home

4b5ad.exe

Project1

The executable 4b5ad.exe has been detected as malware by 41 anti-virus scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘8b075’.
Product:
Project1

Version:
1.00

MD5:
e42c1f13a3d246a96c168f6b1da65ace

SHA-1:
e6438ba2abc46b969206a7c91f21684b9cf20985

Scanner detections:
41 / 68

Status:
Malware

Analysis date:
4/26/2024 11:53:39 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.6861346
922

Agnitum Outpost
Trojan.VB
7.1.1

AhnLab V3 Security
Trojan/Win32.VB
2014.06.13

Avira AntiVirus
TR/Dropper.Gen
7.11.154.162

avast!
Win32:Malware-gen
2014.9-140728

AVG
Generic23
2015.0.3400

Baidu Antivirus
Trojan.Win32.Gogogovb
4.0.3.14728

Bitdefender
Trojan.Generic.6861346
1.0.20.1045

Bkav FE
W32.Clod351.Trojan
1.3.0.4959

Clam AntiVirus
Trojan.VB-44838
0.98/21155

Comodo Security
TrojWare.Win32.TrojanDropper.VB.xw
18531

Dr.Web
Trojan.DownLoad3.586
9.0.1.0209

Emsisoft Anti-Malware
Trojan.Generic.6861346
8.14.07.28.01

ESET NOD32
Win32/AutoRun.VB.AHN
8.9938

Fortinet FortiGate
W32/VB.OFA!tr
7/28/2014

F-Prot
W32/A-faf921fd
v6.4.7.1.166

F-Secure
Trojan.Generic.6861346
11.2014-28-07_2

G Data
Trojan.Generic.6861346
14.7.24

IKARUS anti.virus
Trojan-Banker.Win32.Bancos
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.1712387

Kaspersky
Trojan.Win32.VB
14.0.0.3495

Malwarebytes
Trojan.Agent
v2014.07.28.01

McAfee
Generic.dx!E42C1F13A3D2
5600.7056

Microsoft Security Essentials
Trojan:Win32/Otran!gmb
1.10600

MicroWorld eScan
Trojan.Generic.6861346
15.0.0.627

NANO AntiVirus
Trojan.Win32.AutoRun.lwkfy
0.28.0.60253

Norman
Smalldor.A
11.20140728

nProtect
Trojan/W32.Agent.290816.KM
14.06.12.01

Panda Antivirus
Generic Malware
14.07.28.01

Qihoo 360 Security
Win32/Trojan.5da
1.0.0.1015

Quick Heal
Trojan.Otran.A3
7.14.14.00

Rising Antivirus
PE:Trojan.Win32.Generic.128966F3!310994675
23.00.65.14726

Sophos
Mal/VB-MW
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-AutoRun
10457

Trend Micro House Call
TROJ_SPNR.14I711
7.2.209

Trend Micro
TROJ_SPNR.14I711
10.465.28

Vba32 AntiVirus
SScope.Trojan.VB.0605
3.12.26.0

VIPRE Antivirus
Trojan.Win32.VBmw.a
30252

ViRobot
Trojan.Win32.A.VB.303104.E
2011.4.7.4223

XVirus List
Win32.Detected
2.7.28

Zillya! Antivirus
Trojan.VB.Win32.57520
2.0.0.1822

File size:
284 KB (290,816 bytes)

Product version:
1.00

Original file name:
pp12.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\4b5ad.exe

File PE Metadata
Compilation timestamp:
1/2/2002 10:49:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:9NiH23+bRLtJy+AChZNlvFoXexoZYDWizkAawAhPeQ:DiHc+9BqGWaQhPeQ

Entry address:
0x370C

Entry point:
68, B8, 3A, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, FF, A1, 95, 07, 11, 38, 46, 44, BA, 07, AC, B7, BE, C8, 19, 90, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 75, 74, 6F, 20, 26, 20, 50, 72, 6F, 6A, 65, 63, 74, 31, 00, 6B, 65, 79, 20, 26, 20, 22, 00, 00, 00, 00, FF, CC, 31, 00, 0D, 81, 63, FF, EE, 52, 30, 58, 4C, B5, DB, A4, 1F, 74, C9, 3B, E2, 79, A9, FA, 05, CA, C7, AC, 4A, B4, 63, 6F, B5, 35, D3, 4D, 36, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Entropy:
5.3452

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
200 KB (204,800 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
8b075

Command:
4b5ad.exe


Remove 4b5ad.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.