» ActOnFile.exe
Overview
Analysis
File Details
Behaviors (1)

ActOnFile.exe

Act On File

MBBSoftware Limited

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Act On File’.

File name:

ActOnFile.exe

Publisher:

MBBSoftware (signed by MBBSoftware Limited)

Product:

Act On File

Description:

Act On File: attributor, authenticator, comparator, compressor, cryptor, eraser, locator, protector, quantifier and TV software.

Version:

4.0.0.0

MD5:

1c23c19473d711eaeb5e678639441e0d

SHA-1:

5348a97aa28c1ac94e4939577d7c797da5195749

SHA-256:

74cc49d75552715252c2e111ecc9cc2dc57c057a08858d6c60df8b2dbc72eaaf

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

7/15/2025 12:25:25 AM UTC (today)

File size:

3.9 MB (4,097,808 bytes)

Product version:

2.0.32.0

Original file name:

ActOnFile.exe

File type:

Executable application (Win64 EXE)

Language:

English (United States)

Digital Signature

Signed by:

MBBSoftware Limited

Authority:

VeriSign, Inc.

Valid from:

10/31/2011 5:00:00 PM

Valid to:

10/31/2012 4:59:59 PM

Subject:

CN=MBBSoftware Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=MBBSoftware Limited, L=London, S=England, C=GB

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

5D45146E3C89DA5C72DBFB9DB005C98E

File PE Metadata

Compilation timestamp:

9/23/2012 4:56:21 AM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

98304:Ldmlc/RL6M0ULGWMFaxsoHv3JEOt4BmMd7+VU0Myyw2bPFETBBBBBB4+8Zco:Ldg8Jb08GWMF9Ayiudx0MfwwNwBBBBB6

Entry address:

0x28CBC

Entry point:

48, 83, EC, 28, E8, AF, 03, 00, 00, 48, 83, C4, 28, E9, 26, FD, FF, FF, CC, CC, 40, 53, 48, 83, EC, 20, 45, 8B, 18, 48, 8B, DA, 4C, 8B, C9, 41, 83, E3, F8, 41, F6, 00, 04, 4C, 8B, D1, 74, 13, 41, 8B, 40, 08, 4D, 63, 50, 04, F7, D8, 4C, 03, D1, 48, 63, C8, 4C, 23, D1, 49, 63, C3, 4A, 8B, 14, 10, 48, 8B, 43, 10, 8B, 48, 08, 48, 03, 4B, 08, F6, 41, 03, 0F, 74, 0C, 0F, B6, 41, 03, 83, E0, F0, 48, 98, 4C, 03, C8, 4C, 33, CA, 49, 8B, C9, 48, 83, C4, 20, 5B, E9, 4D, FA, FF, FF, CC, 48, 83, EC, 28, 4D, 8B, 41, 38... 
[+]

Entropy:

7.4661

Code size:

179.5 KB (183,808 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Act On File

Command:

"C:\pc softwares\new folder\actonfile.exe" startsystemtrayactonfile

Scan ActOnFile.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.