| SHA256: | 8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4 |
| Назва файлу: | gcb.exe |
| Співвідношення виявлення: | 2 / 55 |
| Дата дослідження: | 2016-01-14 09:41:41 UTC ( 1 рік, 5 місяців тому ) Переглянути останні |
| Противірус | Підсумок | Оновлення |
|---|---|---|
| AVG | Luhe.MSIL.D | 20160114 |
| Qihoo-360 | HEUR/QVM10.1.Malware.Gen | 20160114 |
| Ad-Aware | 20160114 | |
| AegisLab | 20160114 | |
| Yandex | 20160113 | |
| AhnLab-V3 | 20160114 | |
| Alibaba | 20160114 | |
| ALYac | 20160114 | |
| Antiy-AVL | 20160114 | |
| Arcabit | 20160114 | |
| Avast | 20160114 | |
| Avira (no cloud) | 20160114 | |
| AVware | 20160111 | |
| Baidu-International | 20160114 | |
| BitDefender | 20160114 | |
| Bkav | 20160113 | |
| ByteHero | 20160114 | |
| CAT-QuickHeal | 20160114 | |
| ClamAV | 20160113 | |
| CMC | 20160111 | |
| Comodo | 20160113 | |
| Cyren | 20160114 | |
| DrWeb | 20160114 | |
| Emsisoft | 20160114 | |
| ESET-NOD32 | 20160114 | |
| F-Prot | 20160111 | |
| F-Secure | 20160114 | |
| Fortinet | 20160114 | |
| GData | 20160114 | |
| Ikarus | 20160114 | |
| Jiangmin | 20160114 | |
| K7AntiVirus | 20160114 | |
| K7GW | 20160114 | |
| Kaspersky | 20160114 | |
| Malwarebytes | 20160114 | |
| McAfee | 20160114 | |
| McAfee-GW-Edition | 20160114 | |
| Microsoft | 20160114 | |
| eScan | 20160114 | |
| NANO-Antivirus | 20160114 | |
| nProtect | 20160113 | |
| Panda | 20160113 | |
| Rising | 20160114 | |
| Sophos | 20160114 | |
| SUPERAntiSpyware | 20160114 | |
| Symantec | 20160113 | |
| Tencent | 20160114 | |
| TheHacker | 20160114 | |
| TrendMicro | 20160114 | |
| TrendMicro-HouseCall | 20160114 | |
| VBA32 | 20160113 | |
| VIPRE | 20160114 | |
| ViRobot | 20160114 | |
| Zillya | 20160114 | |
| Zoner | 20160114 |
The file being studied is a Portable Executable file!
More specifically, it is a Win32 EXE
file
for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright © Parhelia Tools 2009-2016
Product Google Chrome backup
Original name gcb.exe
Internal name gcb.exe
File version 1.9.0.182
Description Google Chrome backup
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2009-10-09 12:05:17
Entry Point 0x00010404
Number of sections 4
PE sections
PE imports
Number of PE resources by type
RT_ICON 6
RT_GROUP_ICON 1
RT_VERSION 1
RT_RCDATA 1
RT_MANIFEST 1
Number of PE resources by language
NEUTRAL 10
PE resources
Debug information
ExifTool file metadata
SubsystemVersion
5.0
LinkerVersion
9.0
ImageVersion
0.0
ProductName
Google Chrome backup
FileVersionNumber
1.9.0.182
UninitializedDataSize
0
LanguageCode
Neutral
FileFlagsMask
0x003f
CharacterSet
Unicode
InitializedDataSize
859648
FileTypeExtension
exe
OriginalFileName
gcb.exe
MIMEType
application/octet-stream
Subsystem
Windows GUI
FileVersion
1.9.0.182
TimeStamp
2009:10:09 13:05:17+01:00
FileType
Win32 EXE
PEType
PE32
InternalName
gcb.exe
ProductVersion
1.9.0.182
FileDescription
Google Chrome backup
OSVersion
5.0
FileOS
Win32
LegalCopyright
Copyright Parhelia Tools 2009-2016
MachineType
Intel 386 or later, and compatibles
CompanyName
Parhelia Tools
CodeSize
105472
FileSubtype
0
ProductVersionNumber
1.9.0.182
EntryPoint
0x10404
ObjectFileType
Executable application
AssemblyVersion
1.9.0.182
Compressed bundles
File identification
MD5 42eeea9d8ddb633ed74eb4c1258cf112
SHA1 f4abef392d1d2daef985c1c9005fd258dd5fb8b4
SHA256 8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4
ssdeep
24576:ipVTK2OqN73dC9paWpONzaQKa8KLJVRFVWWdrmu:KVThN7g9pxizZ/8KLJtg+F
Розмір файлу
943.5 Кб ( 966144 bytes )
Тип файлу Win32 EXE
Чарівні букви
PE32 executable for MS Windows (GUI) Intel 80386 32-bit
| TrID |
Win32 Executable MS Visual C++ (generic) (42.2%) Win64 Executable (generic) (37.3%) Win32 Dynamic Link Library (generic) (8.8%) Win32 Executable (generic) (6.0%) Generic Win/DOS Executable (2.7%) |
Tags
peexe
VirusTotal metadata
First submission
2016-01-14 09:41:41 UTC ( 1 рік, 5 місяців тому )
Last submission
2016-10-07 18:37:08 UTC ( 8 місяців, 3 тижні тому )
| Назви файлів |
790499 gcb.exe setupgcb.exe |
Немає дописів.
Жоден член VirusTotal Спільноти ще не писав з цього приводу, Ви можете стати першим, хто зробить це!
Ви не ввійшли в систему. Лише зареєстровані користувачі можуть залишати дописи, увійдіть для отримання прав!
Немає голосів.
Наразі ніхто не проголосував з цього приводу, Ви можете стати першим, хто зробить це!
Condensed report! The following is a condensed report of the
behaviour of the file when executed in a controlled environment. The actions
and events described were either performed by the file itself or by any other
process launched by the executed file or subjected to code injection by the
executed file.
Opened files
Read files
Written files
Deleted files
Created processes
Created mutexes
Opened mutexes
Searched windows
Opened service managers
Opened services
Runtime DLLs
Additional details
The file uses the
IsDebuggerPresent Windows API function in order to see whether it is being debugged.