home

1274856605.silikon.exe

ACD Systems Ltd. FotoAngelo

ACD Systems Ltd.

This is a setup program which is used to install the application. The file has been seen being downloaded from websupport-b1.beate-uhse.com.
Publisher:
ACD Systems Ltd.

Product:
ACD Systems Ltd. FotoAngelo

Description:
FotoAngelo

Version:
1, 0, 2, 105

MD5:
914eb8fb7ccab7c4fa30d5218cfbec4a

SHA-1:
e519769b82e53cbc39378ddb26948cc08bd87188

SHA-256:
55eff43b5be77b65242c789da6dfa5ad2a8a0450da9e26b889105d60b57c0225

Scanner detections:
5 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/25/2024 9:17:11 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Agent.837472
7.11.24.230

Emsisoft Anti-Malware
Trojan.Win32.Scar.bwkh!A2
8.14.05.13.02

McAfee
Artemis!914EB8FB7CCA
5600.7132

Norman
W32/Suspicious_Gen2.BPWQB
11.20140513

Vba32 AntiVirus
Trojan.Scar.bwkh
3.12.16.4

File size:
817.8 KB (837,472 bytes)

Product version:
1, 0, 2, 105

Copyright:
Copyright © 2000

Original file name:
ScreenSaverInstall.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\1274856605.silikon.exe

File PE Metadata
Compilation timestamp:
3/8/2001 3:33:07 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:N2QrYFyseJwvT6DS70mfWfm4rnCXURby3Jp+vE2OcvakgGOplWIFJIltzmvDzJOD:NjUy9Jw7d0eWfZcUUQvEw6N6zmLV4D

Entry address:
0x2FA0

Entry point:
55, 8B, EC, 6A, FF, 68, 98, A1, 40, 00, 68, A0, 69, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, F0, A0, 40, 00, 33, D2, 8A, D4, 89, 15, 7C, E6, 40, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 78, E6, 40, 00, C1, E1, 08, 03, CA, 89, 0D, 74, E6, 40, 00, C1, E8, 10, A3, 70, E6, 40, 00, 33, F6, 56, E8, 8D, 15, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, B0, 00, 00, 00, 59, 89, 75, FC, E8, D6, 37, 00, 00, FF, 15, F4, A0, 40, 00, A3, 48, FC, 40, 00, E8...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
36 KB (36,864 bytes)

The file 1274856605.silikon.exe has been seen being distributed by the following URL.

http://websupport-b1.beate-uhse.com/websupport/files/.../1274856605.silikon.exe

Scan 1274856605.silikon.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.