Thursday, May 21, 2009

VirusTotal

VirusTotal is an on-line service that you can submit suspicious files and it will run it through all the A-V products that it knows.

File TorrentPrivacy.exe received on 05.11.2009 11:23:20 (CET)
AntivirusVersionLast UpdateResult
a-squared4.0.0.1012009.05.11Downloader.Delphi!IK
AhnLab-V35.0.0.22009.05.11-
AntiVir7.9.0.1662009.05.11DR/Delphi.Gen
Antiy-AVL2.0.3.12009.05.11-
Authentium5.1.2.42009.05.10-
Avast4.8.1335.02009.05.10-
AVG8.5.0.3272009.05.11PSW.Banker5.KDS
BitDefender7.22009.05.11-
CAT-QuickHeal10.002009.05.09Win32.TrojanSpy.Banker.aww.a
ClamAV0.94.12009.05.11-
Comodo11572009.05.08Unclassified Malware
DrWeb5.0.0.121822009.05.11-
eSafe7.0.17.02009.05.10Win32.DRDelphi
eTrust-Vet31.6.64972009.05.08-
F-Prot4.4.4.562009.05.10-
F-Secure8.0.14470.02009.05.11-
Fortinet3.117.0.02009.05.11-
GData192009.05.11-
IkarusT3.1.1.49.02009.05.11Downloader.Delphi
K7AntiVirus7.10.7292009.05.08-
Kaspersky7.0.0.1252009.05.11-
McAfee56112009.05.10-
McAfee+Artemis56112009.05.10Artemis!2E37E5F89629
McAfee-GW-Edition6.7.62009.05.11-
Microsoft1.46022009.05.11-
NOD3240642009.05.11-
Norman6.01.052009.05.08Banker.EIWW
nProtect2009.1.8.02009.05.11-
Panda10.0.0.142009.05.10Suspicious file
PCTools4.4.2.02009.05.07-
Prevx3.02009.05.11-
Rising21.29.02.002009.05.11-
Sophos4.41.02009.05.11Mal/Inet-Fam
Sunbelt3.2.1858.22009.05.09-
Symantec1.4.4.122009.05.11-
TheHacker6.3.4.1.3242009.05.09-
TrendMicro8.950.0.10922009.05.11-
VBA323.12.10.42009.05.11-
ViRobot2009.5.11.17282009.05.11-
VirusBuster4.6.5.02009.05.10-
Additional information
File size: 601088 bytes
MD5...: 2e37e5f89629be35a281802e36b967d2
SHA1..: 3efdffdf3f43f78931c19085e31fca4423798bb2
SHA256: b6a0b92fed40df5f5f80c4c7764603f916426f25d6d325b02c518e1d3eaee045
SHA512: 03f3f7bab1d2bd1860ae07493081e4f3994a27bb7645d51f9ec77c2d6d543370
ba97cb27314ff92b35f3d4c5f07f58320fd7b018161d7115337050a4186c223e
ssdeep: 12288:kAaUK050Gy2HlRscolDlXiefWF6HegnkreyLR3Lg5mZfWKGBj:sUz5U2Hl
ucUEeeybIlLR3OAu
PEiD..: PECompact 2.xx --> BitSum Technologies
TrID..: File type identification
Win32 EXE PECompact compressed (v2.x) (48.0%)
Win32 EXE PECompact compressed (generic) (33.8%)
Win32 Executable Generic (6.9%)
Win32 Dynamic Link Library (generic) (6.1%)
Win16/32 Executable Delphi generic (1.6%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x3b0000 0x8f800 8.00 2d4a01639e877b41eed63ccc36e38a1e
.rsrc 0x3b1000 0x3000 0x3000 5.61 a4ef8e9b27138077875000f8f4c6e8ad

( 1 imports )
> kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
ThreatExpert info: www.threatexpert.com/report.aspx?md5= 2e37e5f89629be35a281802e36b967d2
packers (Kaspersky): PE_Patch.PECompact, PecBundle, PECompact
packers (F-Prot): PecBundle, PECompact

The link to threatexpert.com was dead

No comments:

Post a Comment

Please do not enter links that are just promoting your own website or ones to those that you are shilling.
Comments with hyperlinks (that are not relevant to the original post) will be re-posted or deleted.
Sorry, this is to discourage "blog spam"