× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: f8c53cb9cf976bcfa5e71f448b69f509b227a9ab02e82f1ca62b151586bbc78c
File name: StrangerThingsv1_0.exe
Detection ratio: 2 / 57
Analysis date: 2016-08-28 01:48:54 UTC ( 10 months ago ) View latest
Antivirus Result Update
Invincea generic.a 20160826
Zillya Trojan.VBKrypt.Win32.249497 20160826
Ad-Aware 20160828
AegisLab 20160828
AhnLab-V3 20160827
Alibaba 20160826
ALYac 20160828
Antiy-AVL 20160827
Arcabit 20160828
Avast 20160828
AVG 20160827
Avira (no cloud) 20160827
AVware 20160827
Baidu 20160827
BitDefender 20160828
Bkav 20160827
CAT-QuickHeal 20160827
ClamAV 20160827
CMC 20160824
Comodo 20160828
CrowdStrike Falcon (ML) 20160826
Cyren 20160828
DrWeb 20160828
Emsisoft 20160828
ESET-NOD32 20160827
F-Prot 20160828
F-Secure 20160828
Fortinet 20160828
GData 20160828
Ikarus 20160827
Jiangmin 20160828
K7AntiVirus 20160827
K7GW 20160828
Kaspersky 20160827
Kingsoft 20160828
Malwarebytes 20160828
McAfee 20160828
McAfee-GW-Edition 20160828
Microsoft 20160827
eScan 20160828
NANO-Antivirus 20160827
nProtect 20160827
Panda 20160827
Qihoo-360 20160828
Rising 20160828
Sophos 20160827
SUPERAntiSpyware 20160827
Symantec 20160828
Tencent 20160828
TheHacker 20160826
TrendMicro 20160828
TrendMicro-HouseCall 20160828
VBA32 20160826
VIPRE 20160828
ViRobot 20160827
Yandex 20160827
Zoner 20160828
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Packers identified
F-PROT ZIP
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2015-10-02 08:17:46
Entry Point 0x0001115C
Number of sections 4
PE sections
Overlays
MD5 5e9f386d85c96b32f54e69c582f9fb6a
File type application/zip
Offset 157696
Size 15735116
Entropy 7.99
PE imports
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
InitCommonControlsEx
GetDeviceCaps
DeleteDC
SelectObject
StretchBlt
GetObjectW
CreateDIBSection
CreateCompatibleDC
DeleteObject
CreateCompatibleBitmap
GetStdHandle
GetConsoleOutputCP
FileTimeToSystemTime
WaitForSingleObject
GetFileAttributesW
GetLocalTime
FreeEnvironmentStringsA
DeleteCriticalSection
GetCurrentProcess
OpenFileMappingW
GetConsoleMode
GetLocaleInfoA
FreeEnvironmentStringsW
GetLocaleInfoW
SetStdHandle
GetCPInfo
GetStringTypeA
GetTempPathW
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetOEMCP
GetExitCodeProcess
FindClose
InterlockedDecrement
MoveFileW
GetFullPathNameW
SetLastError
GetModuleFileNameW
IsDebuggerPresent
ExitProcess
GetModuleFileNameA
UnhandledExceptionFilter
TlsGetValue
MultiByteToWideChar
FoldStringW
SetFilePointer
SetFileAttributesW
SetEnvironmentVariableW
MoveFileExW
SetUnhandledExceptionFilter
TzSpecificLocalTimeToSystemTime
TerminateProcess
WriteConsoleA
SetCurrentDirectoryW
GlobalAlloc
LocalFileTimeToFileTime
SetEndOfFile
GetCurrentThreadId
InterlockedIncrement
GetNumberFormatW
WriteConsoleW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
SetHandleCount
LoadLibraryW
GetVersionExW
FreeLibrary
QueryPerformanceCounter
GetTickCount
TlsAlloc
FlushFileBuffers
LoadLibraryA
RtlUnwind
GetStartupInfoA
GetDateFormatW
CreateDirectoryW
DeleteFileW
GetProcAddress
CreateFileMappingW
CompareStringW
WriteFile
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
HeapAlloc
LeaveCriticalSection
GetLastError
SystemTimeToFileTime
LCMapStringW
HeapCreate
GetConsoleCP
LCMapStringA
GetTimeFormatW
GetEnvironmentStringsW
IsDBCSLeadByte
FileTimeToLocalFileTime
GetEnvironmentStrings
GetCurrentDirectoryW
GetCurrentProcessId
SetFileTime
GetCommandLineW
WideCharToMultiByte
HeapSize
GetCommandLineA
RaiseException
MapViewOfFile
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
GetACP
GetModuleHandleW
IsValidCodePage
UnmapViewOfFile
FindResourceW
VirtualFree
Sleep
VirtualAlloc
VariantInit
SHBrowseForFolderW
SHChangeNotify
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW
SHGetMalloc
SHAutoComplete
MapWindowPoints
SetFocus
GetParent
UpdateWindow
EndDialog
LoadBitmapW
DefWindowProcW
CopyRect
GetWindowTextW
GetMessageW
ShowWindow
SetWindowPos
wvsprintfW
GetSystemMetrics
SetWindowLongW
IsWindow
SendMessageW
GetWindowRect
EnableWindow
CharUpperW
DialogBoxParamW
SendDlgItemMessageW
GetDlgItemTextW
PostMessageW
GetSysColor
SetDlgItemTextW
GetDC
GetWindowLongW
ReleaseDC
DestroyIcon
TranslateMessage
IsWindowVisible
LoadStringW
GetClientRect
GetDlgItem
GetWindow
OemToCharBuffA
DispatchMessageW
MessageBoxW
PeekMessageW
GetClassNameW
IsDialogMessageW
SetWindowTextW
WaitForInputIdle
LoadCursorW
LoadIconW
FindWindowExW
CreateWindowExW
RegisterClassExW
SetForegroundWindow
DestroyWindow
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromString
OleInitialize
OleUninitialize
Number of PE resources by type
RT_STRING 9
RT_DIALOG 6
RT_ICON 4
RT_MANIFEST 1
RT_BITMAP 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 22
PE resources
Debug information
ExifTool file metadata
MIMEType
application/octet-stream

