| SHA256: | 35c6b1d8371da5ccd328a5d9b2f5ff9a9508fa29f76b4964d0ff6f7012b0b2c6 |
| Име датотеке: | VirusShare_53e790253e8afaa6f794e2ee18447239 |
| Однос откривања: | 42 / 70 |
| Датум анализе: | 2018-12-05 07:22:29 UTC (пре 5 дана, 16 сати) |
| Антивирус | Резултат | Ажурирање |
|---|---|---|
| Ad-Aware | Gen:Variant.Application.Bundler.DownloadGuide.24 | 20181205 |
| AhnLab-V3 | PUP/Win32.DownloadGuide.R245289 | 20181204 |
| Antiy-AVL | GrayWare[AdWare]/Win32.DownloadGuide.dd | 20181205 |
| Arcabit | Trojan.Application.Bundler.DownloadGuide.24 | 20181205 |
| Avast | Win32:PUP-gen [PUP] | 20181205 |
| AVG | Win32:PUP-gen [PUP] | 20181205 |
| BitDefender | Gen:Variant.Application.Bundler.DownloadGuide.24 | 20181205 |
| Bkav | W32.HfsAdware.C530 | 20181203 |
| CAT-QuickHeal | PUA.Freemiumgm2.Gen | 20181204 |
| Comodo | Application.Win32.DownloadGuide.A@7y5gwx | 20181205 |
| CrowdStrike Falcon (ML) | malicious_confidence_100% (D) | 20181022 |
| Cybereason | malicious.53e8af | 20180225 |
| Cyren | W32/S-58b25de1!Eldorado | 20181205 |
| DrWeb | Adware.ClickMeIn.9588 | 20181205 |
| eGambit | Unsafe.AI_Score_99% | 20181205 |
| Emsisoft | Application.Downloader (A) | 20181205 |
| Endgame | malicious (high confidence) | 20181108 |
| ESET-NOD32 | a variant of Win32/DownloadGuide.D potentially unwanted | 20181205 |
| F-Prot | W32/S-58b25de1!Eldorado | 20181205 |
| F-Secure | Gen:Variant.Application.Bundler | 20181205 |
| Fortinet | Riskware/DownloaderGuide | 20181205 |
| GData | Win32.Application.DownloadGuide.T | 20181205 |
| Ikarus | PUA.DownloadGuide | 20181204 |
| Sophos ML | heuristic | 20181128 |
| Jiangmin | Downloader.DownloaderGuide.aqk | 20181205 |
| K7AntiVirus | Adware ( 004b92681 ) | 20181205 |
| K7GW | Adware ( 004b92681 ) | 20181205 |
| Kaspersky | not-a-virus:HEUR:Downloader.Win32.DownloaderGuide.gen | 20181204 |
| Malwarebytes | Adware.Downloader | 20181205 |
| MAX | malware (ai score=77) | 20181205 |
| McAfee | Downloader | 20181205 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.hh | 20181205 |
| Microsoft | PUA:Win32/DownloadGuide | 20181205 |
| eScan | Gen:Variant.Application.Bundler.DownloadGuide.24 | 20181205 |
| NANO-Antivirus | Trojan.Win32.Covus.fkfkjs | 20181205 |
| Rising | Adware.DownloadGuide!1.A1DB (RDM+:cmRtazoekWvSNMJPMSQaRHTxbz3i) | 20181205 |
| SentinelOne (Static ML) | static engine - malicious | 20181011 |
| Symantec | PUA.Downloader | 20181205 |
| VBA32 | BScope.Downloader.DownloaderGuide | 20181204 |
| VIPRE | Trojan.Win32.Generic!BT | 20181205 |
| Webroot | Pua.Freemium | 20181205 |
| ZoneAlarm by Check Point | not-a-virus:HEUR:Downloader.Win32.DownloaderGuide.gen | 20181205 |
| AegisLab | 20181205 | |
| Alibaba | 20180921 | |
| ALYac | 20181205 | |
| Avast-Mobile | 20181204 | |
| Avira (no cloud) | 20181205 | |
| Babable | 20180918 | |
| Baidu | 20181204 | |
| ClamAV | 20181203 | |
| CMC | 20181204 | |
| Cylance | 20181205 | |
| Kingsoft | 20181205 | |
| Palo Alto Networks (Known Signatures) | 20181205 | |
| Panda | 20181204 | |
| Qihoo-360 | 20181205 | |
| Sophos AV | 20181205 | |
| SUPERAntiSpyware | 20181128 | |
| Symantec Mobile Insight | 20181204 | |
