| SHA256: | 6341019d7d03df956de90e2fb5f9250ef07f623c43ce6c0f07ebc2e244461b79 |
| ფაილის სახელი: | NHMConverterSetup.exe |
| დაფიქსირების შეფარდება: | 0 / 46 |
| ანალიზის თარიღი: | 2013-05-14 13:45:19 UTC ( 4 წელი, 5 თვე-ის წინ ) ბოლო |
| ანტივირუსი | შედეგები | განახლება |
|---|---|---|
| Yandex | 20130514 | |
| AhnLab-V3 | 20130514 | |
| AntiVir | 20130514 | |
| Antiy-AVL | 20130514 | |
| Avast | 20130514 | |
| AVG | 20130514 | |
| BitDefender | 20130514 | |
| ByteHero | 20130513 | |
| CAT-QuickHeal | 20130514 | |
| ClamAV | 20130514 | |
| Commtouch | 20130514 | |
| Comodo | 20130514 | |
| DrWeb | 20130514 | |
| Emsisoft | 20130514 | |
| eSafe | 20130513 | |
| ESET-NOD32 | 20130514 | |
| F-Prot | 20130514 | |
| F-Secure | 20130514 | |
| Fortinet | 20130514 | |
| GData | 20130514 | |
| Ikarus | 20130514 | |
| Jiangmin | 20130514 | |
| K7AntiVirus | 20130513 | |
| K7GW | 20130513 | |
| Kaspersky | 20130514 | |
| Kingsoft | 20130506 | |
| Malwarebytes | 20130514 | |
| McAfee | 20130514 | |
| McAfee-GW-Edition | 20130514 | |
| Microsoft | 20130514 | |
| eScan | 20130514 | |
| NANO-Antivirus | 20130514 | |
| Norman | 20130514 | |
| nProtect | 20130514 | |
| Panda | 20130514 | |
| PCTools | 20130514 | |
| Sophos AV | 20130514 | |
| SUPERAntiSpyware | 20130514 | |
| Symantec | 20130514 | |
| TheHacker | 20130513 | |
| TotalDefense | 20130514 | |
| TrendMicro | 20130514 | |
| TrendMicro-HouseCall | 20130514 | |
| VBA32 | 20130513 | |
| VIPRE | 20130514 | |
| ViRobot | 20130514 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
Product NHM Converter
File version
Description NHM Converter Setup
Comments This installation was built with Inno Setup.
Signature verification
Signed file, verified signature
Signing date 2:23 PM 5/14/2013
| Signers |
| Counter signers |
Packers identified
F-PROT INNO
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 1992-06-19 22:22:17
Entry Point 0x00009A58
Number of sections 8
PE sections
Overlays
MD5 b17d44d4f07d7d0d023d591a942c5d0f
File type data
Offset 53248
Size 379376
Entropy 8.00
PE imports
Number of PE resources by type
RT_STRING 6
RT_ICON 4
RT_MANIFEST 1
RT_RCDATA 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 7
DUTCH 4
ENGLISH US 3
PE resources
ExifTool file metadata
UninitializedDataSize
0
Comments
This installation was built with Inno Setup.
LinkerVersion
2.25
ImageVersion
6.0
FileSubtype
0
FileVersionNumber
0.0.0.0
LanguageCode
Neutral
FileFlagsMask
0x003f
CharacterSet
Unicode
InitializedDataSize
17408
EntryPoint
0x9a58
MIMEType
application/octet-stream
TimeStamp
1992:06:19 23:22:17+01:00
FileType
Win32 EXE
PEType
PE32
SubsystemVersion
4.0
FileDescription
NHM Converter Setup
OSVersion
1.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
New Horizon Media Pvt Ltd
CodeSize
37376
ProductName
NHM Converter
ProductVersionNumber
0.0.0.0
FileTypeExtension
exe
ObjectFileType
Executable application
File identification
MD5 9cd6465141ee86f17ae2aea721f12d64
SHA1 b3c80748996ec6e5a07eb2edfade71e9d8c1a760
SHA256 6341019d7d03df956de90e2fb5f9250ef07f623c43ce6c0f07ebc2e244461b79
ssdeep
12288:p2UtPTRcs3NmxiYZPScqKvnY3QyunoYcS5Kl:p2UlTF3Nm0YZ8YaXa8
File size
422.5 კბ ( 432624 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Inno Setup installer (77.7%) Win32 Executable Delphi generic (10.0%) Win32 Dynamic Link Library (generic) (4.6%) Win32 Executable (generic) (3.1%) Win16/32 Executable Delphi generic (1.4%) |
Tags
peexe
signed
overlay
VirusTotal metadata
First submission
2013-05-14 13:45:19 UTC ( 4 წელი, 5 თვე-ის წინ )
Last submission
2017-10-17 03:32:56 UTC ( 5 დღე, 2 საათი-ის წინ )
| ფაილის სახელები |
NHMConverterSetup.exe |
Advanced heuristic and reputation engines
ClamAV
Possibly Unwanted Application. While not necessarily malicious, the
scanned file presents certain characteristics which depending on the
user policies and environment may or may not represent a threat. For
full details see:
https://www.clamav.net/documents/potentially-unwanted-applications-pua
.
Symantec reputation
Suspicious.Insight
კომენტარები არაა.
ვირუსტოტალის წევრებს არ დაუტოვებიათ კომენტარი, იყავი პირველი!
თქვენ არ შესულხართ სისტემაში მხოლოდ დარეგისტრირებულ წევრებს შეუძლიათ კომენტარის დატოვება. დარეგისტრირდით რათა გქონდეთ თქვენი ხმა,
შეფასებები არ არის.
ეს ფაილი არავის შეუფასებია, იყავი პირველი!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Written files
Deleted files
Set keys
Created processes
Runtime DLLs
Additional details
The file sends control codes directly to certain device drivers making use of the
DeviceIoControl
Windows API function.