| SHA256: | 356955f237d6cebcb9724bce244337ee187879045aa01cae22286d58c3b82408 |
| Dosya adı: | WindowexeAllkiller.exe |
| Tespit edilme orani | 10 / 66 |
| Analiz tarihi: | 2017-12-11 16:46:30 UTC ( 4 ay, 2 hafta önce) |
| Antivirus | Sonuç | Güncelle |
|---|---|---|
| Avast | FileRepMetagen [Malware] | 20171211 |
| AVG | FileRepMetagen [Malware] | 20171211 |
| DrWeb | Trojan.Yontoo.4363 | 20171211 |
| ESET-NOD32 | MSIL/HackTool.Agent.AQ potentially unsafe | 20171211 |
| Fortinet | Riskware/Agent | 20171211 |
| McAfee | Artemis!77627660CC9A | 20171211 |
| McAfee-GW-Edition | Artemis | 20171211 |
| SUPERAntiSpyware | Trojan.Agent/Gen-HackTool | 20171211 |
| VBA32 | Trojan.MSIL.gen.16 | 20171211 |
| Zillya | Adware.AgentCRTD.Win32.4247 | 20171211 |
| Ad-Aware | 20171211 | |
| AegisLab | 20171211 | |
| AhnLab-V3 | 20171211 | |
| Alibaba | 20171211 | |
| ALYac | 20171211 | |
| Antiy-AVL | 20171211 | |
| Arcabit | 20171211 | |
| Avast-Mobile | 20171211 | |
| Avira (no cloud) | 20171211 | |
| AVware | 20171211 | |
| Baidu | 20171209 | |
| BitDefender | 20171211 | |
| Bkav | 20171211 | |
| CAT-QuickHeal | 20171209 | |
| ClamAV | 20171211 | |
| CMC | 20171211 | |
| Comodo | 20171211 | |
| CrowdStrike Falcon (ML) | 20171016 | |
| Cybereason | 20171103 | |
| Cylance | 20171211 | |
| Cyren | 20171211 | |
| eGambit | 20171211 | |
| Emsisoft | 20171211 | |
| Endgame | 20171130 | |
| F-Prot | 20171211 | |
| F-Secure | 20171211 | |
| GData | 20171211 | |
| Ikarus | 20171211 | |
| Sophos ML | 20170914 | |
| Jiangmin | 20171211 | |
| K7AntiVirus | 20171211 | |
| K7GW | 20171211 | |
| Kaspersky | 20171211 | |
| Kingsoft | 20171211 | |
| Malwarebytes | 20171211 | |
| MAX | 20171211 | |
| Microsoft | 20171211 | |
| eScan | 20171211 | |
| NANO-Antivirus | 20171211 | |
| nProtect | 20171211 | |
| Palo Alto Networks (Known Signatures) | 20171211 | |
| Panda | 20171211 | |
| Qihoo-360 | 20171211 | |
| Rising | 20171211 | |
| SentinelOne (Static ML) | 20171207 | |
| Sophos AV | 20171211 | |
| Symantec | 20171211 | |
| Symantec Mobile Insight | 20171207 | |
| Tencent | 20171211 | |
| TheHacker | 20171210 | |
| TrendMicro | 20171211 | |
| Trustlook | 20171211 | |
| VIPRE | 20171211 | |
| ViRobot | 20171211 | |
| Webroot | 20171211 | |
| WhiteArmor | 20171204 | |
| Yandex | 20171208 | |
| ZoneAlarm by Check Point | 20171211 | |
| Zoner | 20171211 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
Copyright © WindowexeAllkiller.com
Product WindowexeAllkiller
Original name WindowexeAllkiller.exe
Internal name WindowexeAllkiller.exe
File version 1.0.5514.14799
Description WindowexeAllkiller
Comments windowexe@windowexe.com
Signature verification
Signed file, verified signature
Signing date 12:23 AM 2/5/2015
| Signers |
| Counter signers |
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2015-02-04 23:22:41
Entry Point 0x0005C87E
Number of sections 4
.NET details
Module Version ID
6565f98e-59b0-4dc6-8474-e7a90daf35c4
TypeLib ID
026b74b4-d6bd-4e35-b7e4-1e1a83126caf
PE sections
Overlays
MD5 374798e99c1bd9c2ecde89f7b1789cd9
File type data
Offset 410112
Size 5840
Entropy 7.36
PE imports
Number of PE resources by type
RT_ICON 4
RT_GROUP_ICON 1
RT_VERSION 1
RT_MANIFEST 1
Number of PE resources by language
NEUTRAL 7
PE resources
Debug information
ExifTool file metadata
SubsystemVersion
4.0
Comments
windowexe@windowexe.com
LinkerVersion
11.0
ImageVersion
0.0
FileSubtype
0
FileVersionNumber
1.0.5514.14799
LanguageCode
Neutral
FileFlagsMask
0x003f
FileDescription
WindowexeAllkiller
CharacterSet
Unicode
InitializedDataSize
37888
EntryPoint
0x5c87e
OriginalFileName
WindowexeAllkiller.exe
MIMEType
application/octet-stream
LegalCopyright
Copyright WindowexeAllkiller.com
FileVersion
1.0.5514.14799
TimeStamp
2015:02:05 00:22:41+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
WindowexeAllkiller.exe
ProductVersion
1.0.5514.14799
UninitializedDataSize
0
OSVersion
4.0
FileOS
Win32
Subsystem
Windows GUI
MachineType
Intel 386 or later, and compatibles
CompanyName
http://windowexeallkiller.com
CodeSize
371200
ProductName
WindowexeAllkiller
ProductVersionNumber
1.0.5514.14799
FileTypeExtension
exe
ObjectFileType
Executable application
AssemblyVersion
1.0.5514.14799
Compressed bundles
File identification
MD5 77627660cc9ad75d5356b59d3714fcf6
SHA1 44d6701acf8c66d39fa13bdd43062289763a7599
SHA256 356955f237d6cebcb9724bce244337ee187879045aa01cae22286d58c3b82408
ssdeep
6144:xon07A2XCeM2S35e3yNIRTIyaUbXaf9KyP4vYV8p:aMXC135e3yNIRTdNp
Dosya boyutu
406.2 KB ( 415952 bytes )
Dosya türü Win32 EXE
Magic lafzı
PE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
| TrID |
Win64 Executable (generic) (47.7%) Windows screen saver (22.6%) Win32 Dynamic Link Library (generic) (11.3%) Win32 Executable (generic) (7.7%) Win16/32 Executable Delphi generic (3.5%) |
Tags
peexe
assembly
signed
overlay
VirusTotal metadata
First submission
2015-02-05 17:41:03 UTC ( 3 yıl, 2 ay önce)
Last submission
2015-02-05 17:41:03 UTC ( 3 yıl, 2 ay önce)
| Dosya isimleri |
WindowexeAllkiller.exe |
Advanced heuristic and reputation engines
Symantec reputation
Suspicious.Insight
Yorum yok..
Henüz hiçbir VirusTotal Topluluğu üyesi bu öğeye yorum yapmadı.Bunu yapan ilk sen ol!
Üye girişi yapmadınız..Sadece kayıtlı kullanıcılar yorum yapabilir.Sesinizi duyurmak için giriş yapın.
Oy yok..
Bu öğeyi daha önce hiç kimse oylamadı.Bunu yapan ilk sen ol!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.