| SHA256: | 4ad4a5e11b0ba2ebaae1fa2d7185718c8a113ced52a4b5df0a050fcbf0bfdcbb |
| Nom du fichier : | qrymao_fromSakura |
| Ratio de détection : | 4 / 46 |
| Date d'analyse : | 2013-08-16 23:47:07 UTC (il y a 5 ans, 2 mois) Voir les derniers |
| Antivirus | Résultat | Mise à jour |
|---|---|---|
| Kaspersky | Backdoor.Win32.ZAccess.cxxo | 20130817 |
| Malwarebytes | Backdoor.0Access | 20130816 |
| Panda | Suspicious file | 20130816 |
| Sophos AV | Troj/ZAccess-PI | 20130816 |
| Yandex | 20130816 | |
| AhnLab-V3 | 20130816 | |
| AntiVir | 20130816 | |
| Antiy-AVL | 20130816 | |
| Avast | 20130817 | |
| AVG | 20130816 | |
| BitDefender | 20130817 | |
| ByteHero | 20130814 | |
| CAT-QuickHeal | 20130816 | |
| ClamAV | 20130816 | |
| Commtouch | 20130817 | |
| Comodo | 20130816 | |
| DrWeb | 20130817 | |
| Emsisoft | 20130817 | |
| ESET-NOD32 | 20130816 | |
| F-Prot | 20130817 | |
| F-Secure | 20130817 | |
| Fortinet | 20130817 | |
| GData | 20130817 | |
| Ikarus | 20130816 | |
| Jiangmin | 20130816 | |
| K7AntiVirus | 20130816 | |
| K7GW | 20130816 | |
| Kingsoft | 20130723 | |
| McAfee | 20130817 | |
| McAfee-GW-Edition | 20130816 | |
| Microsoft | 20130816 | |
| eScan | 20130817 | |
| NANO-Antivirus | 20130817 | |
| Norman | 20130816 | |
| nProtect | 20130816 | |
| PCTools | 20130816 | |
| Rising | 20130816 | |
| SUPERAntiSpyware | 20130816 | |
| Symantec | 20130816 | |
| TheHacker | 20130816 | |
| TotalDefense | 20130816 | |
| TrendMicro | 20130817 | |
| TrendMicro-HouseCall | 20130816 | |
| VBA32 | 20130816 | |
| VIPRE | 20130817 | |
| ViRobot | 20130816 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright 2004-2009
Publisher TorchSoft
Product Registry Workshop
Original name RegWorkshop.dll
Internal name Registry Workshop
File version 4, 1, 0, 0
Description Registry Workshop
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2013-08-16 10:59:01
Entry Point 0x00003535
Number of sections 5
PE sections
PE imports
Number of PE resources by type
RT_ICON 2
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 5
PE resources
ExifTool file metadata
SubsystemVersion
5.0
LinkerVersion
10.0
ImageVersion
0.0
FileSubtype
0
FileVersionNumber
4.1.0.0
UninitializedDataSize
0
LanguageCode
English (U.S.)
FileFlagsMask
0x0000
CharacterSet
Unicode
InitializedDataSize
103424
FileOS
Win32
MIMEType
application/octet-stream
LegalCopyright
Copyright 2004-2009
FileVersion
4, 1, 0, 0
TimeStamp
2013:08:16 11:59:01+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
Registry Workshop
ProductVersion
4, 1, 0, 0
FileDescription
Registry Workshop
OSVersion
5.0
OriginalFilename
RegWorkshop.dll
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
TorchSoft
CodeSize
78848
ProductName
Registry Workshop
ProductVersionNumber
4.1.0.0
EntryPoint
0x3535
ObjectFileType
Dynamic link library
File identification
MD5 64fca5d4cc118384a1dd4d12d1028914
SHA1 8df942c3587447e32dec8d3a38383b5295937475
SHA256 4ad4a5e11b0ba2ebaae1fa2d7185718c8a113ced52a4b5df0a050fcbf0bfdcbb
ssdeep
3072:5OMJI/CKAQ8FCgWqLCqrzx5bgqMvHuc6JjnHBvwefT/Kc7br65yUdRWVs+RrH:53JGATF8qLCMzxlnJjnP7Kc7OyiMVtr
File size
144.0 KB ( 147456 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable MS Visual C++ (generic) (67.3%) Win32 Dynamic Link Library (generic) (14.2%) Win32 Executable (generic) (9.7%) Generic Win/DOS Executable (4.3%) DOS Executable Generic (4.3%) |
Tags
peexe
VirusTotal metadata
First submission
2013-08-16 23:47:07 UTC (il y a 5 ans, 2 mois)
Last submission
2013-12-04 07:43:03 UTC (il y a 4 ans, 10 mois)
| Noms du fichier |
RegWorkshop.dll 4ad4a5e11b0ba2ebaae1fa2d7185718c8a113ced52a4b5df0a050fcbf0bfdcbb Registry Workshop qrymao_fromSakura |
Advanced heuristic and reputation engines
F-Secure Deepguard
Suspicious:W32/Malware!Gemini
Symantec reputation
Suspicious.Insight
Aucun commentaire.
Aucun membre de la communauté VirusTotal n'a encore commenté cet élément, soyez le premier à le faire !
Vous n'êtes pas connecté. Seuls les utilisateurs enregistrés peuvent laisser des commentaires, connectez-vous pour commenter !
Aucun vote.
Personne n'a encore voté pour cet élément, soyez le premier à le faire !