× В вашем браузере отключены куки (cookie). Для полноценной работы сайта необходимо включить сохранение файлов cookie.
SHA256: 9b1b94f71aefa141e704b20f6887ad4f87a727dbfe3cd99eb61e4b51ef89122e
Имя файла: Hearthbuddy Installer.exe
Показатель выявления: 0 / 56
Дата анализа: 2016-04-04 02:57:57 UTC (1 год, 7 месяцев назад) Показать последний анализ
Антивирус Результат Дата обновления
Ad-Aware 20160403
AegisLab 20160404
AhnLab-V3 20160403
Alibaba 20160401
ALYac 20160404
Antiy-AVL 20160403
Arcabit 20160403
Avast 20160404
AVG 20160404
Avira (no cloud) 20160403
AVware 20160404
Baidu 20160403
Baidu-International 20160403
BitDefender 20160404
Bkav 20160402
CAT-QuickHeal 20160402
ClamAV 20160402
CMC 20160401
Comodo 20160403
Cyren 20160404
DrWeb 20160404
Emsisoft 20160404
ESET-NOD32 20160403
F-Prot 20160404
F-Secure 20160404
Fortinet 20160404
GData 20160404
Ikarus 20160403
Jiangmin 20160404
K7AntiVirus 20160403
K7GW 20160404
Kaspersky 20160404
Kingsoft 20160404
Malwarebytes 20160404
McAfee 20160404
McAfee-GW-Edition 20160404
Microsoft 20160404
eScan 20160404
NANO-Antivirus 20160404
nProtect 20160401
Panda 20160403
Qihoo-360 20160404
Rising 20160404
Sophos AV 20160404
SUPERAntiSpyware 20160403
Symantec 20160331
Tencent 20160404
TheHacker 20160403
TrendMicro 20160404
TrendMicro-HouseCall 20160404
VBA32 20160401
VIPRE 20160404
ViRobot 20160404
Yandex 20160316
Zillya 20160403
Zoner 20160404
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
FileVersionInfo properties
Copyright
Copyright (c) Bossland GmbH. All rights reserved.

Product Hearthbuddy
Original name Hearthbuddy Installer.exe
Internal name setup
File version 0.3.1184.254
Description Hearthbuddy
Packers identified
F-PROT CAB, UTF-8, Unicode
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2016-02-26 23:57:12
Entry Point 0x0002C990
Number of sections 7
PE sections
Overlays
MD5 27a00994aeab1e7eccea04d60611b031
File type data
Offset 462848
Size 10581318
Entropy 8.00
PE imports
SetSecurityDescriptorOwner
RegCreateKeyExW
RegCloseKey
OpenServiceW
AdjustTokenPrivileges
ControlService
InitializeAcl
LookupPrivilegeValueW
RegDeleteKeyW
CryptHashData
CheckTokenMembership
DecryptFileW
RegQueryValueExW
CryptCreateHash
SetSecurityDescriptorDacl
CloseServiceHandle
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateWellKnownSid
OpenProcessToken
QueryServiceStatus
RegOpenKeyExW
SystemFunction036
QueryServiceConfigW
GetTokenInformation
CryptReleaseContext
GetUserNameW
RegQueryInfoKeyW
SetEntriesInAclW
RegEnumKeyExW
CryptAcquireContextW
CryptDestroyHash
InitializeSecurityDescriptor
RegDeleteValueW
RegSetValueExW
CryptGetHashParam
OpenSCManagerW
RegEnumValueW
AllocateAndInitializeSid
InitiateSystemShutdownExW
SetEntriesInAclA
ChangeServiceConfigW
SetSecurityDescriptorGroup
SetNamedSecurityInfoW
DeleteDC
SelectObject
GetObjectW
CreateCompatibleDC
DeleteObject
StretchBlt
GetVolumePathNameW
GetStdHandle
ReleaseMutex
WaitForSingleObject
ProcessIdToSessionId
GetFileAttributesW
VerifyVersionInfoW
GetProcessId
DeleteCriticalSection
GetCurrentProcess
GetConsoleMode
LoadLibraryExW
FreeEnvironmentStringsW
InitializeSListHead
SetStdHandle
WideCharToMultiByte
InterlockedExchange
WriteFile
GetTimeZoneInformation
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeW
SetEvent
LocalFree
FormatMessageW
ConnectNamedPipe
GetExitCodeProcess
InitializeCriticalSection
FindClose
InterlockedDecrement
SetFileAttributesW
SetLastError
GetSystemTime
CopyFileW
GetUserDefaultLangID
RemoveDirectoryW
IsDebuggerPresent
HeapAlloc
VerSetConditionMask
HeapSetInformation
LoadLibraryExA
UnhandledExceptionFilter
TlsGetValue
MultiByteToWideChar
GetLocalTime
SetFilePointerEx
GetModuleHandleA
GetFullPathNameW
CreateThread
MoveFileExW
GetSystemDirectoryW
GetExitCodeThread
SetNamedPipeHandleState
SetUnhandledExceptionFilter
CreateMutexW
IsProcessorFeaturePresent
DecodePointer
TerminateProcess
GetModuleHandleExW
SetCurrentDirectoryW
GlobalAlloc
LocalFileTimeToFileTime
SetEndOfFile
GetCurrentThreadId
LeaveCriticalSection
WriteConsoleW
GetSystemWow64DirectoryW
InitializeCriticalSectionAndSpinCount
HeapFree
EnterCriticalSection
LoadLibraryW
GetVersionExW
FreeLibrary
QueryPerformanceCounter
TlsAlloc
VirtualProtect
FlushFileBuffers
RtlUnwind
SystemTimeToFileTime
GetWindowsDirectoryW
OpenProcess
GetDateFormatW
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GetProcAddress
GetSystemInfo
GetProcessHeap
GetTempFileNameW
GetComputerNameW
CompareStringW
GetFileSizeEx
GetModuleFileNameW
ExpandEnvironmentStringsW
FindNextFileW
CompareStringA
FindFirstFileW
DuplicateHandle
FindFirstFileExW
WaitForMultipleObjects
CreateFileMappingW
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
ExitProcess
InterlockedIncrement
GetNativeSystemInfo
GetLastError
DosDateTimeToFileTime
LCMapStringW
CreateNamedPipeW
lstrlenA
GlobalFree
GetConsoleCP
GetThreadLocale
GetEnvironmentStringsW
VirtualQuery
lstrlenW
VirtualFree
GetCurrentDirectoryW
GetCurrentProcessId
SetFileTime
GetCommandLineW
GetCPInfo
HeapSize
GetCommandLineA
CopyFileExW
InterlockedCompareExchange
GetSystemDefaultLangID
RaiseException
MapViewOfFile
TlsFree
SetFilePointer
ReadFile
CloseHandle
GetACP
GetModuleHandleW
SetThreadExecutionState
IsValidCodePage
UnmapViewOfFile
GetTempPathW
CreateProcessW
Sleep
SystemTimeToTzSpecificLocalTime
VirtualAlloc
GetOEMCP
ResetEvent
SysFreeString
VariantClear
VariantInit
SysAllocString
UuidCreate
SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW
GetMonitorInfoW
LoadBitmapW
GetMessageW
DefWindowProcW
PostQuitMessage
SetWindowLongW
IsWindow
PeekMessageW
TranslateMessage
PostMessageW
DispatchMessageW
GetCursorPos
RegisterClassW
UnregisterClassW
MessageBoxW
PostThreadMessageW
MonitorFromPoint
WaitForInputIdle
IsDialogMessageW
LoadCursorW
CreateWindowExW
MsgWaitForMultipleObjects
GetWindowLongW
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeSecurity
CLSIDFromProgID
CoTaskMemFree
StringFromGUID2
Number of PE resources by type
RT_VERSION 1
RT_ICON 1
RT_MANIFEST 1
RT_MESSAGETABLE 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 5
PE resources
Debug information
ExifTool file metadata
SubsystemVersion
5.1

