Trojan.Ekstak.GA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,399 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 4,787 |
| First Seen: | July 18, 2011 |
| Last Seen: | January 27, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| Panda | Suspicious file |
| Ikarus | Rootkit.Win32.TDSS |
| AntiVir | TR/Olmarik.AOD.2 |
| Sophos | Mal/TDSSPk-J |
| BitDefender | Gen:Heur.Krypt.70 |
| F-Prot | W32/Alureon.AM.gen!Eldorado |
| NOD32 | a variant of Win32/Olmarik.AOD |
| K7AntiVirus | Riskware |
| Panda | Generic Trojan |
| AVG | BackDoor.Delf.19.A |
| Fortinet | W32/Koblu.FA!tr |
| Ikarus | Trojan.Backdoor.Delf |
| AntiVir | TR/Sasfis.2.25 |
| Comodo | TrojWare.Win32.TrojanDownloader.Murlo.~JH2 |
| Kaspersky | Trojan.Win32.Sasfis.breo |
File System Details
Trojan.Ekstak.GA may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | queryexplorer149.exe | 5aaec7c2463fc84f2174f2398f2a4944 | 5 |
| 2. | termew32.dll | 6c79a96747f7f9f7efc925aa2d29f0d6 | 4 |
| 3. | slui.exe | 8b1fca97a1d8a31ec76b582e0b09c88e | 3 |
| 4. | udpconmain.exe | 1788fd74381a5715ea725ff93307c397 | 2 |
| 5. | AdVantage.exe | 32ce62ee23fbe94633c826b861fe7b6c | 1 |
Analysis Report
General information
| Family Name: | Trojan.Ekstak.GA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
edf1e0fff73b5c2a7a4fdee16438ca0e
SHA1:
c613fa74db9dd8f7e2223f9e2c20fb6907296774
File Size:
3.79 MB, 3789327 bytes
|
|
MD5:
4ea341aa21df0cb3a3ce5c8247a578ce
SHA1:
6d6d9cece61a8793a3cd0cc570d18d2b49f9e544
File Size:
3.65 MB, 3647063 bytes
|
|
MD5:
b10a6b83c1c9d67d4e597a2de3bf04b1
SHA1:
6912ec107d8d540648a4015d6267a875a475fedd
File Size:
3.31 MB, 3312059 bytes
|
|
MD5:
57cd4567e7861433748a7d5609cdd827
SHA1:
4645a593aa137b813fe1202c633cd2c7c08352a4
File Size:
4.38 MB, 4376560 bytes
|
|
MD5:
d699a1b43e3e316696f588be6632c53c
SHA1:
fc94dcaab120486bc3080ad1f0f839351db729cb
File Size:
4.24 MB, 4244118 bytes
|
Show More
|
MD5:
7ecf9963443c5fdbdf4bc3c456858691
SHA1:
bad8c5f90f404699b8c1a68136533ae331e4893b
File Size:
4.50 MB, 4504395 bytes
|
|
MD5:
f49800cd2e10d1b3de76e388ea6be335
SHA1:
b29a802c519b7adb034fa2fe54082e21614ab33b
File Size:
4.87 MB, 4873189 bytes
|
|
MD5:
fcfd3831fab2d4da66071feae0543558
SHA1:
0cb79ce8f5ec41e8d2065941a48cc34c5d73bdcf
File Size:
4.14 MB, 4136468 bytes
|
|
MD5:
830addd6148449f3fd9331520045805f
SHA1:
8a0c20920330c860663ff5635d52188731617996
File Size:
2.61 MB, 2611589 bytes
|
|
MD5:
0cf7fa3cba38d51e3e6639aacb9e451a
SHA1:
7d2951e360d0a01a10cb9e5cad7184c20b788bbb
File Size:
4.58 MB, 4579321 bytes
|
|
MD5:
0b9dc9b1221c962e7c9c3e2b3ed6c18f
SHA1:
22d4c277452389c79f82843bfd246ff37e69c2ff
File Size:
4.92 MB, 4924782 bytes
|
|
MD5:
154363350483b3d4bf625b6252d21af6
SHA1:
63c6ce6d15223055fcd4ddd089cb4e15009d758e
File Size:
4.76 MB, 4762396 bytes
|
|
MD5:
0fa99e43bba469f405b7fd4efab70f59
SHA1:
1510a779e1869bce81284fd4284ff3d17d706981
File Size:
2.59 MB, 2587258 bytes
|
|
MD5:
2745b5e87cad42c0181e1415dc0f73df
SHA1:
e1c3fd3319586ac4eeb63012cb9d088c413d0a84
File Size:
4.85 MB, 4846226 bytes
|
|
MD5:
40dda3439e23255cb0ede011913b2f03
SHA1:
9721cd8d1d8a03af38108762418bdfcbe64a5f81
File Size:
4.30 MB, 4300472 bytes
|
|
MD5:
540fdf8ea073a1606dd062d9453e8970
SHA1:
7ac4d111ec96405ea6d964dd1134542f6e049490
File Size:
4.75 MB, 4745405 bytes
|
|
MD5:
ed2758708801f357005feea52924fe9a
SHA1:
3b6f92fb49c31e9669b69c9ea3a0eb18bd8cda25
File Size:
5.35 MB, 5348827 bytes
|
|
MD5:
f445dc8cf4d2ec2af5871bfa270902df
SHA1:
21b50ff1fd5d77f6e3e1667c26eacae989f19f41
File Size:
3.00 MB, 2999654 bytes
|
|
MD5:
ed7eda65fd8be6c2e108ed6764a67a37
SHA1:
670381a41b7e333939aff0929bad4c4df4c81e7f
File Size:
5.22 MB, 5223848 bytes
|
|
MD5:
5676065a88fd630608941528eee76b35
SHA1:
b2e25c068941d719cd48219e789172b46012c969
File Size:
5.40 MB, 5398527 bytes
|
|
MD5:
18b2e023394e0a308d250082f951af7c
SHA1:
dcd19ac16ff873476383c2b141a9ad15a698d23d
File Size:
4.02 MB, 4016784 bytes
|
|
MD5:
cd84334ffc2dba169d1655f973e8c038
SHA1:
446f413a32f7fc0ac086cddf2524984a84f43774
File Size:
2.21 MB, 2206978 bytes
|
|
MD5:
18da207b6d4202179eeb91f69ec6e026
SHA1:
ad8e7d6c5c30c1b082d4646516677031f1d6d1a8
File Size:
2.67 MB, 2667963 bytes
|
|
MD5:
1ec28400ace7ca68ed88ded8d6b2fd45
SHA1:
739da1af3835d1ce70af7f9e69999f43a4d65db7
File Size:
2.76 MB, 2758538 bytes
|
|
MD5:
b020f6126daf2a19ebdf608ea034274e
SHA1:
a178a72405931504ffd0f072fa6fc0b05b4c3781
File Size:
5.16 MB, 5156802 bytes
|
|
MD5:
1ff7634eeb0ef6eb218553ee887986de
SHA1:
25bf17d300575c7ada9f72242da473da28357656
SHA256:
48F3F204E91B6B2FFDC6665667AF3729C4DD77C5112862A8FDBFC5FC93507319
File Size:
2.34 MB, 2343127 bytes
|
|
MD5:
f2796a001585e31d964f5774aa32cd0f
SHA1:
b4331a1b87cb9178fab64b969fa14d5667b8c7bb
SHA256:
1923973067E2BA513D94B459E348326ED2914D351E17EE9BDB31F641812D14A7
File Size:
2.34 MB, 2341608 bytes
|
|
MD5:
99e20d9ccc127bdbf31c6ce693b248c2
SHA1:
6a42504bf448d5eb211241229b0a91921164cbb8
SHA256:
85236D071A6B905359E03A2509837C868FED98784250A67C5D937D223B64E0E0
File Size:
3.79 MB, 3789791 bytes
|
|
MD5:
c1620277b9d6b85398111915f5e90298
SHA1:
2ef571c5a5f5c2e4c7e1f1fec602d2e2f4d0793d
SHA256:
7D0C345FDFBC10403475E1272C845C441568F933EDD3B5D359696BF3F55ABFED
File Size:
2.49 MB, 2486243 bytes
|
|
MD5:
9359e559514ee437bca74b3fe77728f0
SHA1:
203310e6e8920cfe649be9c4039db05d380ab7a3
SHA256:
7DCD973168767A09CED58A307B9917AFA18D933FBD4BB85A30D257068408B111
File Size:
3.67 MB, 3665918 bytes
|
|
MD5:
97d929e8b597d09a3883b3f9e9bff089
SHA1:
9cf7230115505465e503f36419bcb59eed27f4ae
SHA256:
F09E258D377AB5C0F2B3CABE2368036C6924059B6DBC1C3FD04D01531396A75F
File Size:
2.57 MB, 2573500 bytes
|
|
MD5:
fe6e60025e293161f94d72ba52c83f37
SHA1:
fe6284611544a8375b5acb53e568844d354a3c24
SHA256:
56496C18A9484CA8ABC494707FCD1DA1FC90277C71938EC4029A80264A3FC41C
File Size:
2.89 MB, 2893396 bytes
|
|
MD5:
0df6a03ae45b6866fbe6c3f3f1909bbd
SHA1:
232f7a178f291bc92141a583e15c9d09d1c3a0f5
SHA256:
1007FBFCD11F47D556A76B6079877C1588E8D35BF1929142BC5FE165AE89A318
File Size:
2.86 MB, 2858265 bytes
|
|
MD5:
955628622992c074f5fb3e80a3de15b5
SHA1:
06da653f03435c22b1955cacb4e8809e3191b62d
SHA256:
EB1DDFAE121A40B9BCA9664AB7FAB5ECE522CEDF4B50C9F892E87A5113CAE056