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

FileTypeExtension
exe

TimeStamp
2015:10:02 09:17:46+01:00

FileType
Win32 EXE

PEType
PE32

CodeSize
114688

LinkerVersion
9.0

EntryPoint
0x1115c

InitializedDataSize
228864

SubsystemVersion
5.0

ImageVersion
0.0

OSVersion
5.0

UninitializedDataSize
0

File identification
MD5 b6307f6313d9a1e7c6b2dbe5260395af
SHA1 d5e3b54782301ae73c6d71f9f4a2183399caf0fa
SHA256 f8c53cb9cf976bcfa5e71f448b69f509b227a9ab02e82f1ca62b151586bbc78c
ssdeep
393216:kD+txVZdHE+FqlB0V0VyzI1nUsCOOYKO/wCT7/6rdE:xxZWAq8QA4jt57/6u

authentihash ac499b4080094eae27d5b20301ed4f871ea213fd724bb08af8e8d514b84f3f00
imphash 2f189ddddc40007d1f3710870de5a8b2
File size 15.2 MB ( 15892812 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (42.2%)
Win64 Executable (generic) (37.3%)
Win32 Dynamic Link Library (generic) (8.8%)
Win32 Executable (generic) (6.0%)
Generic Win/DOS Executable (2.7%)
Tags
peexe overlay

VirusTotal metadata
First submission 2016-08-25 12:27:36 UTC ( 10 months ago )
Last submission 2017-03-18 07:03:32 UTC ( 3 months, 1 week ago )
File names StrangerThingsv1_0.exe
StrangerThingsv1_0.exe
StrangerThingsv1_0.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Runtime DLLs
UDP communications