LinkerVersion
14.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
0.3.1184.254

UninitializedDataSize
0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

CharacterSet
Windows, Latin1

InitializedDataSize
161280

EntryPoint
0x2c990

OriginalFileName
Hearthbuddy Installer.exe

MIMEType
application/octet-stream

LegalCopyright
Copyright (c) Bossland GmbH. All rights reserved.

FileVersion
0.3.1184.254

TimeStamp
2016:02:27 00:57:12+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
setup

ProductVersion
0.3.1184.254

FileDescription
Hearthbuddy

OSVersion
5.1

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Bossland GmbH

CodeSize
300544

ProductName
Hearthbuddy

ProductVersionNumber
0.3.1184.254

FileTypeExtension
exe

ObjectFileType
Executable application

File identification
MD5 ff939c71d13ba84e39b4d385a4b21842
SHA1 0c76ed6fb28bcd080c055b42a19ac1fa152fd50a
SHA256 9b1b94f71aefa141e704b20f6887ad4f87a727dbfe3cd99eb61e4b51ef89122e
ssdeep
196608:K8NGyHjLDhWla62aKZZOKLu3TPEx+M4ryXtrCpqVftpDkZxheNNBO8D5KnMQa:KgDjLajKZcKybFMYRUftpgpyNBUnda

authentihash 1f073ec617b770c4b25fee00bd01f0c65daf11c4cbaef3c56e6ff05bd7f44dc7
imphash 2493befdd195b101b538e7cdd3751de7
Размер файла 10.5 MБ ( 11044166 bytes )
Тип файла Win32 EXE
Описание
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable (generic) (52.9%)
Generic Win/DOS Executable (23.5%)
DOS Executable Generic (23.5%)
Tags
peexe overlay

VirusTotal metadata
First submission 2016-04-04 02:57:57 UTC (1 год, 7 месяцев назад)
Last submission 2016-04-09 17:08:11 UTC (1 год, 7 месяцев назад)
Имена файлов setup
Hearthbuddy Installer.exe
Hearthbuddy Installer.exe
Нет комментариев. Из участников сообщества VirusTotal ещё пока никто не оставил комментарий по поводу результатов анализа. Станьте первым!

Оставьте свой комментарий...

?
Отправить

Вы не выполнили вход. Только зарегистрированные пользователи могут оставлять комментарии. Выполните вход и получите право голоса!

Нет голосов. Ещё пока никто не проголосовал за результаты анализа. Станьте первым!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Read files
Written files
Moved files
Deleted files
Created processes
Runtime DLLs
UDP communications