| SHA256: | b0ff4a823eafe565e0402a70bcdc970c9d2c60d84d15656afc3afbbc9065c557 |
| 파일 이름: | install_spartanu3.exe |
| 탐지 비율: | 0 / 55 |
| 분석 날짜: | 2017-01-18 03:53:04 UTC ( 2년, 2개월 전 ) 최신 보기 |
| 안티바이러스 | 결과 | 업데이트 |
|---|---|---|
| Ad-Aware | 20170118 | |
| AegisLab | 20170118 | |
| AhnLab-V3 | 20170117 | |
| Alibaba | 20170118 | |
| ALYac | 20170118 | |
| Antiy-AVL | 20170118 | |
| Arcabit | 20170118 | |
| Avast | 20170118 | |
| AVG | 20170118 | |
| Avira (no cloud) | 20170117 | |
| AVware | 20170118 | |
| Baidu | 20170117 | |
| BitDefender | 20170118 | |
| CAT-QuickHeal | 20170117 | |
| ClamAV | 20170118 | |
| CMC | 20170117 | |
| Comodo | 20170118 | |
| CrowdStrike Falcon (ML) | 20161024 | |
| Cyren | 20170118 | |
| DrWeb | 20170118 | |
| Emsisoft | 20170118 | |
| ESET-NOD32 | 20170118 | |
| F-Prot | 20170118 | |
| F-Secure | 20170118 | |
| Fortinet | 20170118 | |
| GData | 20170118 | |
| Ikarus | 20170117 | |
| Sophos ML | 20170111 | |
| Jiangmin | 20170118 | |
| K7AntiVirus | 20170117 | |
| K7GW | 20170118 | |
| Kaspersky | 20170118 | |
| Kingsoft | 20170118 | |
| Malwarebytes | 20170118 | |
| McAfee | 20170118 | |
| McAfee-GW-Edition | 20170118 | |
| Microsoft | 20170117 | |
| eScan | 20170117 | |
| NANO-Antivirus | 20170117 | |
| nProtect | 20170118 | |
| Panda | 20170117 | |
| Qihoo-360 | 20170118 | |
| Rising | 20170118 | |
| Sophos AV | 20170118 | |
| SUPERAntiSpyware | 20170118 | |
| Symantec | 20170117 | |
| Tencent | 20170118 | |
| TheHacker | 20170117 | |
| TotalDefense | 20170117 | |
| TrendMicro | 20170118 | |
| Trustlook | 20170118 | |
| VBA32 | 20170117 | |
| VIPRE | 20170118 | |
| ViRobot | 20170118 | |
| WhiteArmor | 20170117 | |
| Yandex | 20170117 | |
| Zillya | 20170117 | |
| Zoner | 20170118 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
File version 16.1.0.0
Packers identified
F-PROT UTF-8
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2006-04-10 07:11:20
Entry Point 0x0001BE36
Number of sections 4
PE sections
PE imports
Number of PE resources by type
RT_STRING 27
RT_CURSOR 16
RT_GROUP_CURSOR 15
Struct(255) 7
RT_BITMAP 7
RT_ICON 6
RT_DIALOG 2
BIN 1
RT_HTML 1
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 67
GERMAN 3
FRENCH 3
CHINESE SIMPLIFIED 3
JAPANESE DEFAULT 3
SPANISH MODERN 3
ITALIAN 3
PE resources
Debug information
ExifTool file metadata
UninitializedDataSize
0
CustomBuild
1.0
LinkerVersion
7.1
ImageVersion
0.0
FileVersionNumber
16.1.0.0
LanguageCode
English (U.S.)
FileFlagsMask
0x003f
CharacterSet
Unicode
InitializedDataSize
6516736
PrivateBuild
1.0.0.10
EntryPoint
0x1be36
MIMEType
application/octet-stream
FileVersion
16.1.0.0
TimeStamp
2006:04:10 08:11:20+01:00
FileType
Win32 EXE
PEType
PE32
ProductVersion
16.1.0.0
SubsystemVersion
4.0
OSVersion
4.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CodeSize
233472
FileSubtype
0
ProductVersionNumber
16.1.0.0
Warning
Possibly corrupt Version resource
FileTypeExtension
exe
ObjectFileType
Executable application
File identification
MD5 4df5e18d97eb0719c949ae70ebeb7770
SHA1 515d8548034735ae51361347fb3448ebec50de45
SHA256 b0ff4a823eafe565e0402a70bcdc970c9d2c60d84d15656afc3afbbc9065c557
ssdeep
196608:/xFvsAlt3Ujy0v8tBdlCOVDsF3YA0bN2Dak88aSAa5I:Lv/3Um9WKDAoA0Z858h10I
File size
6.4 MB ( 6754304 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
InstallShield setup (34.8%) Win32 Executable MS Visual C++ (generic) (25.2%) Win64 Executable (generic) (22.3%) Windows screen saver (10.6%) Win32 Executable (generic) (3.6%) |
Tags
peexe
VirusTotal metadata
First submission
2017-01-17 18:52:05 UTC ( 2년, 2개월 전 )
Last submission
2017-01-27 19:26:15 UTC ( 2년, 1개월 전 )
| 파일 이름 |
install_spartanu3.exe B0FF4A823EAFE565E0402A70BCDC970C9D2C60D84D15656AFC3AFBBC9065C557.exe |
댓글이 없습니다..
이 항목에 대해 댓글을 작성한 바이러스토탈 커뮤니티 회원이 아직 없습니다. 첫 번째로 댓글을 작성해 보십시오!
투표가 없습니다..
아직 이 항목에 투표한 사람이 없습니다. 첫 번째로 투표해 보십시오!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Created mutexes
Hooking activity
Runtime DLLs
Additional details
The file installs an application-defined hook procedure into a hook chain. You
would install a hook procedure to monitor the system for certain types of
events. These events are associated either with a specific thread or with all
threads in the same desktop as the calling thread. This is done making use of
the
SetWindowsHook Windows API function.