| SHA256: | 9c5e1ca4843c725516fdd0f114519434ee2e55e01e377e161aa41617c717a4c6 |
| שם קובץ: | Lotus.Trilogy.(v3.0)(1990-1994)(Magnetic.Fields)(+t)-TheCompany.exe |
| יחס זיהוי: | 1 / 67 |
| תאריך ניתוח: | 2018-09-24 12:06:35 UTC ( 2 חודשים, 2 שבועות לפני ) הצג אחרון |
| אנטי־וירוס | תוצאה | עדכן |
|---|---|---|
| Jiangmin | Trojan.PSW.Coins.ajb | 20180924 |
| Ad-Aware | 20180924 | |
| AegisLab | 20180924 | |
| AhnLab-V3 | 20180924 | |
| Alibaba | 20180921 | |
| ALYac | 20180924 | |
| Antiy-AVL | 20180924 | |
| Arcabit | 20180924 | |
| Avast | 20180924 | |
| Avast-Mobile | 20180924 | |
| AVG | 20180924 | |
| Avira (no cloud) | 20180924 | |
| AVware | 20180924 | |
| Babable | 20180918 | |
| Baidu | 20180914 | |
| BitDefender | 20180924 | |
| Bkav | 20180924 | |
| CAT-QuickHeal | 20180923 | |
| CMC | 20180924 | |
| Comodo | 20180924 | |
| CrowdStrike Falcon (ML) | 20180723 | |
| Cybereason | 20180225 | |
| Cylance | 20180924 | |
| Cyren | 20180924 | |
| DrWeb | 20180924 | |
| eGambit | 20180924 | |
| Emsisoft | 20180924 | |
| Endgame | 20180730 | |
| ESET-NOD32 | 20180924 | |
| F-Prot | 20180924 | |
| F-Secure | 20180924 | |
| Fortinet | 20180924 | |
| GData | 20180924 | |
| Ikarus | 20180924 | |
| Sophos ML | 20180717 | |
| K7AntiVirus | 20180924 | |
| K7GW | 20180924 | |
| Kaspersky | 20180924 | |
| Kingsoft | 20180924 | |
| Malwarebytes | 20180924 | |
| MAX | 20180924 | |
| McAfee | 20180924 | |
| McAfee-GW-Edition | 20180924 | |
| Microsoft | 20180924 | |
| eScan | 20180924 | |
| NANO-Antivirus | 20180924 | |
| Palo Alto Networks (Known Signatures) | 20180924 | |
| Panda | 20180923 | |
| Qihoo-360 | 20180924 | |
| Rising | 20180924 | |
| SentinelOne (Static ML) | 20180830 | |
| Sophos AV | 20180924 | |
| SUPERAntiSpyware | 20180907 | |
| Symantec | 20180924 | |
| Symantec Mobile Insight | 20180924 | |
| TACHYON | 20180924 | |
| Tencent | 20180924 | |
| TheHacker | 20180920 | |
| TrendMicro | 20180924 | |
| TrendMicro-HouseCall | 20180924 | |
| Trustlook | 20180924 | |
| VBA32 | 20180924 | |
| VIPRE | 20180924 | |
| ViRobot | 20180923 | |
| Webroot | 20180924 | |
| Yandex | 20180922 | |
| Zillya | 20180922 | |
| ZoneAlarm by Check Point | 20180924 | |
| Zoner | 20180923 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
Copyright © 2008-2018 The Company. All rights reserved.
Product Lotus Trilogy
Original name tcw.exe
Internal name tcw.exe
File version 3.0.0.0.1_Alpha
Description www.TheCompany.pl
Comments www.TheCompany.pl
Signature verification
Signed file, verified signature
Signing date 3:22 AM 9/17/2018
| Signers |
| Counter signers |
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2018-09-17 02:21:10
Entry Point 0x0000287A
Number of sections 6
PE sections
Overlays
MD5 e80a94e0876d12a9364e39ad7f572060
File type data
Offset 308224
Size 9863216
Entropy 7.74
PE imports
Number of PE resources by type
RT_ICON 4
RT_GROUP_ICON 1
RT_VERSION 1
RT_MANIFEST 1
Number of PE resources by language
NEUTRAL 7
PE resources
ExifTool file metadata
SubsystemVersion
5.1
Comments
www.TheCompany.pl
LinkerVersion
11.0
ImageVersion
0.0
FileSubtype
0
FileVersionNumber
3.0.0.0
Website
www.thecompany.pl
LanguageCode
Neutral
FileFlagsMask
0x003f
FileDescription
www.TheCompany.pl
ImageFileCharacteristics
Executable, 32-bit
CharacterSet
Unicode
InitializedDataSize
289280
EntryPoint
0x287a
OriginalFileName
tcw.exe
MIMEType
application/octet-stream
LegalCopyright
Copyright 2008-2018 The Company. All rights reserved.
FileVersion
3.0.0.0.1_Alpha
TimeStamp
2018:09:17 03:21:10+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
tcw.exe
ProductVersion
3.0.0.0.1_Alpha
UninitializedDataSize
0
OSVersion
5.1
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
2008-2018 The Company
CodeSize
17920
ProductName
Lotus Trilogy
ProductVersionNumber
3.0.0.0
FileTypeExtension
exe
ObjectFileType
Executable application
File identification
MD5 9cbe40da60b793951d2dc47885598217
SHA1 303ec1169b4493f83d61fcc5007d5ee1f7509d0e
SHA256 9c5e1ca4843c725516fdd0f114519434ee2e55e01e377e161aa41617c717a4c6
ssdeep
196608:3/zZduwyuQsWouG8kami5rJznE+5yiRUcSp6Na:3/rumQdG8kCrtTRUkNa
קודל קובץ
9.7 מ"ב ( 10171440 bytes )
סוג קובץ Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Windows ActiveX control (56.1%) Win32 Executable MS Visual C++ (generic) (15.0%) Win64 Executable (generic) (13.3%) Windows screen saver (6.3%) Win32 Dynamic Link Library (generic) (3.1%) |
Tags
peexe
signed
overlay
VirusTotal metadata
First submission
2018-09-24 12:06:35 UTC ( 2 חודשים, 2 שבועות לפני )
Last submission
2018-09-24 12:06:35 UTC ( 2 חודשים, 2 שבועות לפני )
| שמות קבצים |
Lotus.Trilogy.(v3.0)(1990-1994)(Magnetic.Fields)(+t)-TheCompany.exe tcw.exe |
אין תגובות.
אף חבר קהילה של VirusTotal הגיב על הפריט הזה. היה הראשון לעשות זאת!
אתה לא מחובר. רק משתמשים רשומים יכולים להשאיר תגובה. והתחבר והראה את קולך!
אין הצבעות.
אף אחד לא הצביע על קובץ זה. היה הראשון לעשות זאת!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Created processes
Shell commands
Created mutexes
Opened mutexes
Opened service managers
Opened services
Hooking activity
Runtime DLLs
Additional details
The file uses the
IsDebuggerPresent Windows API function in order to see whether it is being debugged.
The file installs an application-defined hook procedure into a hook chain. You
would install a hook procedure to monitor the system for certain types of
events. These events are associated either with a specific thread or with all
threads in the same desktop as the calling thread. This is done making use of
the
SetWindowsHook Windows API function.