| TACHYON | 20181204 | |
| Tencent | 20181205 | |
| TheHacker | 20181202 | |
| TotalDefense | 20181205 | |
| Trapmine | 20181128 | |
| TrendMicro | 20181205 | |
| TrendMicro-HouseCall | 20181205 | |
| Trustlook | 20181205 | |
| ViRobot | 20181205 | |
| Yandex | 20181204 | |
| Zillya | 20181204 | |
| Zoner | 20181205 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Signature verification
Signed file, verified signature
Signing date 8:23 AM 12/5/2018
| Signers |
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2018-11-16 05:03:04
Entry Point 0x00014C3C
Number of sections 5
PE sections
Overlays
MD5 69f41b3ed631e1b3fb669bd0932e145b
File type data
Offset 552960
Size 6808
Entropy 7.60
PE imports
Number of PE resources by type
RT_ICON 3
RT_GROUP_ICON 1
RT_VERSION 1
RT_MANIFEST 1
Number of PE resources by language
NEUTRAL 6
PE resources
ExifTool file metadata
UninitializedDataSize
0
LinkerVersion
10.0
ImageVersion
0.0
FileVersionNumber
3.1.0.201
LanguageCode
Russian
FileFlagsMask
0x003f
ImageFileCharacteristics
Executable, 32-bit
CharacterSet
Unicode
InitializedDataSize
200704
EntryPoint
0x14c3c
MIMEType
application/octet-stream
FileVersion
3.1.0.201
TimeStamp
2018:11:16 06:03:04+01:00
FileType
Win32 EXE
PEType
PE32
SubsystemVersion
5.1
OSVersion
5.1
FileOS
Windows NT 32-bit
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CodeSize
361472
FileSubtype
0
ProductVersionNumber
3.1.0.201
FileTypeExtension
exe
ObjectFileType
Executable application
File identification
MD5 53e790253e8afaa6f794e2ee18447239
SHA1 bd69c7d4c0b8eadcc08d0e7a0a71369f9eb8af95
SHA256 35c6b1d8371da5ccd328a5d9b2f5ff9a9508fa29f76b4964d0ff6f7012b0b2c6
ssdeep
12288:y4fmuV/2SlI1MCAHab5I0WozQsmknY87Z1EPclMkc9A7Z2+:y42DMCA6b5fWQmknY87LEPcl9nlD
File size
546.6 KB ( 559768 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable MS Visual C++ (generic) (41.0%) Win64 Executable (generic) (36.3%) Win32 Dynamic Link Library (generic) (8.6%) Win32 Executable (generic) (5.9%) OS/2 Executable (generic) (2.6%) |
Tags
peexe
signed
overlay
VirusTotal metadata
First submission
2018-12-05 07:22:29 UTC (пре 5 дана, 16 сати)
Last submission
2018-12-05 07:22:29 UTC (пре 5 дана, 16 сати)
| Имена датотека |
VirusShare_53e790253e8afaa6f794e2ee18447239 |
Нема коментара..
Ниједан члан заједнице Вајрустотала још није прокоментарисао ову ставку. Будите први који ће то урадити!
Нисте пријављени. Само регистровани корисници могу да остављају коментаре. Отворите налог и разгласите се!
Нема гласова..
Још нико није гласао за ову ставку. Будите први који ће то учинити!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Written files
Moved files
Deleted files
Created mutexes
Opened mutexes
Searched windows
Opened service managers
Opened services
Hooking activity
Runtime DLLs
Additional details
The file installs an application-defined hook procedure into a hook chain. You
would install a hook procedure to monitor the system for certain types of
events. These events are associated either with a specific thread or with all
threads in the same desktop as the calling thread. This is done making use of
the
SetWindowsHook Windows API function.