|
Download
|
|
|
SHA256
|
ac9ce0ace03632fec0a6a8820d3f36c5947cc2ed8842a8ba2a3664d8a81bffe8
|
|
Referer
|
|
|
Magic
|
Windows executable file (EXE)
|
|
Request
|
GET /kits/ytdd/YTDSetup-1956525952.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: get.ytddownloader.com
Connection: Keep-Alive
Cache-Control: no-cache
|
|
Response Header
|
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 13 Feb 2018 15:43:56 GMT
Content-Type: application/octet-stream
Content-Length: 10248600
Connection: keep-alive
Keep-Alive: timeout=2
Content-Description: File Transfer
Content-Disposition: attachment; filename=YTDSetup.exe
Cache-Control: max-age=3600
Pragma: public
|
|
HEX Peek (128 B)
|
0000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ..............
0010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 D0 00 00 00 ................
0040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ........!..L.!Th
0050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno
0060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS
0070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$.......
|
|
PE Info
|
Meta-data
================================================================================
Size: 10248600 bytes
MD5: 4c7e2845cbdf5ac8b3aafa89e7c1c13c
SHA1: 629614b6cbd9bc29a06a41490a9b887df60b9579
Date: 0x4F47E2DF [Fri Feb 24 19:19:59 2012 UTC]
EP: 0x4039e3 .text 0/6
CRC: Claimed: 0x9c9ab8, Actual: 0x9c9ab8
Resource entries
================================================================================
Name RVA Size Lang Sublang Type
--------------------------------------------------------------------------------
RT_ICON 0x2503e8 0x5b84 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x255f70 0x25a8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x258518 0x10a8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x2595c0 0xea8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x25a468 0x8a8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x25ad10 0x568 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x25b278 0x468 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25b6e0 0x200 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25b8e0 0xf8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25b9d8 0xa0 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25ba78 0xee LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25bb68 0x1ec LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25bd58 0xe4 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25be40 0x8c LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x25bed0 0xda LANG_ENGLISH SUBLANG_ENGLISH_US
RT_GROUP_ICON 0x25bfb0 0x68 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_VERSION 0x25c018 0x2ac LANG_ENGLISH SUBLANG_ENGLISH_US
RT_MANIFEST 0x25c2c8 0x3c8 LANG_ENGLISH SUBLANG_ENGLISH_US
Suspicious IAT alerts
================================================================================
CreateProcessW
OpenProcess
ShellExecuteW
Sections
================================================================================
Name VirtAddr VirtSize RawSize Entropy
--------------------------------------------------------------------------------
.text 0x1000 0x6f10 0x7000 6.497885
.rdata 0x8000 0x2a92 0x2c00 4.393894
.data 0xb000 0x67ebc 0x200 1.472782
.ndata 0x73000 0x1dd000 0x0 0.000000 [SUSPICIOUS]
.rsrc 0x250000 0xc690 0xc800 6.777099
.reloc 0x25d000 0xf8a 0x1000 7.911934 [SUSPICIOUS]
Version info
================================================================================
LegalCopyright: Copyright \xa9 2007-2015 GreenTree Applications SRL
FileVersion: 5.9.4
ProductName: YTD Video Downloader
ProductVersion: 5.9.4.0.1
FileDescription: YTD Video Downloader
OriginalFilename: Uninstall.exe
Translation: 0x0409 0x0000
|