× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: f824c36ef805b13751a25bb421f38abf80ba094ae32afd471ed624247c6cc7cc
File name: Salt-Minion-2017.7.2-Py2-x86-Setup.exe
Detection ratio: 3 / 68
Analysis date: 2017-11-24 13:28:16 UTC ( 1 month, 3 weeks ago )
Antivirus Result Update
Baidu Win32.Trojan.WisdomEyes.16070401.9500.9739 20171124
VBA32 Trojan.Win64.Agent 20171124
Zoner Trojan.Instsrv 20171124
Ad-Aware 20171124
AegisLab 20171124
AhnLab-V3 20171124
Alibaba 20171124
ALYac 20171124
Antiy-AVL 20171124
Arcabit 20171124
Avast 20171124
Avast-Mobile 20171124
AVG 20171124
Avira (no cloud) 20171124
AVware 20171124
BitDefender 20171124
Bkav 20171124
CAT-QuickHeal 20171124
ClamAV 20171124
CMC 20171124
Comodo 20171124
CrowdStrike Falcon (ML) 20171016
Cybereason 20171103
Cylance 20171124
Cyren 20171124
DrWeb 20171124
eGambit 20171124
Emsisoft 20171124
Endgame 20171024
ESET-NOD32 20171124
F-Prot 20171124
F-Secure 20171124
Fortinet 20171124
GData 20171124
Ikarus 20171124
Sophos ML 20170914
Jiangmin 20171124
K7AntiVirus 20171124
K7GW 20171124
Kaspersky 20171124
Kingsoft 20171124
Malwarebytes 20171124
MAX 20171124
McAfee 20171124
McAfee-GW-Edition 20171124
Microsoft 20171124
eScan 20171124
NANO-Antivirus 20171124
nProtect 20171124
Palo Alto Networks (Known Signatures) 20171124
Panda 20171124
Qihoo-360 20171124
Rising 20171124
SentinelOne (Static ML) 20171113
Sophos AV 20171124
SUPERAntiSpyware 20171124
Symantec 20171124
Symantec Mobile Insight 20171123
Tencent 20171124
TheHacker 20171121
TotalDefense 20171124
TrendMicro 20171124
TrendMicro-HouseCall 20171124
Trustlook 20171124
VIPRE 20171124
ViRobot 20171124
Webroot 20171124
WhiteArmor 20171104
Yandex 20171120
Zillya 20171124
ZoneAlarm by Check Point 20171124
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Signature verification Signed file, verified signature
Signing date 4:07 PM 10/4/2017
Signers
[+] Salt Stack, Inc.
Status Valid
Issuer DigiCert EV Code Signing CA (SHA2)
Valid from 1:00 AM 2/26/2016
Valid to 1:00 PM 3/1/2019
Valid usage Code Signing
Algorithm sha256RSA
Thumbprint E477E6824B2C6CBB854FD4CE8FB9D4E5A2BCC2BB
Serial number 0C E6 70 38 E3 83 D7 42 7C E3 B9 9B 0A A7 06 9F
[+] DigiCert EV Code Signing CA (SHA2)
Status Valid
Issuer DigiCert High Assurance EV Root CA
Valid from 1:00 PM 4/18/2012
Valid to 1:00 PM 4/18/2027
Valid usage Code Signing
Algorithm sha256RSA
Thumbprint 60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3
Serial number 03 F1 B4 E1 5F 3A 82 F1 14 96 78 B3 D7 D8 47 5C
[+] DigiCert
Status Valid
Issuer DigiCert High Assurance EV Root CA
Valid from 1:00 AM 11/10/2006
Valid to 1:00 AM 11/10/2031
Valid usage Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing
Algorithm sha1RSA
Thumbprint 5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
Serial number 02 AC 5C 26 6A 0B 40 9B 8F 0B 79 F2 AE 46 25 77
Counter signers
[+] DigiCert Timestamp Responder
Status Valid
Issuer DigiCert Assured ID CA-1
Valid from 1:00 AM 10/22/2014
Valid to 1:00 AM 10/22/2024
Valid usage Timestamp Signing
Algorithm sha1RSA
Thumbrint 614D271D9102E30169822487FDE5DE00A352B01D
Serial number 03 01 9A 02 3A FF 58 B1 6B D6 D5 EA E6 17 F0 66
[+] DigiCert Assured ID CA-1
Status Valid
Issuer DigiCert Assured ID Root CA
Valid from 1:00 AM 11/10/2006
Valid to 1:00 AM 11/10/2021
Valid usage Server Auth, Client Auth, Code Signing, Email Protection, Timestamp Signing
Algorithm sha1RSA
Thumbrint 19A09B5A36F4DD99727DF783C17A51231A56C117
Serial number 06 FD F9 03 96 03 AD EA 00 0A EB 3F 27 BB BA 1B
[+] DigiCert
Status Valid
Issuer DigiCert Assured ID Root CA
Valid from 1:00 AM 11/10/2006
Valid to 1:00 AM 11/10/2031
Valid usage Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing
Algorithm sha1RSA
Thumbrint 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
Serial number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Packers identified
F-PROT NSIS, appended, UTF-8, Unicode, CAB
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2014-10-07 04:40:23
Entry Point 0x000030E2
Number of sections 5
PE sections
Overlays
MD5 9306a4fcfcd39c713a3ae12b77c0ada1
File type data
Offset 177152
Size 34107200
Entropy 8.00
PE imports
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegEnumValueA
ImageList_Create
Ord(17)
ImageList_Destroy
ImageList_AddMasked
GetDeviceCaps
SelectObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetBkColor
DeleteObject
SetTextColor
GetLastError
lstrlenA
GetFileAttributesA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
CopyFileA
GetTickCount
SetFileTime
GlobalUnlock
LoadLibraryA
DeleteFileA
GetModuleFileNameA
GetShortPathNameA
GetCurrentProcess
LoadLibraryExA
CompareFileTime
GetPrivateProfileStringA
WritePrivateProfileStringA
GetFileSize
lstrcatA
CreateDirectoryA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
SetErrorMode
MultiByteToWideChar
GetCommandLineA
GlobalLock
SetFileAttributesA
SetFilePointer
GetTempPathA
CreateThread
lstrcmpiA
GetModuleHandleA
lstrcmpA
ReadFile
lstrcpyA
FindFirstFileA
CloseHandle
GetTempFileNameA
lstrcpynA
FindNextFileA
RemoveDirectoryA
GetSystemDirectoryA
GetDiskFreeSpaceA
GetProcAddress
SetEnvironmentVariableA
GetFullPathNameA
FreeLibrary
MoveFileA
CreateProcessA
WriteFile
GlobalAlloc
SearchPathA
FindClose
Sleep
CreateFileA
ExitProcess
GetVersion
SetCurrentDirectoryA
MulDiv
SHGetFileInfoA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA
SHFileOperationA
CharPrevA
GetMessagePos
EndPaint
ReleaseDC
EndDialog
BeginPaint
ShowWindow
DefWindowProcA
GetClassInfoA
SetClassLongA
LoadBitmapA
SetWindowPos
GetSystemMetrics
IsWindow
AppendMenuA
PostQuitMessage
GetWindowRect
DispatchMessageA
ScreenToClient
SetDlgItemTextA
MessageBoxIndirectA
LoadImageA
GetDlgItemTextA
PeekMessageA
SetWindowLongA
IsWindowEnabled
GetSysColor
CheckDlgButton
GetDC
SystemParametersInfoA
CreatePopupMenu
wsprintfA
DialogBoxParamA
SetClipboardData
IsWindowVisible
SendMessageA
DrawTextA
GetClientRect
SetTimer
GetDlgItem
SetForegroundWindow
CreateDialogParamA
EnableMenuItem
RegisterClassA
SendMessageTimeoutA
InvalidateRect
GetWindowLongA
FindWindowExA
CreateWindowExA
LoadCursorA
TrackPopupMenu
SetWindowTextA
FillRect
OpenClipboard
CharNextA
CallWindowProcA
GetSystemMenu
EmptyClipboard
EnableWindow
CloseClipboard
DestroyWindow
ExitWindowsEx
SetCursor
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
CoTaskMemFree
OleUninitialize
CoCreateInstance
OleInitialize
Number of PE resources by type
RT_ICON 7
RT_DIALOG 4
RT_GROUP_ICON 1
RT_MANIFEST 1
Number of PE resources by language
ENGLISH US 13
PE resources
ExifTool file metadata
MIMEType
application/octet-stream

