home

4e7aa9b006.exe

The application 4e7aa9b006.exe has been detected as a potentially unwanted program by 35 anti-malware scanners. The file has been seen being downloaded from www.adscseed.info and multiple other hosts.
MD5:
1744785c94090dc561ec8ec97af75cc1

SHA-1:
0bf4ddb57d5dbecc991592ce2db57c64efdbdcb9

SHA-256:
719fedc2319b3beb3259eaf07ee26daaca78421474918aa0e0aaed7329b79b1c

Scanner detections:
35 / 68

Status:
Potentially unwanted

Analysis date:
5/27/2024 5:00:09 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Zusy.125061
345

Agnitum Outpost
Backdoor.Farfli
7.1.1

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.09.19

Avira AntiVirus
ADWARE/Vonteera.1139792
8.3.2.2

Arcabit
Trojan.Zusy.D1E885
1.0.0.545

avast!
Win32:Adware-gen [Adw]
2014.9-160225

AVG
Win32/DH
2017.0.2823

Baidu Antivirus
Adware.Win32.Vonteera
4.0.3.16225

Bitdefender
Gen:Variant.Zusy.125061
1.0.20.280

Bkav FE
W32.KirapaL.Trojan
1.3.0.7237

Comodo Security
ApplicUnwnt
23259

Dr.Web
Trojan.DownLoader12.22982
9.0.1.056

Emsisoft Anti-Malware
Gen:Variant.Zusy.125061
8.16.02.25.01

ESET NOD32
Win32/AdWare.Vonteera (variant)
10.12277

Fortinet FortiGate
Adware/ExtCrome
2/25/2016

F-Secure
Gen:Variant.Zusy.125061
11.2016-25-02_5

G Data
Gen:Variant.Zusy.125061
16.2.25

IKARUS anti.virus
PUA.Vonteera
t3scan.1.9.5.0

K7 AntiVirus
Adware
13.210.17267

Kaspersky
not-a-virus:AdWare.Win32.ExtCrome
14.0.0.610

McAfee
Artemis!1744785C9409
5600.6479

Microsoft Security Essentials
BrowserModifier:Win32/Vonteera
1.1.12101.0

MicroWorld eScan
Gen:Variant.Zusy.125061
17.0.0.168

NANO AntiVirus
Riskware.Win32.ExtCrome.domqby
0.30.24.3283

Panda Antivirus
Trj/Genetic.gen
16.02.25.01

Qihoo 360 Security
Trojan.Generic
1.0.0.1015

Quick Heal
Backdoor.Farfli.08016
2.16.14.00

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D[F1]
23.00.65.16223

Sophos
Generic PUA AL (PUA)
4.98

SUPERAntiSpyware
Adware.Graftor/Variant
9303

Trend Micro House Call
TROJ_SPNR.11BC15
7.2.56

Trend Micro
TROJ_SPNR.11BC15
10.465.25

Vba32 AntiVirus
AdWare.Vonteera
3.12.26.4

VIPRE Antivirus
Trojan.Win32.Generic
43870

Zillya! Antivirus
Adware.ExtCrome.Win32.256
2.0.0.2403

File size:
1.1 MB (1,133,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\4e7aa9b006.exe

File PE Metadata
Compilation timestamp:
2/10/2015 8:58:20 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:e0C9AknsOKvyNhXCV4E8BXAfrnkcAqU0Ak1qQC+tOyaCGO:e0C9AknnKv+hyz8grnkQf5IQCYOhC

Entry address:
0x10DAF

Entry point:
E8, A5, 72, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, BF, 0E, 00, 00, 3B, 0D, A0, 94, 43, 00, 75, 02, F3, C3, E9, 21, 73, 00, 00, 8B, FF, 51, C7, 01, 24, D5, 42, 00, E8, 19, 74, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, E3, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, BD, FF, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 83, C1, 09, 51, 83, C0, 09, 50, E8, 57, 74, 00, 00, F7, D8, 59, 1B, C0, 59, 40, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 85, F6...
 
[+]

Entropy:
6.8692

Packer / compiler:
PEQuake V0.06

Code size:
173 KB (177,152 bytes)

The file 4e7aa9b006.exe has been seen being distributed by the following 13 URLs.

http://www.adscseed.info/.../8f37175.exe

http://www.adskoola.info/.../f6cb159.exe

http://www.adskoola.info/.../afb522.exe

http://www.golgool.info/.../ad0670e7.exe

http://www.adskoola.info/.../bf7082d56.exe

http://www.dolfine.info/.../42d3c515.exe

http://www.dolfine.info/.../ca3eeaf6f6.exe

http://www.golgool.info/.../cabb24.exe

http://www.dolfine.info/.../5c842e9.exe

http://www.golgool.info/.../ed5b7b02a.exe

http://www.adscseed.info/.../9440eb2c.exe

http://www.dolfine.info/.../829351dc20.exe

http://www.adskoola.info/.../f1576f4.exe

Remove 4e7aa9b006.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.