Antivirus scan for f845c4b674de79c8c528d15f6f0ab2ba4c471a58a214943b31ae7cf17ed4165b at 2017-01-07 01:56:49 UTC

אנטי־וירוס	תוצאה	עדכן
Antiy-AVL	Trojan/Win32.AGeneric	20170107
AVG	Generic38.AGCZ	20170107
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9740	20170106
Sophos ML	trojan.win32.dorv.a!rfn	20161216
Jiangmin	PSWTool.NetPass.dp	20170106
K7AntiVirus	Unwanted-Program ( 004f9a671 )	20170106
K7GW	Unwanted-Program ( 004f9a671 )	20170107
Qihoo-360	QVM41.1.Malware.Gen	20170107
Rising	Malware.Generic!WiFrbDTHthD@5 (thunder)	20170107
Ad-Aware		20170107
AegisLab		20170107
AhnLab-V3		20170106
Alibaba		20170107
ALYac		20170107
Arcabit		20170107
Avast		20170107
Avira (no cloud)		20170106
AVware		20170107
BitDefender		20170107
Bkav		20170106
CAT-QuickHeal		20170106
ClamAV		20170106
CMC		20170106
Comodo		20170106
CrowdStrike Falcon (ML)		20161024
Cyren		20170107
DrWeb		20170107
Emsisoft		20170107
ESET-NOD32		20170106
F-Prot		20170107
F-Secure		20170107
Fortinet		20170107
GData		20170107
Ikarus		20170106
Kaspersky		20170107
Kingsoft		20170107
Malwarebytes		20170107
McAfee		20170107
McAfee-GW-Edition		20170107
Microsoft		20170106
eScan		20170107
NANO-Antivirus		20170106
nProtect		20170107
Panda		20170106
Sophos AV		20170107
SUPERAntiSpyware		20170107
Symantec		20170107
Tencent		20170107
TheHacker		20170104
TrendMicro		20170107
TrendMicro-HouseCall		20170107
Trustlook		20170107
VBA32		20170106
VIPRE		20170107
ViRobot		20170106
WhiteArmor		20161221
Yandex		20170106
Zillya		20170104
Zoner		20170107

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Eduardo Armas | @ApostolWario http://nx406e.tk/

Product AP+NX406Ev2 by ApostolWario

Internal name AP+NX406Ev2 by ApostolWario

File version 2,0,1,8

Description Asistente de Particionado para el NX406E by @ApostolWario.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2016-12-29 09:28:39

Entry Point 0x00001000

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.code 4096 11952 12288 5.42 78897ed4835ad20c815be96f9eb8cfc4

.text 16384 46033 46080 6.58 a195715715e6570a8f7dad87fc6d695d

.rdata 65536 2438 2560 6.60 bf592ce9c64d060197af5d9f8061dd05

.data 69632 7168 5632 5.45 20bfc5d1b551ee5d4f3ea5d764b211c4

.rsrc 77824 21425680 21426176 8.00 155785cc23cf1e232ca19fa5d0f9d065

PE imports

Number of PE resources by type

RT_ICON 5

RT_RCDATA 5

RT_MANIFEST 1

RT_VERSION 1

RT_GROUP_ICON 1

Number of PE resources by language

NEUTRAL 13

PE resources

0221c4c02a8f03d48d9727efd1a08caa56e2ffcfd498f6b1fc74dfd1d4b08a22 data

10487d86ce3584e156874ed9b2650e8d772a8d1fdbb1c9111bf7e2fbcab18ccb ASCII text

3ad7c846bdb6b6460cbb9db2793da56ecce6e7c748d72e9749c3e59dca227b5d data

48ee4e34f5ee83551c4a4da990a21098885b114c5632ad69964e8acde08e6edf data

4d8aec84d213168a1a563d0d417627e1a08a6c09e45feaf3ef929cb975df6789 data

656bd3786c993572f2a2ca3197c4b6864c1bf3b07547a908ff51e0062559bedc data

94590afb68f7eee2be3305a04770937732cf29debe031106d5d4b75145c7d7ce data

be809cba9d14bfb52a969d766992832b10e99e133babcdd99dc6d1bba5597cf7 ASCII text

d2bdae8556623609d3f341efb9092aab5320ad74d85a6cca7cfcc71bcad7aea8 data

d5b8cebe28cb565fdd4eac45e66086e42b1499e670b6af75317ca77e89783697 data

ExifTool file metadata

SubsystemVersion

4.0

LinkerVersion

2.5

ImageVersion

0.0

FileSubtype

FileVersionNumber

2.0.1.8

UninitializedDataSize

LanguageCode

English (U.S.)

FileFlagsMask

0x003f

CharacterSet

Windows, Latin1

InitializedDataSize

21434368

EntryPoint

0x1000

MIMEType

application/octet-stream

LegalCopyright

Eduardo Armas | @ApostolWario http://nx406e.tk/

FileVersion

2,0,1,8

TimeStamp

2016:12:29 10:28:39+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

AP+NX406Ev2 by ApostolWario

ProductVersion

2.0.0.0

FileDescription

Asistente de Particionado para el NX406E by @ApostolWario.

OSVersion

4.0

FileOS

Windows 16-bit

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Apostol Wario 2017

CodeSize

58368

ProductName

AP+NX406Ev2 by ApostolWario

ProductVersionNumber

2.0.0.0

FileTypeExtension

exe

ObjectFileType

Executable application

File identification

MD5 466b151b1731fe7462e57c7e79ac7328

SHA1 cee79005dd90bd888c3b0e2ff87929b958dfd8b2

SHA256 f845c4b674de79c8c528d15f6f0ab2ba4c471a58a214943b31ae7cf17ed4165b

ssdeep

393216:h8dZ0Zy/pnYvJJo4VrkxEjIPQMxwpEnkiHsLHqNhq3T5Ml6qPQp49H:WjN2JyQkyOQLStFg3KPxt

authentihash b5474d89911045d5f26b451b51ada17ca275c4ab1016407c88ec1456edcd1d2f

imphash 484ccce96115e0df270eb260991439ca

קודל קובץ 20.5 מ"ב ( 21493760 bytes )

סוג קובץ Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (24.4%) Win64 Executable (generic) (21.6%) UPX compressed Win32 Executable (21.2%) Win32 EXE Yoda's Crypter (20.8%) Win32 Dynamic Link Library (generic) (5.1%)

VirusTotal metadata

First submission 2017-01-07 01:56:49 UTC ( 9 חודשים, 2 שבועות לפני )

Last submission 2017-01-07 01:56:49 UTC ( 9 חודשים, 2 שבועות לפני )

שמות קבצים

AP+NX406EV2.0.1.8 .exe
AP+NX406Ev2 by ApostolWario

SHA256:	f845c4b674de79c8c528d15f6f0ab2ba4c471a58a214943b31ae7cf17ed4165b
שם קובץ:	AP+NX406EV2.0.1.8 .exe
יחס זיהוי:	9 / 56
תאריך ניתוח:	2017-01-07 01:56:49 UTC ( 9 חודשים, 2 שבועות לפני )

Ciphered bundle