Antivirus scan for 8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4 at 2016-01-14 09:41:41 UTC

Противірус	Підсумок	Оновлення
AVG	Luhe.MSIL.D	20160114
Qihoo-360	HEUR/QVM10.1.Malware.Gen	20160114
Ad-Aware		20160114
AegisLab		20160114
Yandex		20160113
AhnLab-V3		20160114
Alibaba		20160114
ALYac		20160114
Antiy-AVL		20160114
Arcabit		20160114
Avast		20160114
Avira (no cloud)		20160114
AVware		20160111
Baidu-International		20160114
BitDefender		20160114
Bkav		20160113
ByteHero		20160114
CAT-QuickHeal		20160114
ClamAV		20160113
CMC		20160111
Comodo		20160113
Cyren		20160114
DrWeb		20160114
Emsisoft		20160114
ESET-NOD32		20160114
F-Prot		20160111
F-Secure		20160114
Fortinet		20160114
GData		20160114
Ikarus		20160114
Jiangmin		20160114
K7AntiVirus		20160114
K7GW		20160114
Kaspersky		20160114
Malwarebytes		20160114
McAfee		20160114
McAfee-GW-Edition		20160114
Microsoft		20160114
eScan		20160114
NANO-Antivirus		20160114
nProtect		20160113
Panda		20160113
Rising		20160114
Sophos AV		20160114
SUPERAntiSpyware		20160114
Symantec		20160113
Tencent		20160114
TheHacker		20160114
TrendMicro		20160114
TrendMicro-HouseCall		20160114
VBA32		20160113
VIPRE		20160114
ViRobot		20160114
Zillya		20160114
Zoner		20160114

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Product Google Chrome backup

Original name gcb.exe

Internal name gcb.exe

File version 1.9.0.182

Description Google Chrome backup

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2009-10-09 12:05:17

Entry Point 0x00010404

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 105295 105472 6.66 ab3e172c8d645c40e8254211fb3f3416

.rdata 110592 28532 28672 6.45 eefe1bcdce4d9e51731a2e7b2f5f1ad8

.data 139264 13284 4608 2.42 7f16fbf71f4aebc8aef3318f77d96017

.rsrc 155648 826100 826368 7.87 e9dffc6e776ca700744b006cb8dc1934

PE imports

[+] KERNEL32.dll

Number of PE resources by type

RT_ICON 6

RT_GROUP_ICON 1

RT_VERSION 1

RT_RCDATA 1

RT_MANIFEST 1

Number of PE resources by language

NEUTRAL 10

PE resources

0a57dea2630500322e1251badd3c81af5735a9d823945cfbffb8de5900ccc608 data

114df903eee0642bdb70c522d6c6641430c35d28fec3c8e9d35aca6ae285f25e data

27872f5b9787356a5d389684ca2b2defd6171bf3e111ace2a12ac82309662eba data

407488b38cecf14b9b8a0501483b229ded5a9225198be0e3c493acb74528df09 data

555b244a926caa5929018c4f61cad3dc1dd11ccd33787816ef159ad8d690e197 data

5b2ea2b3d456ae8385b196e409a6724d07f36a5a21662cd4505734b241dbe391 data

869cedf7f712f4668241ea3ca9255a50a2feaff85a5f0f96d25e65aeabae962f data

8922daa04069c9555b3b2a762e13c6f6f767a796effdc351ca3371147486b406 data

c5cb31ea49f844fecf4ef804a942eb564c270bfaf040d3e815f7eb6a2d2bc9d1 data

e6b99edabee8034db1e3776f9f284fe145cee52601ca8d4ec7bc87b9518989f0 data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Fri Oct 09 12:05:17 2009 131044 90 Bytes

