Antivirus scan for f90823a28728bdf3e6421f487d06348415320d4550a3f02785734020659627e9 at 2018-08-08 21:13:41 UTC

Antivirus	Result	Update
Ad-Aware	Trojan.GenericKD.40376149	20180808
AhnLab-V3	Trojan/Win32.Emotet.R233699	20180808
ALYac	Trojan.Agent.Emotet	20180808
Arcabit	Trojan.Generic.D2681755	20180808
Avast	Win32:Trojan-gen	20180808
AVG	Win32:Trojan-gen	20180808
Avira (no cloud)	TR/Kryptik.gxzts	20180808
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9999	20180808
BitDefender	Trojan.GenericKD.40376149	20180808
CAT-QuickHeal	Trojan.Emotet.X4	20180807
ClamAV	Win.Trojan.Agent-6638554-0	20180808
CrowdStrike Falcon (ML)	malicious_confidence_100% (D)	20180723
Cybereason	malicious.f17d3a	20180225
Cylance	Unsafe	20180808
DrWeb	Trojan.EmotetENT.258	20180808
Emsisoft	Trojan.GenericKD.40376149 (B)	20180808
Endgame	malicious (high confidence)	20180730
ESET-NOD32	a variant of Win32/Kryptik.GJPF	20180808
F-Secure	Trojan.GenericKD.40376149	20180808
Fortinet	W32/GenKryptik.CHKB!tr	20180808
GData	Win32.Trojan-Spy.Emotet.SU	20180808
Ikarus	Trojan.Win32.Krypt	20180808
Sophos ML	heuristic	20180717
K7AntiVirus	Trojan ( 00539c721 )	20180808
K7GW	Trojan ( 00539c721 )	20180808
Kaspersky	Trojan-Banker.Win32.Emotet.baig	20180808
Malwarebytes	Trojan.Emotet	20180808
MAX	malware (ai score=100)	20180808
McAfee	Artemis!A399B354C143	20180808
McAfee-GW-Edition	BehavesLike.Win32.Virut.dt	20180808
Microsoft	Trojan:Win32/Emotet.AC!bit	20180808
eScan	Trojan.GenericKD.40376149	20180808
Palo Alto Networks (Known Signatures)	generic.ml	20180808
Panda	Trj/Emotet.C	20180808
Qihoo-360	HEUR/QVM20.1.02F1.Malware.Gen	20180808
Rising	Trojan.Fuerboos!8.EFC8 (CLOUD)	20180808
SentinelOne (Static ML)	static engine - malicious	20180701
Sophos AV	Mal/EncPk-ANX	20180808
Symantec	Trojan.Gen.2	20180808
TACHYON	Trojan/W32.Agent.270336.ARM	20180808
Tencent	Win32.Trojan-banker.Emotet.Lmar	20180808
TrendMicro	TSPY_EMOTET.THHOGAH	20180808
TrendMicro-HouseCall	TSPY_EMOTET.THHOGAH	20180808
ViRobot	Trojan.Win32.Z.Emotet.270336.I	20180808
Webroot	W32.Trojan.Emotet	20180808
ZoneAlarm by Check Point	Trojan-Banker.Win32.Emotet.baig	20180808
AegisLab		20180808
Alibaba		20180713
Antiy-AVL		20180808
Avast-Mobile		20180808
AVware		20180727
Babable		20180725
Bkav		20180807
CMC		20180808
Comodo		20180808
Cyren		20180808
eGambit		20180808
F-Prot		20180808
Jiangmin		20180808
Kingsoft		20180808
NANO-Antivirus		20180808
SUPERAntiSpyware		20180808
Symantec Mobile Insight		20180801
TheHacker		20180807
TotalDefense		20180808
Trustlook		20180808
VBA32		20180808
VIPRE		20180808
Yandex		20180808
Zillya		20180808
Zoner		20180808

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2018-08-07 04:18:28

Entry Point 0x00001A09

Number of sections 6

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.CRT 4096 10574 12288 5.78 a77788c8717c228270847ae18f0e7010

