home

adv_288.exe

Beijing Caiyunshidai Technology Co., Ltd.

The application adv_288.exe by Beijing Caiyunshidai Technology Co. has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
Beijing Caiyunshidai Technology Co., Ltd.  (signed and verified)

MD5:
3aa645231d613bd09aa3fa1622046937

SHA-1:
49a0b10a68a3c232fd592ab72e0f94546af48337

SHA-256:
2939311d20a1e9377f827b637b5469e44f724553bd41c3d1218fe7ddb5149636

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/14/2024 7:48:57 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.ELEX.SpeedSearch (M)
17.2.14.15

File size:
411.6 KB (421,440 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\adv_288.exe

Digital Signature
Signed by:
Beijing Caiyunshidai Technology Co., Ltd.

Authority:
thawte, Inc.

Valid from:
1/17/2017 2:00:00 PM

Valid to:
3/4/2017 1:59:59 PM

Subject:
CN="Beijing Caiyunshidai Technology Co., Ltd.", O="Beijing Caiyunshidai Technology Co., Ltd.", L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
5CA1EF4409BED5441078E4EC71840A58

File PE Metadata
Compilation timestamp:
1/18/2017 3:49:41 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

Entry address:
0xB0DB

Entry point:
E8, D5, EF, FF, FF, E9, B2, 14, 00, 00, 6A, 17, E8, 0A, 45, 00, 00, 85, C0, 74, 05, 6A, 05, 59, CD, 29, 56, 6A, 01, BE, 17, 04, 00, C0, 56, 6A, 02, E8, 84, C6, FF, FF, 56, E8, 7C, A0, FF, FF, 83, C4, 10, 5E, C3, 55, 8B, EC, 81, EC, 4C, 02, 00, 00, A1, 18, 50, 46, 00, 33, C5, 89, 45, FC, 53, 8B, 59, 04, BA, 28, 35, 46, 00, 56, 8B, 31, 57, 83, 7E, 7C, 00, 0F, 84, B9, 00, 00, 00, 8B, 76, 78, 03, F3, 8B, 4E, 18, 85, C9, 0F, 84, A9, 00, 00, 00, 83, 7E, 14, 00, 0F, 84, 9F, 00, 00, 00, 8B, C2, C1, E8, 10, 66, 85...
 
[+]

Entropy:
7.8072  (probably packed)

Remove adv_288.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.