home

كتاب روح التضرعات للارشدياكون حبيب جرجس.exe

Loading

Maxiget Limited

This is part of a bundled installer which provides applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application كتاب روح التضرعات للارشدياكون حبيب جرجس.exe by Maxiget Limited has been detected as adware by 12 anti-malware scanners. It is also typically executed from the user's temporary directory.
Publisher:
Loading ...   (signed by Maxiget Limited)

Product:
Loading

Description:
Empty

Version:
3, 5, 13, 0

MD5:
83d72db563e701879bed457eb74b1b8d

SHA-1:
90ada33e59a240b2237e3b5de480b65264cac21c

SHA-256:
306963941095568b2577d0d5ad903f7b83414c908a16e21aa0d528b8603c8ffc

Scanner detections:
12 / 68

Status:
Adware

Explanation:
This is a modified installer version of the software and bundles additional offers including adware.

Analysis date:
4/18/2024 4:50:15 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Strictor.65095
833

Avira AntiVirus
APPL/Downloader.Gen
7.11.181.10

AVG
Maxiget Limited
2015.0.3311

Bitdefender
Gen:Variant.Strictor.65095
1.0.20.1485

Emsisoft Anti-Malware
Gen:Variant.Strictor.65095
8.14.10.24.04

ESET NOD32
Win32/4Shared.Y potentially unwanted application
7.0.302.0

F-Secure
Gen:Variant.Strictor.65095
11.2014-24-10_6

G Data
Gen:Variant.Strictor.65095
14.10.24

Kaspersky
Trojan-Dropper.Win32.Agent
15.0.0.494

MicroWorld eScan
Gen:Variant.Strictor.65095
15.0.0.891

Reason Heuristics
PUP.MaxigetLimited.h
14.10.24.16

Sophos
4Share Downloader
4.98

File size:
585.6 KB (599,640 bytes)

Product version:
3, 5, 16, 0

Copyright:
2014

Trademarks:
No

Original file name:
PreWork

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\???? ??? ???????? ??????????? ???? ????.exe

Digital Signature
Signed by:
Maxiget Limited

Authority:
COMODO CA Limited

Valid from:
11/11/2013 7:00:00 PM

Valid to:
11/12/2014 6:59:59 PM

Subject:
CN=Maxiget Limited, O=Maxiget Limited, STREET="Arch. Makariou III, 135", STREET="Emelle Building, 4th floor", L=Limassol, S=Limassol, PostalCode=3021, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00FBB004FE732F9C48D07FE66424856186

File PE Metadata
Compilation timestamp:
10/15/2014 11:52:27 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:9nslkcijCFBWPND2SZKcyfEUNdttL7pU21iZE9twRK8kmYI1:+lkxCFBexZkEidttL7n1ftwRK8kK1

Entry address:
0x451FB

Entry point:
E8, 86, C8, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 14, A1, 28, FE, 46, 00, 33, C5, 89, 45, FC, 53, 56, 33, DB, 57, 8B, F1, 39, 1D, 04, 2F, 47, 00, 75, 38, 53, 53, 33, FF, 47, 57, 68, D4, 39, 46, 00, 68, 00, 01, 00, 00, 53, FF, 15, 98, F1, 45, 00, 85, C0, 74, 08, 89, 3D, 04, 2F, 47, 00, EB, 15, FF, 15, FC, F0, 45, 00, 83, F8, 78, 75, 0A, C7, 05, 04, 2F, 47, 00, 02, 00, 00, 00, 39, 5D, 14, 7E, 22, 8B, 4D, 14, 8B, 45, 10, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, 45, 14, 2B, C1...
 
[+]

Entropy:
6.8584

Code size:
376 KB (385,024 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.