File Size:
2.69 MB, 2688962 bytes
|
|
MD5:
029a484913b3c00895e02a24172b3aa3
SHA1:
6431ad0519fba4cf8987f99f23b56f38ae1393cc
SHA256:
36A2FC929D11E88DB7B470DE363C2833867CCCBCF04BD9A0A447E9F7A605C094
File Size:
2.80 MB, 2802948 bytes
|
|
MD5:
86516c1b61e2fa4f170ea7b0a6b8f474
SHA1:
b4f5198dde3d1ea367be0c8a8f370ec2a491db66
SHA256:
41D90F4F0959915194BBF44BD1E3041C5FF1CD96BACBAD461BDF11ED58A5D962
File Size:
6.53 MB, 6532593 bytes
|
|
MD5:
bf6d60a865bb7e29b9d76e2cc721827f
SHA1:
9cf906ae2997355611e9b9c69a31f7620abf2dfd
SHA256:
3240E492FF6830BD5A748EF1F1028B219F040C14AC2877377E5ECFDA89DC6DA0
File Size:
2.65 MB, 2645296 bytes
|
|
MD5:
562891ac88988177e65d941042da3aea
SHA1:
068637fcdb1a39bd3546c0d5c0faadd472ed0161
SHA256:
A4B55E967F453922D6B8628DA154F983B99044B62378BD36C51DA65880884F99
File Size:
5.35 MB, 5345041 bytes
|
|
MD5:
685acc8cd3f875a2a55dac4ffdb0de23
SHA1:
846b20b688f36cc919d6359448ea716fed00b4bd
SHA256:
4D71924BCC2166FCFABE41F273E6DE6E7CEDDBA821E9AF9C8C59DD6B42343EF0
File Size:
4.26 MB, 4255591 bytes
|
|
MD5:
35e3f5c0b4645723cd20f930d785f4f4
SHA1:
37b42a5a5674a8d97cb75e17eb74dd9c00372575
SHA256:
47E65C565F95A570C07A7E6BFB55F74EBF09FD5FA15B4287A6551C70C8CA3DB7
File Size:
2.42 MB, 2418041 bytes
|
|
MD5:
de4b8638e8ae35a8a89a1d4a25589f91
SHA1:
1de249191055f2799861646a432af3cdcbea7dde
SHA256:
C3E6F4543CFB0D6E859CBDBFD8269AC49A468BDB48B0B056AAD412864BC221D4
File Size:
4.91 MB, 4911104 bytes
|
|
MD5:
385e76c8cea138a05c1f1b4b14ef8a92
SHA1:
99730204237a4b6824bd2d22a57b0a147790af08
SHA256:
5BD23D34BE546947E298684A129DA72089AABEEA55B4EA63E5FEFB1106926162
File Size:
3.81 MB, 3809279 bytes
|
|
MD5:
de746c76f962e5004a563bc3ae56f83c
SHA1:
b721e1e2d5d61b556fe933c9b39437b132fa4dc1
SHA256:
D3EE5266C5C65BF70BB956E4EFF2AB044B68F2CB666E43019E2CB64681C417A6
File Size:
2.09 MB, 2086346 bytes
|
|
MD5:
8e1bc8bc20a70ead38d182caab96ba8a
SHA1:
16916929fb83741932d35c30f2bdee123291a897
SHA256:
B292A0844B014B0F425FD945208A05EC14E626DB9F256C42A8DCAD8A78B94335
File Size:
2.65 MB, 2649180 bytes
|
|
MD5:
56a5adc8c4e3187f09616ef2359cd8f2
SHA1:
c32b9087e34f99ff81ac6e58daf00853d8c759a3
SHA256:
798C725BDE7CBFD7AFA42C14DF3ED0B90DFF8AD58977DC19DEC625BA13F17C4C
File Size:
2.58 MB, 2577863 bytes
|
|
MD5:
d68a7b78be78b54638ca83f28c9c313c
SHA1:
2d6a29c14cd79ead86c887fd6b3db0017d28fdde
SHA256:
7E20EDDA76681774D6034138F3F8F322B3B4496F8216F32A79C3CC97F467AAD7
File Size:
2.78 MB, 2775878 bytes
|
|
MD5:
161d4fcc71e4f187c3efec5c4a0d9efa
SHA1:
58e6b9024557039238b74c76a7f7fb92c1d227ad
SHA256:
F87C5129B4C477DB1B864926D31E07F1B80359C2C486A790E45476BD11D08C39
File Size:
4.58 MB, 4579319 bytes
|
|
MD5:
8c02d6b0c331729ed1545649a0a1520d
SHA1:
d7c299acb7b874cd446ac88619649441f5f02c72
SHA256:
2C5F8573E393ACC655810F4BC64D79CB87B4734711496BBC7FD38AAA5C878188
File Size:
2.49 MB, 2491562 bytes
|
|
MD5:
c421df2892a723a64beab0781d85dec6
SHA1:
b703aaf54b9f4a7057c59169bf3d956637cd3c4a
SHA256:
4540D3DBBED85DB8A58B3A580FF3DC9F0D31227C815162C19FE08BF65AFBF3BB
File Size:
2.34 MB, 2343861 bytes
|
|
MD5:
4703b8c22dc323d857b590d04500478f
