0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: 
Elli0tt.exe 
Submission date: 
2010-08-31 18:01:08 (UTC) 
Current status: 
queued queued analysing finished 
Result: 
12/ 43 (27.9%) 

VT Community 
not reviewed 
Safety score: -

Antivirus Version Last Update Result

AhnLab-V3 2010.08.31.01 2010.08.31 - 
AntiVir 8.2.4.46 2010.08.31 TR/Crypt.XPACK.Gen 
Antiy-AVL 2.0.3.7 2010.08.31 - 
Authentium 5.2.0.5 2010.08.31 W32/Virut.AI!Generic 
Avast 4.8.1351.0 2010.08.31 - 
Avast5 5.0.594.0 2010.08.31 - 
AVG 9.0.0.851 2010.08.31 - 
BitDefender 7.2 2010.08.31 - 
CAT-QuickHeal 11.00 2010.08.31 - 
ClamAV 0.96.2.0-git 2010.08.31 Trojan.Notifier-5 
Comodo 5924 2010.08.31 - 
DrWeb 5.0.2.03300 2010.08.31 - 
Emsisoft 5.0.0.37 2010.08.31 Trojan.Crypt!IK 
eSafe 7.0.17.0 2010.08.30 - 
eTrust-Vet 36.1.7828 2010.08.31 - 
F-Prot 4.6.1.107 2010.08.31 W32/Virut.AI!Generic 
F-Secure 9.0.15370.0 2010.08.31 - 
Fortinet 4.1.143.0 2010.08.31 - 
GData 21 2010.08.31 - 
Ikarus T3.1.1.88.0 2010.08.31 Trojan.Crypt 
Jiangmin 13.0.900 2010.08.30 - 
K7AntiVirus 9.63.2396 2010.08.30 Backdoor 
Kaspersky 7.0.0.125 2010.08.31 - 
McAfee 5.400.0.1158 2010.08.31 - 
McAfee-GW-Edition 2010.1B 2010.08.31 Heuristic.LooksLike.Win32.SuspiciousPE.F 
Microsoft 1.6103 2010.08.31 - 
NOD32 5412 2010.08.31 - 
Norman 6.05.11 2010.08.31 - 
nProtect 2010-08-31.01 2010.08.31 - 
Panda 10.0.2.7 2010.08.31 - 
PCTools 7.0.3.5 2010.08.31 Trojan.ADH 
Prevx 3.0 2010.08.31 - 
Rising 22.63.01.04 2010.08.31 - 
Sophos 4.56.0 2010.08.31 Sus/UnkPacker 
Sunbelt 6818 2010.08.31 - 
SUPERAntiSpyware 4.40.0.1006 2010.08.31 - 
Symantec 20101.1.1.7 2010.08.31 Trojan.ADH 
TheHacker 6.5.2.1.359 2010.08.31 - 
TrendMicro 9.120.0.1004 2010.08.31 Possible_Virus 
TrendMicro-HouseCall 9.120.0.1004 2010.08.31 - 
VBA32 3.12.14.0 2010.08.31 - 
ViRobot 2010.8.31.4017 2010.08.31 - 
VirusBuster 5.0.27.0 2010.08.31 - 

Additional information 
Show all 
MD5 : 02d9f387d0b35b0c2750f753dc707dc4 
SHA1 : 840bae14382896e4e4bd5f15a4d4eb5552264b9d 
SHA256: 58074c6d86c4f9e2052d89f680a95f761e34a0a1be32391584913add84ddddbf 
ssdeep: 24576:eT4cZLBNGejlHdGHDtHMI4qzJzzl+4QmcgY:BAFdsHDREazz4E4 
File size : 888832 bytes 
First seen: 2010-08-31 18:01:08 
Last seen : 2010-08-31 18:01:08 
TrID: 
Win64 Executable Generic (72.0%) 
Windows Screen Saver (11.0%) 
Win32 Executable Generic (7.1%) 
Win32 Dynamic Link Library (generic) (6.3%) 
Generic Win/DOS Executable (1.6%) 
sigcheck: 
publisher....: 
copyright....: 
product......: 
description..: Or4ng3 KusH 
original name: Or4ng3 KusH.dll 
internal name: Or4ng3 KusH 
file version.: 1, 0, 0, 0 
comments.....: __QQ_1035345158 
signers......: - 
signing date.: - 
verified.....: Unsigned 
packers (Kaspersky): Splasher 
PEInfo: PE structure information

[[ basic data ]] 
entrypointaddress: 0xD000 
timedatestamp....: 0x4A19EF64 (Mon May 25 01:07:48 2009) 
machinetype......: 0x14c (I386)

[[ 7 section(s) ]] 
name, viradd, virsiz, rawdsiz, ntropy, md5 
.text, 0x1000, 0x2734, 0x3000, 3.64, 2a9893566ef0ea694cb06976f8a7862a 
.rdata, 0x4000, 0x14E, 0x1000, 0.09, 11cdd767aceda2e59e27d1fc703a7508 
.data, 0x5000, 0x1520, 0x1000, 1.57, 0c905525d68c5b18f95c89ed03e360c6 
.idata, 0x7000, 0x9D6, 0x1000, 2.50, 9dec19e569f9f587b5354fa63b5c3567 
.rsrc, 0x8000, 0x342C, 0x4000, 3.90, 1cda4a3a1ee48f12461c149b40dc307b 
.reloc, 0xC000, 0x3C9, 0x1000, 1.73, 43b493957e1a26a3a4fec10f9e322181 
splasher, 0xD000, 0xCC000, 0xCB091, 7.96, 7f6a48992d10b406f62dae8a2edccac6

[[ 5 import(s) ]] 
KERNEL32.dll: ReadProcessMemory, GlobalAlloc, OpenProcess, CloseHandle, SetThreadContext, SuspendThread, Sleep, ResumeThread, WriteProcessMemory, VirtualProtectEx, GetThreadContext, GetExitCodeThread, GlobalFree, CreateRemoteThread, ExitProcess, LoadLibraryA, FindFirstFileA, GetWindowsDirectoryA, SetFileAttributesA, TerminateProcess, CreateProcessA, SetCurrentDirectoryA, DeleteFileA, GetModuleFileNameA, GetModuleHandleA, GetStartupInfoA, GetProcAddress, WaitForSingleObject, GetVersion 
USER32.dll: MessageBoxA 
comdlg32.dll: GetOpenFileNameA, GetSaveFileNameA 
ADVAPI32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey 
MSVCRT.dll: _onexit, _stricmp, __dllonexit, _strcmpi, strcpy, memset, tolower, strcat, strlen, strstr, fprintf, fgets, fopen, fclose, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp

VT Community 
0 
This file has never been reviewed by any VT Community member. Be the first one to comment on it!