| SHA256: | a26e3ae578dade4d81b6cc253577f789de091a87f45ed996eeb20671620189b5 |
| Имя файла: | Avatariya v78.exe |
| Показатель выявления: | 1 / 61 |
| Дата анализа: | 2017-05-22 12:32:35 UTC (1 год, 4 месяцев назад) Показать последний анализ |
| Антивирус | Результат | Дата обновления |
|---|---|---|
| McAfee-GW-Edition | BehavesLike.Win32.Generic.th | 20170521 |
| Ad-Aware | 20170522 | |
| AegisLab | 20170522 | |
| AhnLab-V3 | 20170522 | |
| Alibaba | 20170522 | |
| ALYac | 20170522 | |
| Antiy-AVL | 20170522 | |
| Arcabit | 20170522 | |
| Avast | 20170522 | |
| AVG | 20170522 | |
| Avira (no cloud) | 20170522 | |
| AVware | 20170522 | |
| Baidu | 20170503 | |
| BitDefender | 20170522 | |
| Bkav | 20170522 | |
| CAT-QuickHeal | 20170522 | |
| ClamAV | 20170522 | |
| CMC | 20170521 | |
| Comodo | 20170522 | |
| CrowdStrike Falcon (ML) | 20170130 | |
| Cyren | 20170522 | |
| DrWeb | 20170522 | |
| Emsisoft | 20170522 | |
| Endgame | 20170515 | |
| ESET-NOD32 | 20170522 | |
| F-Prot | 20170522 | |
| F-Secure | 20170522 | |
| Fortinet | 20170522 | |
| GData | 20170522 | |
| Ikarus | 20170522 | |
| Sophos ML | 20170519 | |
| Jiangmin | 20170522 | |
| K7AntiVirus | 20170522 | |
| K7GW | 20170522 | |
| Kaspersky | 20170522 | |
| Kingsoft | 20170522 | |
| Malwarebytes | 20170522 | |
| McAfee | 20170522 | |
| Microsoft | 20170522 | |
| eScan | 20170522 | |
| NANO-Antivirus | 20170522 | |
| nProtect | 20170522 | |
| Palo Alto Networks (Known Signatures) | 20170522 | |
| Panda | 20170521 | |
| Qihoo-360 | 20170522 | |
| Rising | 20170522 | |
| SentinelOne (Static ML) | 20170516 | |
| Sophos AV | 20170521 | |
| SUPERAntiSpyware | 20170522 | |
| Symantec | 20170522 | |
| Symantec Mobile Insight | 20170522 | |
| Tencent | 20170522 | |
| TheHacker | 20170522 | |
| TrendMicro | 20170522 | |
| TrendMicro-HouseCall | 20170522 | |
| Trustlook | 20170522 | |
| VBA32 | 20170522 | |
| VIPRE | 20170522 | |
| ViRobot | 20170522 | |
| Webroot | 20170522 | |
| WhiteArmor | 20170517 | |
| Yandex | 20170518 | |
| Zillya | 20170520 | |
| ZoneAlarm by Check Point | 20170522 | |
| Zoner | 20170522 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
File version 1.0.0.0
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2016-01-23 15:54:38
Entry Point 0x003DB8A0
Number of sections 11
PE sections
PE imports
PE exports
Number of PE resources by type
RT_STRING 49
RT_BITMAP 29
RT_RCDATA 23
RT_GROUP_CURSOR 8
RT_CURSOR 8
RT_DIALOG 2
RT_MANIFEST 1
RT_ICON 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 57
ENGLISH US 56
ENGLISH NEUTRAL 7
RUSSIAN 3
PE resources
ExifTool file metadata
UninitializedDataSize
0
LinkerVersion
2.25
ImageVersion
0.0
FileVersionNumber
1.0.0.0
LanguageCode
English (U.S.)