SHA1:
fcf9bef34ba80abde1d7ac4323c2e6f5c5af2741
SHA256:
8FC0E89BD7B232E48D39952FE5281D3CDE2F812F206DE0AC8F4600A42C31238A
File Size:
2.24 MB, 2244582 bytes
|
|
MD5:
88b7cd5b429649376bb40085db2ee232
SHA1:
83793686c6015989c19f239ab3ad42de6e5095df
SHA256:
DD6BEB878B2C22003F5F8362CF398AE338531F9F140D77DD6282A74E455E1EAC
File Size:
2.54 MB, 2539967 bytes
|
|
MD5:
5ba0c8990167be8027320d304166f79d
SHA1:
57f2d16360380cd03e2fc3e624a0b9455f45fa88
SHA256:
651C830BA0113BF3E993C3D860979C4F47F25A91C5CD9534AB7874EA033C2ACA
File Size:
2.78 MB, 2781696 bytes
|
|
MD5:
2c67d5bb5f5c125702acfab1f7adfeec
SHA1:
fd68eb04960b636c06f0ec151dfef63acea10d4f
SHA256:
61A9E5E1AB31F4D4A53E2E42C638E41701C3C73F22F56D051C59517F6E43581C
File Size:
3.33 MB, 3327431 bytes
|
|
MD5:
57c0f522db0a0e8b3ab42a86f3704ff7
SHA1:
3911cabbfddd7c4b06197b379fff09439775bf45
SHA256:
BD0851586F260DE2CE76F7D17FBDE6D274673E77C43831EB6CC9728F5684091F
File Size:
3.00 MB, 3004795 bytes
|
|
MD5:
0db49f65d49a1f1d577c1774be4d873f
SHA1:
450a453e98f65c240b44c86b7da18aa7787f5950
SHA256:
0DDBD74118BD5A958424BCA4BA809F816C8B33517AABCEA26F34682761E613E6
File Size:
3.36 MB, 3355303 bytes
|
|
MD5:
a04efb32260007ce1b68a51f82079754
SHA1:
cd62991649c944e74d60b90febe64521eb73bdce
SHA256:
FF42F8BF641E035C35E2299CA175056149F1876007328BBB2070020FB4066B4D
File Size:
2.46 MB, 2455805 bytes
|
|
MD5:
07e06e45292b66b15faec0987c13755d
SHA1:
8e0a174373be7169beb69ead4f33f5ab3a753c30
SHA256:
721703F404C1B16FB29E9234359B345B6947BA98716E8034457304F753396AEF
File Size:
2.65 MB, 2653016 bytes
|
|
MD5:
a44cd8a400bf442c10ec9405e35004d9
SHA1:
0cbcc975b1af5c00ac1936c6d7ac135ba206490a
SHA256:
8A226FCF6C6E2DACCDBD03D02059354464428075D2A9CE0EDB73B3D95B639214
File Size:
3.35 MB, 3346867 bytes
|
|
MD5:
4b97cd91404946871863bf9470e8c0e6
SHA1:
f7bc40d6138bbb9cf116030b6b336ee8d7f97729
SHA256:
5EA78874AA4FCCB2F8C0721856CB00C401E397A7816195E5DB0530901D75BEEA
File Size:
2.38 MB, 2376530 bytes
|
|
MD5:
40fbbedfd49173bb08634f3e28927b43
SHA1:
29f8d35093fd5154df66777bc6b8ac7f6eea42ee
SHA256:
63511273ACBA22DE6BEAC0EC3F5DE3B1E38F3A47E4CFA872F43CBDB164ACB2BF
File Size:
3.12 MB, 3124353 bytes
|
|
MD5:
a82115538cc2d2dd5793ba48442cf0b0
SHA1:
8d36dcbf095af504e1848d0930737f618dfc2998
SHA256:
79D1FC0C8AC8C13ABCD6EA435E242DD19C964F86629930936C38637AB7D60567
File Size:
3.28 MB, 3280351 bytes
|
|
MD5:
1d9731201137ab5c0270d5b455386668
SHA1:
51b2305a033e32ca3cc8bd599f4e0efb50a0a19e
SHA256:
3C062005BB455C6A03A8EED3176DAC19A33BEC27F8A44A9631FA69F302DC54F6
File Size:
1.76 MB, 1759220 bytes
|
|
MD5:
0b3cfdacc08cd85905ab1d3a040d505c
SHA1:
efc2e1e452c85b549329f2e9874853d1e7b9f087
SHA256:
88D3D4A572FE2AE5B1D1EE47BE69597F0D74156D8EE388A964F0D097FD0A27CF
File Size:
2.58 MB, 2583061 bytes
|
|
MD5:
4b0de8ed6b90b1e948ac64626d907d3f
SHA1:
0299b3590d35d31ccd6dcf48a1b39f48e656fb7e
SHA256:
E91BB7846BD3BF2ACE979A8FD4363AEB1598EA58A67A26CC2FC389690184922C
File Size:
3.64 MB, 3637248 bytes
|
|
MD5:
7488030f336ba6b250cf77333e4cb558
SHA1:
6e4d60fe991271fb58edf5db7ba7b33455f33b03
SHA256:
