home

9c055050-sample

Microsoft MSN Communications System

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The file 9c055050-sample, “MSN Uninstall Progman” has been detected as malware by 37 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft(R) MSN (R) Communications System

Description:
MSN Uninstall Progman

Version:
6.10.0016.1624

MD5:
2df99e7670098c0e1d736d82bc76cc38

SHA-1:
b5270a5d20de7f2bcc35a72d7cbb98faf935bd65

SHA-256:
ad61ca84b6df5ca1fba39c2cc0cef1902191a1f70758f74a51f190a689e9375d

Scanner detections:
37 / 68

Status:
Malware

Analysis date:
5/1/2024 12:03:08 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Jadtre.F
766

Agnitum Outpost
Win32.Nimnul.Gen
7.1.1

AhnLab V3 Security
Win32/Wapomi
2014.12.05

Avira AntiVirus
TR/Patched.Ren.Gen2
7.11.192.162

avast!
Win32:AutoRun-BSV [Wrm]
2014.9-141231

AVG
Win32/Wapomi.C
2015.0.3244

Baidu Antivirus
Virus.Win32.Otwycal.$b
4.0.3.141231

Bitdefender
Win32.Jadtre.F
1.0.20.1825

Bkav FE
HW32.Packed
1.3.0.6267

Clam AntiVirus
WIN.Virus.Wapomi
0.98/21511

Comodo Security
Virus.Win32.Qvod.~Gen
20282

Dr.Web
Win32.Simona.1
9.0.1.0365

ESET NOD32
Win32/Wapomi.AE
8.10827

Fortinet FortiGate
W32/Wapomi.U
12/31/2014

F-Prot
W32/Patched.J.gen
v6.4.7.1.166

F-Secure
Win32.Jadtre.F
11.2014-31-12_4

G Data
Win32.Jadtre
14.12.24

IKARUS anti.virus
Trojan-Dropper.Win32.Bototer
t3scan.1.8.5.0

K7 AntiVirus
Virus
13.186.14239

Kaspersky
Virus.Win32.Otwycal
14.0.0.2713

McAfee
W32/Fujacks.be
5600.6900

Microsoft Security Essentials
Virus:Win32/Jadtre.L
1.11202

MicroWorld eScan
Win32.Jadtre.F
15.0.0.1095

NANO AntiVirus
Virus.Win32.Otwycal.durta
0.28.6.63850

Norman
Killav.AWIG
11.20141231

nProtect
Virus/W32.Patched.P
14.12.03.01

Qihoo 360 Security
Virus.Win32.Downloader.N
1.0.0.1015

Quick Heal
W32.Jadtre.I
12.14.14.00

Rising Antivirus
PE:Win32.Dodou.a!1590972
23.00.65.141229

Sophos
W32/Jadtre-C
4.98

Total Defense
Win32/Jadtre.BE
37.0.11314

Trend Micro House Call
PE_FUJACKS.EG
7.2.365

Trend Micro
PE_FUJACKS.EG
10.465.31

Vba32 AntiVirus
Virus.Otwycal.b
3.12.26.3

VIPRE Antivirus
Virus.Win32.Jadtre.b
35420

ViRobot
Win32.Qvod.C
2011.4.7.4223

Zillya! Antivirus
Virus.Otwycal.Win32.1
2.0.0.1998

File size:
276 KB (282,624 bytes)

Product version:
6.10.0016.1624

Copyright:
Copyright (C) Microsoft Corp. 1981-2000

Original file name:
MSNUNIN.EXE

Language:
English (United States)

File PE Metadata
Compilation timestamp:
7/19/2001 11:59:57 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.20

CTPH (ssdeep):
6144:tvlRJrfB3+pJu7BOqLVJ5bbZXegqw48gyH0YtnbvK/kFZj:tNRJrp3pkWJtbZU8JFtrymB

Entry address:
0x8000

Entry point:
55, 8B, EC, 81, EC, 84, 00, 00, 00, 64, FF, 35, 30, 00, 00, 00, 58, 89, 45, DC, C7, 45, EC, 00, C4, 03, 00, C7, 45, CC, 43, 3A, 5C, 35, C7, 45, D0, 33, 39, 62, 37, C7, 45, D4, 33, 64, 31, 2E, C7, 45, D8, 65, 78, 65, 00, 8B, 45, DC, 8B, 40, 0C, 8B, 40, 1C, 8B, 00, 89, 45, E8, 8B, 45, E8, 8B, 40, 08, 89, 45, F4, 8B, 45, F4, 8B, 40, 3C, 8B, 4D, F4, 8B, 55, F4, 03, 54, 01, 78, 89, 55, E0, 8B, 45, E0, 8B, 4D, F4, 03, 48, 20, 89, 4D, B8, 8B, 45, E0, 8B, 4D, F4, 03, 48, 24, 89, 4D, C4, 8B, 45, E0, 8B, 4D, F4, 03...
 
[+]

Entropy:
7.6250

Developed / compiled with:
Microsoft Visual C++

Code size:
260 KB (266,240 bytes)

Remove 9c055050-sample - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.