FileFlagsMask
0x003f
ImageFileCharacteristics
Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
CharacterSet
Windows, Latin1
InitializedDataSize
1994752
EntryPoint
0x3db8a0
MIMEType
application/octet-stream
FileVersion
1.0.0.0
TimeStamp
2016:01:23 16:54:38+01:00
FileType
Win32 EXE
PEType
PE32
ProductVersion
1.0.0.0
SubsystemVersion
5.0
OSVersion
5.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CodeSize
4038656
FileSubtype
0
ProductVersionNumber
1.0.0.0
FileTypeExtension
exe
ObjectFileType
Executable application
Execution parents
Compressed bundles
File identification
MD5 2303fb1e114efe24bacfb04653099e17
SHA1 690663b3ff593c3dc568ab187d49d34e12cade5c
SHA256 a26e3ae578dade4d81b6cc253577f789de091a87f45ed996eeb20671620189b5
ssdeep
98304:8AKsgV8GFDcPm1mPzB5LPa4R7R9UVdsXAifbvWW6ogLzF7Sn1:OntEm1m15CdQ+7oEJ7y
Размер файла
5.8 MБ ( 6034432 bytes )
Тип файла Win32 EXE
Описание
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Inno Setup installer (53.0%) InstallShield setup (20.8%) Win32 EXE PECompact compressed (generic) (20.0%) Win32 Executable (generic) (2.1%) Win16/32 Executable Delphi generic (1.0%) |
Tags
peexe
VirusTotal metadata
First submission
2016-01-30 08:28:23 UTC (2 лет, 8 месяцев назад)
Last submission
2018-08-25 07:54:04 UTC (1 месяц, 3 недель назад)
| Имена файлов |
kbz ii v49.exe KontraCity V11.exe rAGQ3YgR3gDpdh2wF7kPA5ME4F04%3D&limit=0&content_type=application%2Fx-msdownload&fsize=6034432&hid=20e19825f61521a29543fafe2fdb5c0a&media_type=executable&tknv=v2&rtoken=2zOPIAQY01WY&force_default=no&ycrid=na-624f62ecca823bf7009e77ef00e839ee-downloader16f&ts=56798d3b38200&s=5c21e5d3d37414f228a49152f2d2d3171e5fcd1feb4b4834ee21013af845fb6f&pb=U2FsdGVkX18Xr_K8N_uIV4VTeBnW7Zz1HKXMYDRmFX2EJQQ-3q_D-PTyN25O7JmlwDdCBCJpjqsiWLJWl315Z4CiDfRdUM2ceAvJtNsl_Lw Кубезумие.exe 5FEF~1.EXE KBZ II v49.exe 1Gfz71Ms8lURZcpnkJR_rI5ne8O6o2nnxKEq4i4om8YqTBQKo4JjQbvIVtFcVHVhiTxHEBW2bOm1EsbofvBbXQ== Чит на кубезумие зд от просто Сани.exe rAGQ3YgR3gDpdh2wF7kPA5ME4F04%3D&limit=0&content_type=application%2Fx-msdownload&fsize=6034432&hid=20e19825f61521a29543fafe2fdb5c0a&media_type=executable&tknv=v2&rtoken=LauH5hghZfSW&force_default=no&ycrid=na-7155a5a5599f8164218e24037aa9d7e1-downloader18h&ts=573c5ff44be00&s=542814e967ff96bbc1f970d4c358466a4a0c72c23df32402f109d9e249884c1c&pb=U2FsdGVkX18tf3LlOqPZB5AMpVzLRubFZc-3whw5TSK1mkQdLAs744FywzrgQ4fdGOh1bQMjNsqp_j1WKBo4J1CZENWhcoRVVPCBZxt-kJA rAGQ3YgR3gDpdh2wF7kPA5ME4F04%3D&limit=0&content_type=application%2Fx-msdownload&fsize=6034432&hid=20e19825f61521a29543fafe2fdb5c0a&media_type=executable&tknv=v2&rtoken=WDmzKGFFct47&force_default=no&ycrid=na-3680f1492eb42606ec4d1903c693880d-downloader9h&ts=5707737f86c80&s=4d1535ab7a96c47924169a4530473750b1ad6c83ee7120f4887181ad48b1d773&pb=U2FsdGVkX1_36K5SccHo6-JKtkVFJK-Z_xUFSEThln9Df6u1zFAIqIRj7ca2Wp76q7Qqy7bk55nnXl_uyp5eqeSB8zUJZMnjYobDAPCLxcs Avatariya v78.exe 5783359 |
Нет комментариев.
Из участников сообщества VirusTotal ещё пока никто не оставил комментарий по поводу результатов анализа. Станьте первым!
Вы не выполнили вход. Только зарегистрированные пользователи могут оставлять комментарии. Выполните вход и получите право голоса!
Нет голосов.
Ещё пока никто не проголосовал за результаты анализа. Станьте первым!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Created processes
Shell commands
Created mutexes
Opened mutexes
Searched windows
Hooking activity
Runtime DLLs
Additional details
The file uses the
IsDebuggerPresent Windows API function in order to see whether it is being debugged.
The file installs an application-defined hook procedure into a hook chain. You
would install a hook procedure to monitor the system for certain types of
events. These events are associated either with a specific thread or with all
threads in the same desktop as the calling thread. This is done making use of
the
SetWindowsHook Windows API function.