C95B9586CD4964DA3A7CF91DC4364353361EC86B2E34564142DC82BBB9726070
File Size:
2.71 MB, 2708708 bytes
|
|
MD5:
32cdcac16e86a5e2a133712b04e0f3ee
SHA1:
133ec3bb8a14484c121fa0a4b3e1465da57dde29
SHA256:
3EA21D627309069F0F949E7CC941E362B9F0FD19CEBC92768D024AB03FCCE800
File Size:
2.93 MB, 2926140 bytes
|
|
MD5:
fd1e465a23936cef8d4f421742fb0c0c
SHA1:
f6aec6030c28021873d0d98815c6ef2d9072ddbc
SHA256:
C8727433D15608C10E073845BB6B9F357DFEE4C5A75B502D2D7730A01220AEF9
File Size:
2.49 MB, 2486819 bytes
|
|
MD5:
86b40f352f599a137027557b10dd8969
SHA1:
c0809fe66b8aeccabb17a22a06fbd1a7822b2a42
SHA256:
B53F97C21FF491E3BE54ADA66D84654DE04011A4EEFCC46A6D47E0C14171E177
File Size:
2.87 MB, 2867278 bytes
|
|
MD5:
194d46915713f070104eeb03ea442b5a
SHA1:
d0f12ccdf2632a7cb37b40c36cf9e757a5786494
SHA256:
C702590F5D50A6F6174BFCCE9AE99253E55133D56E6AC2F101E4DAF34553B281
File Size:
2.96 MB, 2959182 bytes
|
|
MD5:
f6a33d702612d2a5942d90b45830a9e1
SHA1:
148bd113a40f593a39a21784a879afb982d258b2
SHA256:
F660BEE472C0C15BCC81021C73A5611A3562FB4C6460E29F31C0D725B2F76804
File Size:
2.52 MB, 2521981 bytes
|
|
MD5:
15395dc9f90739515d07c4fadd3d9412
SHA1:
77c1958db9cf766cb5db3c9263d8d845c0c54c8c
SHA256:
968E2220CF0196834AC47A1111882261035282B340D2222C5E2EAE21E3AA9104
File Size:
2.52 MB, 2515309 bytes
|
|
MD5:
df23f221ddc0c74c9427b8f6d6ad386d
SHA1:
872044dd303c44a08b272c0331c0ea4eb79a932c
SHA256:
540ED4EDF14CE76A77FFDFC2B35D8EBFD7B30650F7C16D22DA22E22CA64CC91B
File Size:
4.18 MB, 4179758 bytes
|
|
MD5:
6675cc9ec60765c3298505f70ab001c3
SHA1:
08eca9057b450f2317323116257f94bf15380c2b
SHA256:
9C0AE2425E982ED5CEA9A851D404DC3DFDAFE19D8EB261A5DC7024AB7063B23D
File Size:
2.57 MB, 2569084 bytes
|
|
MD5:
adc0daf14c6a22391d38a0be81a690d7
SHA1:
aa0951b72cd345e1e39215ab065381feee26c740
SHA256:
32CFBAA7B78B7D5866B2FF17BBB8171F2DFE04C04CDF8AF0939389BDC44F1501
File Size:
2.38 MB, 2381717 bytes
|
|
MD5:
82dd3c12d109c88165a1a6fb7bda1b7c
SHA1:
6d212c4453473d572ef724eef7bc04affa83c1b4
SHA256:
15A3C03B3ED3D756E8A9B03443D79BFBAAAB07F28E3EA389924CE38DA578F40D
File Size:
2.66 MB, 2659189 bytes
|
|
MD5:
fae11a2946db3a2eeaf6fbdb28d529e0
SHA1:
6a530b2261ccaeebd4edb2c162382cc02541a6f5
SHA256:
308CBE3D9481167042E02ACEEB6DAE45A3A4A48B0FF8FEBB17879E87F7A7AFCC
File Size:
2.78 MB, 2783836 bytes
|
|
MD5:
2432fe7bcacbe609382e5c961ac9ba67
SHA1:
492ad3353f4e9e47872c6cf278ee472a4b3b2edf
SHA256:
9C4C373DB6478A14AF92B2004ADAE5AEF64730D243C55DC9538E12E4A745ACDE
File Size:
3.07 MB, 3070587 bytes
|
|
MD5:
97024653af6f0e435ea267293676292e
SHA1:
fca2cb4c649e5eff864ce4117ac3491bfab6e726
SHA256:
35B2228B50C176DA599A4670FDF4D8903EDBC57D33D0D909A5B8E56FB832F9EB
File Size:
2.16 MB, 2161733 bytes
|
|
MD5:
1ae799200619794fc822be70e2901966
SHA1:
3eec361bbfa3aef6a92156bc303df881b2c13e42
SHA256:
4CC4C352592EB33E29704CBB5AE80136FFEEF9B7BCB0895045F53160678DD04E
File Size:
2.32 MB, 2319277 bytes
|
|
MD5:
cc1601064dd1a8f439fa0298d6b3a4c4
SHA1:
9f1eeded810963aedf849e7eb6eacb53fe0dbc65
SHA256:
7674F95DE40177F81F65849F0AF8AD50A844E6E078E0818C28C7046E1C98EA1B
File Size:
2.26 MB, 2262093 bytes
|
|
MD5:
