× В вашем браузере отключены куки (cookie). Для полноценной работы сайта необходимо включить сохранение файлов cookie.
SHA256: ef63f2244646a3bbad2a769e952ba4b9915aac7db4fd2abf5c7eee0788868034
Имя файла: Mine-Play-Launcher.exe
Показатель выявления: 1 / 56
Дата анализа: 2016-11-21 14:18:29 UTC (1 год назад) Показать последний анализ
Антивирус Результат Дата обновления
McAfee-GW-Edition BehavesLike.Win32.Downloader.rc 20161121
Ad-Aware 20161121
AegisLab 20161121
AhnLab-V3 20161121
Alibaba 20161121
ALYac 20161121
Antiy-AVL 20161121
Arcabit 20161121
Avast 20161121
AVG 20161121
Avira (no cloud) 20161121
AVware 20161121
Baidu 20161121
BitDefender 20161121
Bkav 20161121
CAT-QuickHeal 20161121
ClamAV 20161121
CMC 20161121
Comodo 20161121
CrowdStrike Falcon (ML) 20161024
Cyren 20161121
DrWeb 20161121
Emsisoft 20161121
ESET-NOD32 20161121
F-Prot 20161121
F-Secure 20161121
Fortinet 20161121
GData 20161121
Ikarus 20161121
Sophos ML 20161018
Jiangmin 20161121
K7AntiVirus 20161121
K7GW 20161121
Kaspersky 20161121
Kingsoft 20161121
Malwarebytes 20161121
McAfee 20161121
Microsoft 20161121
eScan 20161121
NANO-Antivirus 20161121
nProtect 20161121
Panda 20161120
Qihoo-360 20161121
Rising 20161121
Sophos AV 20161121
SUPERAntiSpyware 20161121
Symantec 20161121
Tencent 20161121
TheHacker 20161117
TrendMicro 20161121
TrendMicro-HouseCall 20161121
Trustlook 20161121
VBA32 20161121
VIPRE 20161121
ViRobot 20161121
Yandex 20161121
Zillya 20161118
Zoner 20161121
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Packers identified
F-PROT appended, ZIP, embedded
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2016-11-21 12:28:54
Entry Point 0x00001290
Number of sections 6
PE sections
Overlays
MD5 76822d6c4c44dcc0adcac2901209d51f
File type application/zip
Offset 64000
Size 4257840
Entropy 8.00
PE imports
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
RegCloseKey
GetLastError
WaitForSingleObject
GetExitCodeProcess
ExitProcess
GetModuleFileNameA
GetCurrentProcess
LockResource
GetCurrentDirectoryA
GetCommandLineA
GetProcAddress
CreateMutexA
FindResourceExA
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
CloseHandle
GlobalMemoryStatusEx
SetEnvironmentVariableA
LocalFree
CreateProcessA
GetEnvironmentVariableA
LoadResource
FormatMessageA
SetLastError
ShellExecuteA
GetWindowThreadProcessId
GetMessageA
FindWindowExA
CreateWindowExA
LoadImageA
TranslateMessage
GetWindowLongA
DispatchMessageA
GetWindowRect
EnumWindows
SendMessageA
SetForegroundWindow
KillTimer
SetTimer
PostQuitMessage
GetWindowTextA
ShowWindow
GetSystemMetrics
UpdateWindow
SetWindowPos
MessageBoxA
__p__fmode
__p__environ
memset
fclose
strcat
atexit
strncat
_setmode
printf
fopen
strlen
strncpy
_cexit
_itoa
puts
strtok
_chdir
_open
_onexit
_findclose
strrchr
_close
strchr
strpbrk
atoi
__getmainargs
_stat
strstr
_read
_findnext
strcmp
_findfirst
strcpy
fwrite
fprintf
__set_app_type
signal
_iob
Number of PE resources by type
RT_RCDATA 12
RT_ICON 4
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL DEFAULT 17
PE resources
ExifTool file metadata
MIMEType
application/octet-stream

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

FileTypeExtension
exe

TimeStamp
2016:11:21 13:28:54+01:00

FileType
Win32 EXE

PEType
PE32

CodeSize
24064

LinkerVersion
2.56

EntryPoint
0x1290

InitializedDataSize
38912

SubsystemVersion
4.0

ImageVersion
1.0

OSVersion
4.0

UninitializedDataSize
36352

File identification
MD5 72daa5edc2e3df6418f4941a8cb72d25
SHA1 5b558c8333fe0e4897446ea706927e84ff5d3ef2
SHA256 ef63f2244646a3bbad2a769e952ba4b9915aac7db4fd2abf5c7eee0788868034
ssdeep
98304:xAuAkRZpDoXeoXXRMRrjvpi/wVyERHQ0bWZtOmGTKrNPZ:xF7pyKR3k/oXRHQ05ED

authentihash d165345c20679ed5635d59480cc8739d40ac76afbe04cfd0010f114c313afb2b
imphash 6011984d7c1f1b97a34d7517a498bff8
Размер файла 4.1 MБ ( 4321840 bytes )
Тип файла Win32 EXE
Описание
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (41.0%)
Win64 Executable (generic) (36.3%)
Win32 Dynamic Link Library (generic) (8.6%)
Win32 Executable (generic) (5.9%)
Win16/32 Executable Delphi generic (2.7%)
Tags
peexe overlay

VirusTotal metadata
First submission 2016-11-21 14:00:45 UTC (1 год назад)
Last submission 2016-11-21 14:18:29 UTC (1 год назад)
Имена файлов Mine-Play-Launcher.exe
Launcher.exe
Нет комментариев. Из участников сообщества VirusTotal ещё пока никто не оставил комментарий по поводу результатов анализа. Станьте первым!

Оставьте свой комментарий...

?
Отправить

Вы не выполнили вход. Только зарегистрированные пользователи могут оставлять комментарии. Выполните вход и получите право голоса!

Нет голосов. Ещё пока никто не проголосовал за результаты анализа. Станьте первым!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Created processes
Shell commands
Created mutexes
Opened mutexes
Searched windows
Runtime DLLs
Additional details
The file uses the IsDebuggerPresent Windows API function in order to see whether it is being debugged.
UDP communications