× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: faec05cb56ff585a683cbe6e0a6e5ec240f9529665c1435e063548f3ed82cf14
File name: FAEC05CB56FF585A683CBE6E0A6E5EC240F9529665C1435E063548F3ED82CF14
Detection ratio: 6 / 59
Analysis date: 2017-02-17 16:31:51 UTC ( 2 years ago ) View latest
Antivirus Result Update
CrowdStrike Falcon (ML) malicious_confidence_100% (D) 20170130
Endgame malicious (high confidence) 20170217
Sophos ML virus.win32.ramnit.ah 20170203
Qihoo-360 HEUR/QVM10.1.0000.Malware.Gen 20170217
Rising Malware.Generic.6!tfe (thunder:6:3wlDARhRXuS) 20170217
Symantec ML.Attribute.HighConfidence 20170217
Ad-Aware 20170217
AegisLab 20170217
AhnLab-V3 20170217
Alibaba 20170217
ALYac 20170217
Antiy-AVL 20170217
Arcabit 20170217
Avast 20170217
AVG 20170217
Avira (no cloud) 20170217
AVware 20170217
Baidu 20170217
BitDefender 20170217
Bkav 20170217
CAT-QuickHeal 20170217
ClamAV 20170217
CMC 20170217
Comodo 20170217
Cyren 20170217
DrWeb 20170217
Emsisoft 20170217
ESET-NOD32 20170217
F-Prot 20170217
F-Secure 20170217
Fortinet 20170217
GData 20170217
Ikarus 20170217
Jiangmin 20170217
K7AntiVirus 20170217
K7GW 20170217
Kaspersky 20170217
Kingsoft 20170217
Malwarebytes 20170217
McAfee 20170217
McAfee-GW-Edition 20170216
Microsoft 20170217
eScan 20170217
NANO-Antivirus 20170217
nProtect 20170217
Panda 20170217
Sophos AV 20170217
SUPERAntiSpyware 20170217
Tencent 20170217
TheHacker 20170217
TotalDefense 20170217
TrendMicro 20170217
TrendMicro-HouseCall 20170217
Trustlook 20170217
VBA32 20170217
VIPRE 20170217
ViRobot 20170217
Webroot 20170217
WhiteArmor 20170215
Yandex 20170217
Zillya 20170216
Zoner 20170217
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright 2015 MSoft

