-23 10:17:48 UTC ( 5 years, 9 months ago )
| File names |
888poker_installer.exe |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Written files
Set keys
Created mutexes
Opened mutexes
Searched windows
Opened service managers
Opened services
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the
DeviceIoControl
Windows API function.