e4ed38e20187d5ab9e0941da57348ef0
SHA1:
caf766f87ef2470daa9fa522ded81095bafe8923
SHA256:
9239B51001AFEC363A390F929560A651ECADADD9A000EFE649AB4FA87AFC1896
File Size:
2.45 MB, 2445038 bytes
|
|
MD5:
0a4fb2a3af5bde7b4d07d27d440f7860
SHA1:
ccc463af62eb2b314d98b7ae8f5ddec9a2f0ca09
SHA256:
F6AFD78C72CC086465A12E5E7DB93426726E7D3BEC0FCBCD28C57629AA109DA3
File Size:
3.35 MB, 3351519 bytes
|
|
MD5:
0358d0b3913b74a575d105765eca3129
SHA1:
9b10fb7a340f0edd4940bfabaad37f703e0c4909
SHA256:
383CE50A0648065D5C57A7DB9702D88A10542688884B8F227E95F61C2BAB6B45
File Size:
2.35 MB, 2352928 bytes
|
|
MD5:
bf85424643a132c08a74ea2c17743ebd
SHA1:
d984b29f141fa87342c47ed2a5706d4808d1506c
SHA256:
3CB7593302D0CCD4FB58B3941103A5D5D2DB56CEA38D2784A0B0C7C50872FE70
File Size:
2.91 MB, 2911207 bytes
|
|
MD5:
d0d816bbef6acc06b7bd4601243f628d
SHA1:
1863b0c34b1785bfc1331a533967fdf7b14a94ee
SHA256:
5B2E8E47248FA816478790E39C534C3E0897979584DE48C054F886639718634F
File Size:
6.34 MB, 6339631 bytes
|
|
MD5:
bf64ce172fa18ddcd2ac1bf9f447ac48
SHA1:
fcf6d7df0b0694c4b42811235e00d1b2b5a0fe24
SHA256:
FE9FB5B10B4A39C0A19918623B8FBF7B6044DD3F2CF64D5B77572623A7E58A6B
File Size:
2.93 MB, 2930309 bytes
|
|
MD5:
0cdee6d1a44403e229a357c90c60c63a
SHA1:
a93480e67cbc55745ea01d425e0d6d6fd5867ba8
SHA256:
C99B2C9E6FD8D90B30AB6A10171EC2BD88AC39F37BA48A90CE918D9FC92394A9
File Size:
3.89 MB, 3891188 bytes
|
|
MD5:
1b3b78663c37b8c3ac11aabadb0ee397
SHA1:
a639cd0e3dca22f8f15b79896eb05aea6e53d45e
SHA256:
DD824293D5092714E34B0F3726C6815D869EB71583B9F1F4C7E9E7CEABCE7AAB
File Size:
3.23 MB, 3229852 bytes
|
|
MD5:
8db73bbe45e0f381329ed44c823fba94
SHA1:
29c5982e14d169913d091c9ceca5fbb51e38c8c7
SHA256:
32538757210CCC37BC97C0C8160D67690A2F3F7358D1C0522FF122679581A00D
File Size:
2.78 MB, 2780527 bytes
|
|
MD5:
d0e0a70eec18b5fe5e9ea5b86fc234f9
SHA1:
29dc73f6777a77a4fe929a931ca0fdcfd0c6e93b
SHA256:
8DC0DA14925E51A1285E6E320A74ECF5CEDAC492820FC8F9B78E99B6F27F37E3
File Size:
2.60 MB, 2598384 bytes
|
|
MD5:
24b8b4c113c559d17da0a42dce7027fa
SHA1:
030a7cea75c50ae21f0f6de2995b486e16133569
SHA256:
A2887C744AF3EA0FC9122C9CBA0EAA440CB2DDB90D6155775B891F226940B919
File Size:
2.74 MB, 2735123 bytes
|
|
MD5:
9c50d8d149bedcaf10bf561404aa48b3
SHA1:
7301cff09315ae28480b4559a3a9ec2207d6a98f
SHA256:
5942A4EA5C870BE2ABD2C8CAD5F29DDFCA5E76FFEFD8831F36F78E51C90472B0
File Size:
4.89 MB, 4886516 bytes
|
|
MD5:
181129f5d0122e0bd1f916cd8c667ef5
SHA1:
2fb47dc6065fee590f4b6ae27e2f70042bfbf7e2
SHA256:
4F2A4CE9DCAF1D5A0BC9907F89D18E865A85873453DEB08E57DA6F99CA1FAD5D
File Size:
3.07 MB, 3068833 bytes
|
|
MD5:
fd3821535163962ab9ac7e3608978a7c
SHA1:
49ffd108d647c84f888620aa09bde64324196e8a
SHA256:
C8696800B8CB4702274DDD293DC490E6839D67CC7A20EE18A83813E262AC1CE4
File Size:
2.86 MB, 2862858 bytes
|
|
MD5:
4e765d4aa88cae352a40d81e067fa131
SHA1:
b3a0fcc7f60cc2ac04119bbc6badce0e3361177c
SHA256:
7866F673D66FE067BDE5EFDB2C35EE586A01897D1BB4BDFC868287736554C73D
File Size:
5.73 MB, 5726204 bytes
|
|
MD5:
f38e344821cec836b4dac2e86bc35478
SHA1:
09c93002b9249f61a95a9daafeaeb5e7deb15679
SHA256:
