home

2734963f88a2b76c42ca40135fec6905.exe

The application 2734963f88a2b76c42ca40135fec6905.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “9c8fbd7a2a8806ec2aa9d36140f371e9”. While running, it connects to the Internet address vip1.g5.cachefly.net on port 80 using the HTTP protocol.
Version:
11.12.1.127

MD5:
e013c936ecf01668a4d31419d224ccdc

SHA-1:
9680ac3f75ace666f3b330a1991c69902e08955c

SHA-256:
7a7574bc35a289dca08ac3e633ee1ff663b7a990464a30c4af10a94e65b14287

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/19/2024 5:38:01 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Wajam
16.11.24.22

File size:
4 MB (4,217,856 bytes)

Product version:
11.12.1.127

Copyright:
Copyright (C) 2014

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\9c8fbd7a2a8806ec2aa9d36140f371e9\2734963f88a2b76c42ca40135fec6905.exe

File PE Metadata
Compilation timestamp:
11/24/2016 6:21:24 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:EnFCKekMPij9kprGJdibBV6GvR1EJQr44yEqUzcur4eGbkrE2ppwU+ZBnG7Nv8P+:EzMKjaprG6nV6AcFeNr

Entry address:
0x41A000

Entry point:
53, 5B, 50, 51, 31, C9, 59, 41, 49, 52, 31, D2, 5A, 50, 58, 52, 31, D2, 5A, 51, 51, 31, C9, 59, 90, 42, 4A, 43, 4B, 41, 49, 52, 42, 4A, 51, 31, C9, 59, E8, 00, 00, 00, 00, 52, 31, D2, 5A, 51, 31, C9, 59, 53, 5B, 41, 49, 53, 31, DB, 5B, 51, 31, C9, 59, 41, 49, 52, 31, D2, 5A, 5B, 53, 5B, 42, 4A, 43, 4B, 51, 31, C9, 59, 81, EB, 2B, A0, 41, 00, BA, 00, 10, 00, 00, 8B, C2, 03, C3, 53, 31, DB, 5B, 40, 48, 80, 30, 44, 43, 4B, 40, 48, 80, 30, CD, 53, 31, DB, 5B, 80, 00, 30, 52, 31, D2, 5A, 52, 31, D2, 5A, 80, 28...
 
[+]

Code size:
3.1 MB (3,202,048 bytes)

Service
Display name:
9c8fbd7a2a8806ec2aa9d36140f371e9

Type:
Win32OwnProcess

Depends on:
RPCSS


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to e3-1230v2.bl-ash0.1.1.2.5.a4.securedservers.com  (131.153.5.194:80)

TCP (HTTP):
Connects to a23-15-155-27.deploy.static.akamaitechnologies.com  (23.15.155.27:80)

TCP (HTTP):
Connects to vip1.g5.cachefly.net  (66.225.197.197:80)

TCP (HTTP):
Connects to a23-15-149-163.deploy.static.akamaitechnologies.com  (23.15.149.163:80)

TCP (HTTP):
Connects to a23-43-133-163.deploy.static.akamaitechnologies.com  (23.43.133.163:80)

TCP (HTTP):
Connects to a23-41-75-27.deploy.static.akamaitechnologies.com  (23.41.75.27:80)

Remove 2734963f88a2b76c42ca40135fec6905.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.