| SHA256: | 746b9a5c26cae1980a224afc7b2be1a836a7709532bd35c8d0d36f94ed1c84ea |
| Nom du fichier : | EZBlocker.exe |
| Ratio de détection : | 1 / 55 |
| Date d'analyse : | 2016-12-18 21:32:47 UTC (il y a 1 an, 4 mois) Voir les derniers |
| Antivirus | Résultat | Mise à jour |
|---|---|---|
| Rising | Malware.Undefined!8.C-zPw7H6Ix7SI (cloud) | 20161218 |
| Ad-Aware | 20161218 | |
| AegisLab | 20161217 | |
| AhnLab-V3 | 20161218 | |
| Alibaba | 20161216 | |
| ALYac | 20161218 | |
| Antiy-AVL | 20161218 | |
| Arcabit | 20161218 | |
| Avast | 20161218 | |
| AVG | 20161218 | |
| Avira (no cloud) | 20161218 | |
| AVware | 20161218 | |
| Baidu | 20161207 | |
| BitDefender | 20161218 | |
| Bkav | 20161217 | |
| CAT-QuickHeal | 20161217 | |
| ClamAV | 20161218 | |
| CMC | 20161218 | |
| Comodo | 20161218 | |
| CrowdStrike Falcon (ML) | 20161024 | |
| Cyren | 20161218 | |
| DrWeb | 20161218 | |
| Emsisoft | 20161218 | |
| ESET-NOD32 | 20161218 | |
| F-Prot | 20161218 | |
| F-Secure | 20161218 | |
| Fortinet | 20161218 | |
| GData | 20161218 | |
| Ikarus | 20161218 | |
| Sophos ML | 20161216 | |
| Jiangmin | 20161218 | |
| K7AntiVirus | 20161218 | |
| K7GW | 20161218 | |
| Kaspersky | 20161218 | |
| Kingsoft | 20161218 | |
| Malwarebytes | 20161218 | |
| McAfee | 20161218 | |
| McAfee-GW-Edition | 20161218 | |
| Microsoft | 20161218 | |
| eScan | 20161218 | |
| NANO-Antivirus | 20161218 | |
| nProtect | 20161218 | |
| Panda | 20161218 | |
| Qihoo-360 | 20161218 | |
| Sophos AV | 20161218 | |
| SUPERAntiSpyware | 20161218 | |
| Symantec | 20161218 | |
| Tencent | 20161218 | |
| TheHacker | 20161214 | |
| TrendMicro | 20161218 | |
| TrendMicro-HouseCall | 20161218 | |
| Trustlook | 20161218 | |
| VBA32 | 20161216 | |
| VIPRE | 20161218 | |
| ViRobot | 20161218 | |
| WhiteArmor | 20161212 | |
| Yandex | 20161217 | |
| Zillya | 20161216 | |
| Zoner | 20161218 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
Copyright © 2012-2016 Eric Zhang
Product EZBlocker
Original name EZBlocker.exe
Internal name EZBlocker.exe
File version 1.6.8.4
Description EZBlocker
Comments http://www.ericzhang.me
Signature verification
Signed file, verified signature
Signing date 8:38 AM 12/2/2016
| Signers |
| Counter signers |
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2016-12-02 07:32:41
Entry Point 0x001798BA
Number of sections 3
.NET details
Module Version ID
5cea501e-ea78-4a24-a3e0-671093fdfb3b
TypeLib ID
21d38de5-96a9-42ae-ba70-224adfd93c5d
PE sections
Overlays
MD5 2872ed5dc9d216004f1293e8e5b0fae2
File type data
Offset 1974272
Size 6312
Entropy 7.32
PE imports
Number of PE resources by type
RT_ICON 9
RT_GROUP_ICON 1
RT_VERSION 1
RT_MANIFEST 1
Number of PE resources by language
NEUTRAL 12
PE resources
Debug information
ExifTool file metadata
SubsystemVersion
6.0
Comments
http://www.ericzhang.me
InitializedDataSize
435200
ImageVersion
0.0
FileSubtype
0
FileVersionNumber
1.6.8.4
LanguageCode
Neutral
FileFlagsMask
0x003f
FileDescription
EZBlocker
CharacterSet
Unicode
LinkerVersion
48.0
EntryPoint
0x1798ba
OriginalFileName
EZBlocker.exe
MIMEType
application/octet-stream
LegalCopyright
Copyright 2012-2016 Eric Zhang
FileVersion
1.6.8.4
TimeStamp
2016:12:02 08:32:41+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
EZBlocker.exe
ProductVersion
1.6.8.4
UninitializedDataSize
0
OSVersion
4.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
Eric Zhang
CodeSize
1538560
ProductName
EZBlocker
ProductVersionNumber
1.6.8.4
FileTypeExtension
exe
ObjectFileType
Executable application
AssemblyVersion
1.6.8.4
CarbonBlack
CarbonBlack acts as a surveillance camera for computers
While monitoring an end-user machine in-the-wild, CarbonBlack noticed the
following files in execution wrote this sample to disk.
While monitoring an end-user machine in-the-wild, CarbonBlack noticed this
sample wrote the following files to disk.
Execution parents
PE resource-wise parents
Compressed bundles
File identification
MD5 e4de4313e45dd3990b33069658f24544
SHA1 013d8f102b4333076e8b939d98994fbf1a823308
SHA256 746b9a5c26cae1980a224afc7b2be1a836a7709532bd35c8d0d36f94ed1c84ea
ssdeep
24576:3Rr1FZihw6XRr1FZihw6jpzD6BZVz346c5HR3TFZiSJR:3RrM3XRrM3j96BZVyR3ae
File size
1.9 MB ( 1980584 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 Mono/.Net assembly
| TrID |
Win32 EXE PECompact compressed (generic) (29.7%) Win64 Executable (generic) (19.7%) UPX compressed Win32 Executable (19.3%) Win32 EXE Yoda's Crypter (18.9%) Win32 Dynamic Link Library (generic) (4.7%) |
Tags
peexe
assembly
signed
overlay
VirusTotal metadata
First submission
2016-12-02 09:31:15 UTC (il y a 1 an, 4 mois)
Last submission
2018-03-12 10:23:52 UTC (il y a 1 mois, 1 semaine)
| Noms du fichier |
EZBlocker.exe EZBlocker.exe EZBlocker.exe Spotify_adblocker.exe EZBlocker.exe ezblocker[1].exe EZBlocker (4).exe EZBlocker.exe EZBlocker.exe ezblocker.exe.zpy62zf.partial EZBlocker.1.6.8.4.exe EZBlocker.exe EZBlocker.exe EZBlocker.exe ezblocker.exe EZBlocker [bySomeTrash.tk].exe SpotifyPremium-Dinero4Free.exe Ezblockerr.exe ezblocker.exe EZBlocker.exe Mod - TutorialesCesar.exe EZBlocker.exe EZBlocker (1).exe Mod de Spotify Premium.exe bind0.exe |
Advanced heuristic and reputation engines
F-Secure Deepguard
Suspicious:W32/Malware!Online
Aucun commentaire.
Aucun membre de la communauté VirusTotal n'a encore commenté cet élément, soyez le premier à le faire !
Vous n'êtes pas connecté. Seuls les utilisateurs enregistrés peuvent laisser des commentaires, connectez-vous pour commenter !
Aucun vote.
Personne n'a encore voté pour cet élément, soyez le premier à le faire !
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.