E7BFB2467F6E1B0D56A4CA7B1E246D79E81E1DE631715DCF4F5197D4C5CD4AB7
File Size:
3.00 MB, 2996220 bytes
|
|
MD5:
39bf4ed7299eae3902fb3220c3f741ef
SHA1:
42c817a35df820eadc899e90913eded008c148de
SHA256:
683861E912A8DA3E58AAA9587E83B2C04364B5F29670733E4AF9F2501033AAB5
File Size:
2.15 MB, 2147222 bytes
|
|
MD5:
25b3ba6965546653632bcdb389294552
SHA1:
b65a009f667b059fd6bc42ffab100ebdfee90554
SHA256:
87FCEE0A108EFF01B95D88DCDC9608DAE27DA391BE1F149A49D2C52FEBB2A95F
File Size:
2.58 MB, 2575552 bytes
|
|
MD5:
367a989d268a37e040d536ac8e83a558
SHA1:
d56437a8d3e24b346234485784744eef1c21a7cc
SHA256:
3034C7DAD8637B1E1266078E331CEB5523B03C8D2800C9CA035F5B5F10835CC3
File Size:
2.94 MB, 2936143 bytes
|
|
MD5:
0267b0db9b05cf41d46c385e13c370a3
SHA1:
8bb76824d5c6b1e65d3a6811210a895a88dba5bb
SHA256:
3ED0A16C5B1A3DBA2C5E291CE8235EEA8729350A9B4F52C2AE13FDDE346637D7
File Size:
2.97 MB, 2965674 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
561 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
|
| Legal Trademarks | Copyright © 2011-2012 3delite |
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- 2+ executable sections
- HighEntropy
- imgui
- No Version Info
- VirtualQueryEx
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,171 |
|---|---|
| Potentially Malicious Blocks: | 288 |
| Whitelisted Blocks: | 836 |
| Unknown Blocks: | 2,047 |
Visual Map
0
0
?
?
?
?
?
?
?
?
?
0
0
?
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
x
x
0
0
0
0
?
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
x
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
x
?
?
?
?
?
x
?
?
?
?
x
x
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
?
0
0
?
0
0
?
0
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
?
0
0
?
?
x
?
?
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
0
0
?
0
?
?
0
0
?
?
0
x
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
0
?
?
?
?
?
0
0
x
0
?
?
?
?
x
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
0
0
?
0
?
?
0
?
x
?
0
?
0
0
?
?
?
?
0
?
?
?
0
?
?
0
0
?
x
0
0
?
?
x
?
?
?
0
?
?
0
0
?
?
0
?
?
x
?
x
0
0
x
?
?
0
?
0
0
0
?
0
?
?
x
?
?
?
?
x
?
0
?
?
x
0
?
0
x
?
0
?
0
?
?
0
0
?
?
0
?
?
?
?
?
?
?
0
?
0
0
?
0
0
?
0
x
x
0
0
?
0
0
x
x
0
0
?
?
?
?
?
0
?
?
?
?
x
?
?
?
0
?
?
0
?
x
?
0
?
?
x
?
x
?
0
?
0
?
0
0
0
0
0
?
x
?
?
0
?
?
0
0
0
0
x
0
0
?
?
?
x
0
?
?
?
0
?
x
?
?
x
?
0
0
?
0
?
?
0
0
0
0
?
?
?
x
?
?
?
?
?
?
?
0
0
?
0
?
x
?
0
0
?
?
x
0
?
0
0
?
?
0
?
0
x
0
?
?
0
x
?
?
x
x
?
0
x
?
?
?
?
?
0
0
0
0
?
?
?
?
?
?
0
?
?
0
0
?
?
?
?
x
?
?
?
?
0
?
?
0
x
?
0
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
?
?
0
?
x
?
?
0
0
?
?
?
?
0
0
?
?
0
0
?
?
0
?
?
x
x
?
x
?
?
0
?
0
?
0
0
?
?
x
?
?
0
?
0
?
x
0
?
?
?
0
?
?
x
0
x
x
0
?
?
x
x
x
?
0
?
?
0
?
0
?
x
x
?
?
?
x
0
0
0
?
?
0
?
0
?
?
x
?
x
?
?
?
?
0
0
0
0
?
x
0
0
?
?
?
x
?
?
0
0
0
?
?
?
?
?
?
?
0
?
0
0
0
0
?
?
0
0
?
0
x
?
?
?
0
0
?
0
0
?
0
0
0
?
x
?
?
?
0
0
0
?
?
?
?
?
?
0
?
0
?
?
?
0
x
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
x
?
?
?
x
?
?
?
0
?
?
?
?
?
?
x
?
?
0
?
x
?
?
?
?
?
?
?
0
?
?
x
?
0
x
?
?
?
0
0
?
x
?
x
?
x
?
0
?