Product WorseNeedhelp
Internal name WorseNeedhelp
File version 3.7.1.8
Description Versin Milling
Comments Versin Milling
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2017-02-17 10:37:41
Entry Point 0x0000855D
Number of sections 5
PE sections
PE imports
OpenProcessToken
GetUserNameW
PrivilegeCheck
OpenThreadToken
RegEnumKeyA
RegOpenKeyExA
IsTextUnicode
GetOpenFileNameA
ChooseFontA
CertGetNameStringA
GetObjectA
GetDeviceCaps
DeleteDC
DeleteObject
GetStockObject
GetBitmapDimensionEx
CreateFontIndirectA
GetTextMetricsA
SelectObject
CreateEllipticRgnIndirect
BitBlt
SetTextAlign
GetDIBits
CreateCompatibleDC
GetBitmapBits
CreateCompatibleBitmap
SetTextColor
ImmSetConversionStatus
ImmReleaseContext
ImmSetOpenStatus
ImmCreateContext
ImmGetContext
CreateIpForwardEntry
CreateIpNetEntry
GetStdHandle
GetDriveTypeW
FileTimeToSystemTime
EncodePointer
GetLocalTime
DeleteCriticalSection
GetCurrentProcess
GetCurrentDirectoryA
GetConsoleMode
GetLocaleInfoA
LocalAlloc
FreeEnvironmentStringsW
lstrcatW
SetStdHandle
WideCharToMultiByte
WriteFile
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
GetFullPathNameA
LocalFree
OutputDebugStringW
FindClose
TlsGetValue
EnumDateFormatsA
SetLastError
GetModuleFileNameW
IsDebuggerPresent
HeapAlloc
GetModuleFileNameA
HeapSetInformation
UnhandledExceptionFilter
InterlockedDecrement
MultiByteToWideChar
FlushInstructionCache
GetModuleHandleA
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TzSpecificLocalTimeToSystemTime
SetEnvironmentVariableA
TerminateProcess
GlobalAlloc
GetCurrentThreadId
InterlockedIncrement
SetCurrentDirectoryA
WriteConsoleW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
SetHandleCount
LoadLibraryW
GetOEMCP
QueryPerformanceCounter
GetTickCount
DisableThreadLibraryCalls
TlsAlloc
VirtualProtect
FlushFileBuffers
RtlUnwind
DecodePointer
GetStartupInfoW
GetProcAddress
CompareStringW
lstrcpyW
FindFirstFileExA
FindNextFileW
CreateFileMappingA
FindFirstFileW
GetTimeZoneInformation
CreateFileW
GetFileType
TlsSetValue
CreateFileA
ExitProcess
LeaveCriticalSection
GetLastError
IsValidCodePage
SystemTimeToFileTime
LCMapStringW
HeapCreate
GlobalFree
GetConsoleCP
GetEnvironmentStringsW
FileTimeToLocalFileTime
CompareFileTime
GetCurrentProcessId
GetCPInfo
HeapSize
GetCommandLineA
GetCurrentThread
RaiseException
MapViewOfFile
TlsFree
SetFilePointer
CloseHandle
GetACP
GetModuleHandleW
GetCurrentDirectoryW
UnmapViewOfFile
Sleep
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
EmptyClipboard
GetForegroundWindow
SetWindowRgn
SetPropA
EndDialog
BeginPaint
FindWindowW
NotifyWinEvent
FindWindowA
DrawFrameControl
GetWindowThreadProcessId
SendDlgItemMessageA
GetSystemMetrics
EndPaint
SetMenu
MessageBoxIndirectA
GetDlgItemTextA
GetScrollRange
AppendMenuW
GetWindow
GetSysColor
GetDC
CreateDialogParamW
ReleaseDC
CreatePopupMenu
SetClipboardData
SendMessageA
GetClientRect
CreateMenu
GetDlgItem
DrawMenuBar
SetCursor
MonitorFromWindow
SetRect
wsprintfA
FindWindowExA
CreateWindowExA
LoadCursorA
GetKeyboardLayout
IsDlgButtonChecked
LoadImageA
CloseClipboard
DestroyWindow
OpenClipboard
DrawThemeBackground
getaddrinfo
WSAAsyncGetServByPort
bind
WSACleanup
WSAStartup
freeaddrinfo
socket
ioctlsocket
closesocket
listen
EnumerateLoadedModules
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipGraphicsClear
GdipDisposeImage
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipAlloc
GdipDrawImageRectI
GdipCloneImage
GdiplusStartup
GdipGetImageWidth
GdipDrawImageI
GdipGetImageGraphicsContext
GdipFree
GdipDeleteGraphics
PE exports
Number of PE resources by type
RT_STRING 14
RCDATA 8
RT_RCDATA 6
RT_GROUP_CURSOR 5
RT_ICON 5
RT_CURSOR 4
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 45
PE resources
ExifTool file metadata
UninitializedDataSize
0

Comments
Versin Milling

LinkerVersion
10.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
3.7.1.8

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

CharacterSet
Unicode

InitializedDataSize
239104

EntryPoint
0x855d

MIMEType
application/octet-stream

LegalCopyright
Copyright 2015 MSoft

FileVersion
3.7.1.8

TimeStamp
2017:02:17 11:37:41+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
WorseNeedhelp

SubsystemVersion
5.1

ProductVersion
3.7.1.8

FileDescription
Versin Milling

OSVersion
5.1

FileOS
Windows NT 32-bit

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
MSoft

CodeSize
90624

ProductName
WorseNeedhelp

ProductVersionNumber
3.7.1.8

FileTypeExtension
exe

ObjectFileType
Executable application

File identification
MD5 b5da20567575acfb2d385060b1a2cb39
SHA1 c9686cdc984e6892b57a91dfcab9346533ae25fd
SHA256 faec05cb56ff585a683cbe6e0a6e5ec240f9529665c1435e063548f3ed82cf14
ssdeep
6144:ltOCWDtYHprJWYzdwZ8Wg61VmNOLL0wdk/VRhsyJ:QDtYHtAYzaRTEfwdoUyJ

authentihash c1dfd6ea7419b364bc3cdb8f711079a7772206bc51653bb7d799e0110f30e5d7
imphash 850651512a57b2e413b1accf420fd2b8
File size 323.0 KB ( 330752 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (42.2%)
Win64 Executable (generic) (37.3%)
Win32 Dynamic Link Library (generic) (8.8%)
Win32 Executable (generic) (6.0%)
Generic Win/DOS Executable (2.7%)
Tags
peexe

VirusTotal metadata
First submission 2017-02-17 16:31:51 UTC ( 2 years ago )
Last submission 2017-02-17 16:31:51 UTC ( 2 years ago )
File names WorseNeedhelp
11.exe
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Written files
Moved files
Deleted files
Created processes
Shell commands
Code injections in the following processes
Created mutexes
Opened mutexes
Searched windows
Opened service managers
Opened services
Runtime DLLs
Additional details
The file uses the IsDebuggerPresent Windows API function in order to see whether it is being debugged.
HTTP requests
TCP connections