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

FileTypeExtension
exe

TimeStamp
2014:10:07 05:40:23+01:00

FileType
Win32 EXE

PEType
PE32

CodeSize
24064

LinkerVersion
6.0

EntryPoint
0x30e2

InitializedDataSize
162816

SubsystemVersion
4.0

ImageVersion
6.0

OSVersion
4.0

UninitializedDataSize
1024

File identification
MD5 3a8586e024a04a9199e89470c6d41ce4
SHA1 bb1e5fd8d6900d5718fefd7eeecfad3490454f19
SHA256 f824c36ef805b13751a25bb421f38abf80ba094ae32afd471ed624247c6cc7cc
ssdeep
786432:D+RpAX6lFerm6cfPD0YtUNehOGKJXrNCVq7q5MR8:D+uUFPD0YGNehOxJRV2M8

authentihash 199a4132b77dcecece971a2aaf52da4254098f1c76d1cf2ff09239ace782da62
imphash e160ef8e55bb9d162da4e266afd9eef3
File size 32.7 MB ( 34284352 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID NSIS - Nullsoft Scriptable Install System (90.8%)
InstallShield setup (4.6%)
Win64 Executable (generic) (2.9%)
Win32 Dynamic Link Library (generic) (0.7%)
Win32 Executable (generic) (0.4%)
Tags
nsis peexe signed overlay

VirusTotal metadata
First submission 2017-10-10 00:07:06 UTC ( 3 months, 1 week ago )
Last submission 2017-10-10 00:07:06 UTC ( 3 months, 1 week ago )
File names Salt-Minion-2017.7.2-Py2-x86-Setup.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!