ExifTool file metadata

UninitializedDataSize

LinkerVersion

9.0

ImageVersion

0.0

ProductName

Google Chrome backup

FileVersionNumber

1.9.0.182

LanguageCode

Neutral

FileFlagsMask

0x003f

FileDescription

Google Chrome backup

CharacterSet

Unicode

InitializedDataSize

859648

FileTypeExtension

exe

OriginalFileName

gcb.exe

MIMEType

application/octet-stream

Subsystem

Windows GUI

FileVersion

1.9.0.182

TimeStamp

2009:10:09 13:05:17+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

gcb.exe

ProductVersion

1.9.0.182

SubsystemVersion

5.0

OSVersion

5.0

FileOS

Win32

LegalCopyright

MachineType

Intel 386 or later, and compatibles

CompanyName

Parhelia Tools

CodeSize

105472

FileSubtype

ProductVersionNumber

1.9.0.182

EntryPoint

0x10404

ObjectFileType

Executable application

AssemblyVersion

1.9.0.182

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

bb9d5320f7d3a55292f2af2a0dcb3e0ff1cef8e57994d653f3a167e78fa09a14

File identification

MD5 42eeea9d8ddb633ed74eb4c1258cf112

SHA1 f4abef392d1d2daef985c1c9005fd258dd5fb8b4

SHA256 8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4

ssdeep

24576:ipVTK2OqN73dC9paWpONzaQKa8KLJVRFVWWdrmu:KVThN7g9pxizZ/8KLJtg+F

authentihash 1dcec2f28d663ccc3fec3adf1a032b81538150ba7736f65f9ef7fd0aa6f0b868

imphash 27829aa329af2b25059a56b7007516bb

Розмір файлу 943.5 Кб ( 966144 bytes )

Тип файлу Win32 EXE

Чарівні букви

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (42.2%) Win64 Executable (generic) (37.3%) Win32 Dynamic Link Library (generic) (8.8%) Win32 Executable (generic) (6.0%) Generic Win/DOS Executable (2.7%)

VirusTotal metadata

First submission 2016-01-14 09:41:41 UTC ( 2 роки, 10 місяців тому )

Last submission 2016-10-07 18:37:08 UTC ( 2 роки, 1 місяць тому )

Назви файлів

790499
gcb.exe
setupgcb.exe

Ви не ввійшли в систему. Лише зареєстровані користувачі можуть залишати дописи, увійдіть для отримання прав!

Увійти Долучитися до спільноти

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4.config (failed)

C:\8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4 (successful)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\machine.config (successful)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\security.config (failed)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch (failed)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config (failed)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch (failed)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config (failed)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch (failed)

C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index12.dat (successful)

Read files

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\machine.config (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll (successful)

C:\8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4 (successful)

c:\autoexec.bat (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\dw.log (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\125B4.dmp (successful)

Deleted files

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.548.73645 (failed)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.548.73645 (failed)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch.548.73645 (failed)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\125B4.dmp (successful)

Created processes

C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE dw20.exe -x -s 8244 (successful)

Created mutexes

RasPbFile (failed)

Opened mutexes

ShimCacheMutex (successful)

Global\CLR_CASOFF_MUTEX (failed)

RasPbFile (successful)

Searched windows

CLASS: Shell_TrayWnd
NAME: (null)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

RASMAN (successful)

Runtime DLLs

mscoree.dll (successful)

advapi32.dll (successful)

shlwapi.dll (successful)

ole32.dll (successful)

rsaenh.dll (successful)

mscorjit.dll (successful)

rpcrt4.dll (successful)

oleaut32.dll (successful)

ole32 (successful)

version.dll (successful)

Additional details

The file uses the IsDebuggerPresent Windows API function in order to see whether it is being debugged.

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	8d59cc91de358d6bd493cf416b328a5636927789f0295960593a84a3422b90f4
Назва файлу:	gcb.exe
Співвідношення виявлення:	2 / 55
Дата дослідження:	2016-01-14 09:41:41 UTC ( 2 роки, 10 місяців тому ) Переглянути останні

Ciphered bundle

FileVersionInfo properties

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

Debug information

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Напишіть свій допис…

Opened files

Read files

Written files

Deleted files

Created processes

Created mutexes

Opened mutexes

Searched windows

Opened service managers

Opened services

Runtime DLLs

Additional details

UDP communications

Відновлення Вашого паролю

Долучайтеся до VirusTotal Спільноти

Увійти