home

02229009.exe

{70166A21-2F6A-4CC0-822C-607696D8F4B7}

The executable 02229009.exe has been detected as malware by 31 anti-virus scanners.
Publisher:
{70166A21-2F6A-4CC0-822C-607696D8F4B7}  (signed and verified)

MD5:
28f04ff83a96480fbef54d7afa6f3dcd

SHA-1:
2ddb2577acadbfc7008e6ece05693d12d625a0d7

SHA-256:
6a063de331a04059d2f293868bba946892234c7c3ffc46b299432333a2e56fe9

Scanner detections:
31 / 68

Status:
Malware

Analysis date:
4/26/2024 6:15:35 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1662316
810

Agnitum Outpost
Trojan.Badur
7.1.1

AhnLab V3 Security
Backdoor/Win32.Necurs
14.11.16

Avira AntiVirus
TR/Dropper.MSIL.40345
7.11.151.166

avast!
Win32:Malware-gen
2014.9-141116

AVG
MSIL3
2015.0.3288

Baidu Antivirus
Trojan.MSIL.Injector
4.0.3.141116

Bitdefender
Trojan.GenericKD.1662316
1.0.20.1600

Dr.Web
Trojan.Inject1.42145
9.0.1.0320

Emsisoft Anti-Malware
Trojan.GenericKD.1662316
8.14.11.16.08

ESET NOD32
MSIL/Injector.DUB (variant)
8.9852

Fortinet FortiGate
W32/Badur.DMT!tr
11/16/2014

F-Secure
Trojan.GenericKD.1662316
11.2014-16-11_1

G Data
Trojan.GenericKD.1662316
14.11.24

IKARUS anti.virus
Trojan-Signed:Agent
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.178.12203

Kaspersky
Trojan.Win32.Badur
14.0.0.2936

Malwarebytes
Trojan.Inject
v2014.11.16.08

McAfee
RDN/Generic BackDoor!yb
5600.6944

Microsoft Security Essentials
HackTool:Win32/IEPassRecover
1.10600

MicroWorld eScan
Trojan.GenericKD.1662316
15.0.0.960

NANO AntiVirus
Trojan.Win32.Badur.cxkxkn
0.28.0.59921

Norman
Troj_Generic.TUGBG
11.20141116

nProtect
Trojan.GenericKD.1662316
14.05.26.01

Panda Antivirus
Trj/CI.A
14.11.16.08

Qihoo 360 Security
HEUR/Malware.QVM03.Gen
1.0.0.1015

Quick Heal
Trojan.Badur.r3
11.14.14.00

Sophos
Troj/MSIL-RD
4.98

Trend Micro House Call
TROJ_GEN.R0CBC0FE914
7.2.320

Trend Micro
TROJ_GEN.R0CBC0FE914
10.465.16

VIPRE Antivirus
Trojan.Win32.Generic
29646

File size:
405.1 KB (414,784 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\02229009.exe

Digital Signature
Signed by:
{70166A21-2F6A-4CC0-822C-607696D8F4B7}

Authority:
{70166A21-2F6A-4CC0-822C-607696D8F4B7}

Valid from:
4/19/2014 6:47:18 AM

Valid to:
4/19/2015 12:47:18 PM

Subject:
CN={70166A21-2F6A-4CC0-822C-607696D8F4B7}

Issuer:
CN={70166A21-2F6A-4CC0-822C-607696D8F4B7}

Serial number:
3F0DF1EBD88FB1B94D119CFFAC6B01C9

File PE Metadata
Compilation timestamp:
5/1/2014 10:08:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:aIyBKNQSgFkyg1kKOWclRbOr3naKGddjBshH:FQSkeGKH

Entry address:
0x6604E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.2566

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
400.5 KB (410,112 bytes)

Remove 02229009.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.