0
?
x
0
0
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
0
?
0
?
?
?
?
?
?
0
?
?
0
?
0
0
0
x
?
x
x
?
0
?
0
?
?
0
?
x
?
?
x
x
0
x
?
?
0
0
?
x
0
x
0
0
0
?
x
?
?
?
0
x
0
0
?
?
?
?
?
?
?
?
x
?
x
0
0
?
?
?
0
x
?
?
?
0
?
0
0
x
?
0
?
?
?
?
?
x
0
?
?
0
?
?
?
?
?
0
?
?
x
?
x
?
x
?
x
?
?
?
?
0
?
?
?
?
?
?
?
?
x
0
x
0
0
?
?
?
0
?
?
?
?
0
?
?
x
0
0
0
?
?
?
?
0
0
?
?
?
x
0
?
?
?
?
?
?
?
0
?
?
0
0
?
?
0
0
?
0
?
0
?
?
?
0
?
?
?
x
?
0
?
?
?
?
0
0
x
?
0
0
?
?
?
?
?
?
?
0
0
0
?
?
?
?
?
0
?
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
x
0
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
0
?
x
?
?
?
?
?
0
?
?
0
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
0
?
?
?
0
?
0
?
0
0
?
x
?
0
?
x
0
x
?
?
?
0
?
0
x
?
0
x
0
?
?
0
?
x
?
?
?
0
0
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
0
0
0
0
x
?
0
x
?
?
0
0
?
0
0
0
0
?
?
?
?
0
0
?
?
?
?
0
0
?
?
?
?
x
?
?
?
?
?
?
x
?
?
?
?
?
?
0
0
?
0
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
0
0
?
?
?
?
?
?
0
0
?
0
0
?
0
x
0
0
?
x
0
?
?
?
0
?
?
?
?
x
x
x
?
?
0
x
0
x
0
?
?
0
0
?
0
0
?
?
?
?
?
?
?
0
0
0
?
?
?
?
0
0
x
0
?
?
0
0
?
?
x
?
?
?
?
?
0
?
?
?
x
?
?
?
0
?
?
?
0
0
?
?
x
x
?
?
0
0
?
?
?
?
0
0
0
0
?
0
?
?
?
0
?
?
x
x
?
?
?
?
?
?
?
0
0
?
?
x
0
x
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
0
x
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
x
?
x
x
?
?
x
?
?
0
x
0
0
0
?
x
?
0
?
0
?
?
x
?
?
0
x
?
x
?
0
?
?
?
?
?
x
?
?
?
?
?
0
x
x
0
?
x
0
?
?
?
?
?
?
x
?
?
?
?
0
0
x
0
0
?
?
0
?
?
x
x
0
x
?
?
?
?
?
x
x
0
?
?
x
?
0
x
0
?
?
0
?
0
?
x
0
?
0
0
0
?
0
x
0
0
?
?
?
?
0
?
?
?
0
?
?
0
?
?
0
0
?
0
0
?
x
?
?
?
?
x
0
0
0
?
?
?
0
?
?
0
0
0
0
?
0
?
0
x
?
x
0
0
?
x
x
?
0
0
?
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
0
?
?
?
?
x
x
?
?
?
?
0
0
?
0
0
0
?
x
?
?
?
?
?
?
?
0
0
0
?
0
0
?
?
0
0
?
0
?
?
?
0
?
x
0
0
?
?
?
0
?
0
0
x
?
0
0
?
?
0
?
?
?
?
?
0
0
0
?
?
?
0
0
0
0
?
?
0
0
0
0
?
x
?
?
?
0
?
?
x
x
x
?
0
0
?
x
?
?
0
x
?
0
x
?
?
x
?
?
0
?
?
0
?
0
?
?
0
x
0
?
?
0
x
?
?
0
?
?
?
?
?
x
0
?
x
?
?
0
x
?
?
?
0
0
?
x
?
?
?
0
0
?
?
x
0
?
x
0
0
?
?
0
x
?
0
?
0
?
?
?
0
0
?
0
?
0
0
x
0
0
0
?
?
?
?
?
?
0
?
0
?
0
?
0
?
?
?
?
?
?
?
x
0
?
?
x
?
0
x
x
?
?
?
?
x
0
?
x
0
?
x
0
0
?
x
0
x
0
0
?
?
?
0
0
0
?
0
?
x
?
x
0
0
0
x
?
?
0
?
0
?
0
?
0
?
0
?
?
?
?
?
x
?
x
0
?
?
?
?
?
0
0
?
?
?
?
?
?
?
0
0
x
?
?
?
?
x
?
?
?
0
0
?
x
?
?
?
0
0
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
0
0
?
0
0
?
?
0
0
0
?
?
?
?
0
?
?
0
0
?
?
?
?
?
?
0
?
?
?
?
0
?
0
?
?
?
?
0
?
0
0
0
?
?
0
?
?
?
x
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
0
?
?
?
?
?
?
?
x
?
0
0
0
?
?
x
?
?
?
?
?
x
?
?
x
?
0
?
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
0
0
?
x
?
?
?
?
?
?
?
?
0
0
?
0
?
?
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
