home

0cb0204505ac8372a660c014cd85db70.pe

Microsoft MSN Communications System

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The file 0cb0204505ac8372a660c014cd85db70.pe has been detected as malware by 39 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft(R) MSN (R) Communications System

Description:
msn

Version:
6.10.0016.1624

MD5:
0cb0204505ac8372a660c014cd85db70

SHA-1:
d28bcc3ebeeb73a3e87743c4225e3492f88b5191

SHA-256:
375a549567198aae7f55b7586906d84dcb18542b61fc2b11f78260ab76f1272d

Scanner detections:
39 / 68

Status:
Malware

Analysis date:
4/27/2024 4:34:17 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Jadtre.F
658

Agnitum Outpost
Win32.Nimnul.Gen
7.1.1

AhnLab V3 Security
Win32/Wapomi
2015.04.16

avast!
Win32:Evo-gen [Susp]
2014.9-150417

AVG
Win32/Wapomi.C
2016.0.3136

Baidu Antivirus
Virus.Win32.Otwycal.$b
4.0.3.15417

Bitdefender
Win32.Jadtre.F
1.0.20.535

Bkav FE
HW32.Packed
1.3.0.6267

Clam AntiVirus
WIN.Virus.Wapomi
0.98/21511

Comodo Security
Virus.Win32.Qvod.~Gen
21781

Dr.Web
Win32.Simona.1
9.0.1.0107

Emsisoft Anti-Malware
Win32.Jadtre
8.15.04.17.09

ESET NOD32
Win32/Wapomi.AE
9.11482

Fortinet FortiGate
W32/Wapomi.U
4/17/2015

F-Prot
W32/Patched.J.gen
v6.4.7.1.166

F-Secure
Win32.Jadtre.F
11.2015-17-04_6

G Data
Win32.Jadtre
15.4.25

herdProtect (fuzzy)
variant of acf45050-sample
2015.7.18.19

IKARUS anti.virus
Trojan-Dropper.Win32.Bototer
t3scan.1.8.9.0

K7 AntiVirus
Virus
13.186.14239

Kaspersky
Virus.Win32.Otwycal
14.0.0.2176

McAfee
W32/Fujacks.be
5600.6792

Microsoft Security Essentials
Virus:Win32/Jadtre.L
1.1.11502.0

MicroWorld eScan
Win32.Jadtre.F
16.0.0.321

NANO AntiVirus
Virus.Win32.Otwycal.durta
0.30.16.1110

Norman
Killav.AWIG
11.20150417

nProtect
Virus/W32.Patched.P
14.12.03.01

Panda Antivirus
Generic Suspicious
15.04.17.09

Qihoo 360 Security
HEUR/QVM19.1.Malware.Gen
1.0.0.1015

Quick Heal
W32.Jadtre.I
4.15.14.00

Rising Antivirus
PE:Win32.Dodou.a!1590972
23.00.65.15415

Sophos
W32/Jadtre-C
4.98

Total Defense
Win32/Jadtre.BE
37.0.11314

Trend Micro House Call
PE_FUJACKS.EG
7.2.107

Trend Micro
PE_FUJACKS.EG
10.465.17

Vba32 AntiVirus
Virus.Otwycal.b
3.12.26.3

VIPRE Antivirus
Virus.Win32.Jadtre.b
39388

ViRobot
Win32.Qvod.C[h]
2014.3.20.0

Zillya! Antivirus
Virus.Otwycal.Win32.1
2.0.0.1998

File size:
332 KB (339,968 bytes)

Product version:
6.10.0016.1624

Copyright:
Copyright (C) Microsoft Corp. 1981-2000

Original file name:
msn.exe

Language:
English (United States)

Common path:
C:\users\{user}\downloads\virussignlist_free_150411\0cb0204505ac8372a660c014cd85db70.pe

File PE Metadata
Compilation timestamp:
7/19/2001 3:01:47 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.20

CTPH (ssdeep):
6144:BPeyxTWzJrfB3+pJu7BOqLVJ5bbZXegqw48gyH0YtnbvK/kFZj:BPbZWzJrp3pkWJtbZU8JFtrymB

Entry address:
0x16000

Entry point:
55, 8B, EC, 81, EC, 84, 00, 00, 00, 64, FF, 35, 30, 00, 00, 00, 58, 89, 45, DC, C7, 45, EC, 00, C4, 03, 00, C7, 45, CC, 43, 3A, 5C, 33, C7, 45, D0, 36, 33, 63, 37, C7, 45, D4, 34, 34, 30, 2E, C7, 45, D8, 65, 78, 65, 00, 8B, 45, DC, 8B, 40, 0C, 8B, 40, 1C, 8B, 00, 89, 45, E8, 8B, 45, E8, 8B, 40, 08, 89, 45, F4, 8B, 45, F4, 8B, 40, 3C, 8B, 4D, F4, 8B, 55, F4, 03, 54, 01, 78, 89, 55, E0, 8B, 45, E0, 8B, 4D, F4, 03, 48, 20, 89, 4D, B8, 8B, 45, E0, 8B, 4D, F4, 03, 48, 24, 89, 4D, C4, 8B, 45, E0, 8B, 4D, F4, 03...
 
[+]

Entropy:
7.4152

Developed / compiled with:
Microsoft Visual C++

Code size:
284 KB (290,816 bytes)

Remove 0cb0204505ac8372a660c014cd85db70.pe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.