.rdata 16384 13384 14336 3.05 2406a8cc870ed4e4d640686e955d8a08

.data 32768 114996 112640 1.71 4173739dd414774fdd6844c1b1f9c514

CONST 151552 106977 108544 7.43 6b04e0574fb0bcbfe94ec385afbddb60

.rsrc 262144 13920 14336 3.74 511394fcf14fff465dd8ec9b95213499

.reloc 278528 4240 6144 4.86 f3d481323d58167c31c37a89c2e5a449

PE imports

Number of PE resources by type

RT_STRING 15

RT_BITMAP 13

Number of PE resources by language

NEUTRAL 26

CHINESE TRADITIONAL 1

SPANISH 1

PE resources

0f5248f16fe2b1e73aa9be760a6f0bef933dc09e3cc6d8a8958eae1ce0bd0f97 data

1393255f51eb7f6ba1846c66ef93761f14661368eba6f110d2e34903e3653d2e ASCII text

17b07efdaa0a29047984ccc097bbbe258ffcb76dad8ea803f14e5473ec77791c ASCII text

2cb60d7d674640457497f54b82b42afaa8a2cbd7c28a1aae35f128b4471cfaaa data

369c5223029ea6d1b17b7f24a8d84c10f528457e79be3349a6c55efd0e8f0e02 ASCII text

3a0969803f248355c08a55fb93099ab7616142cd95b50750d3d0fb461e319448 ASCII text

3cf8dd24fcb6e2b44ee8af90436ccf5ff6876969031ee19d62ca7b6040b9675a ASCII text

4a217ca811d9c29363ead1d67b7ffa0f6e8b8e1d1a068730f4f7d557c3710b44 data

4ae8b4d06d5719e7f792fafdb8ecb1772862ca78d4747dbe7c17903c25f2f580 ASCII text

4f72c53f3bac49ce0b7c248152479a14e383a90c9fe95edbddec9f03784ca698 data

Debug information

Type Timestamp Offset Size

4359852 (4359852) Wed Feb 18 18:21:42 1970 2404186920 1510002350 Bytes

3917779365 (3917779365) Sat Sep 11 05:17:42 2027 0 424458981 Bytes

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

SubsystemVersion

5.1

MachineType

Intel 386 or later, and compatibles

TimeStamp

2018:08:07 05:18:28+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

12288

LinkerVersion

15.0

FileTypeExtension

exe

InitializedDataSize

260096

ImageFileCharacteristics

Executable, 32-bit

EntryPoint

0x1a09

OSVersion

5.0

ImageVersion

0.0

UninitializedDataSize

File identification

MD5 a399b354c14392cf233e4b5f46546741

SHA1 dc9dcfbf17d3a3588e22a06de38304a6be2038d2

SHA256 f90823a28728bdf3e6421f487d06348415320d4550a3f02785734020659627e9

ssdeep

3072:5Ri1g16eoCDhW0DC5bj9VStPEmCdYFPuAi0KKYUdBTmC1LhdP+42k:5Ri1y68D+VSt8mdG8eUdBTmYLhR

authentihash e0f1bd9a6f15882859c1a284174d489e276a3bea173e7bac5110ea2041dd47f2

imphash 95049acca1216c1e2c47bb156e62113c

File size 264.0 KB ( 270336 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (38.4%) Win32 Executable (generic) (26.3%) OS/2 Executable (generic) (11.8%) Generic Win/DOS Executable (11.6%) DOS Executable Generic (11.6%)

VirusTotal metadata

First submission 2018-08-07 04:25:01 UTC ( 3 months, 2 weeks ago )

Last submission 2018-08-07 04:25:12 UTC ( 3 months, 2 weeks ago )

Advanced heuristic and reputation engines

F-Secure Deepguard Suspicious:W32/Malware!Online

SHA256:	f90823a28728bdf3e6421f487d06348415320d4550a3f02785734020659627e9
File name:	f90823a28728bdf3e6421f487d06348415320d4550a3f02785734020659627e9
Detection ratio:	46 / 68
Analysis date:	2018-08-08 21:13:41 UTC ( 3 months, 1 week ago ) View latest

Ciphered bundle