home

ARUWizard.EXE

ROM Update Utility

HTC

Publisher:
HTC

Product:
ROM Update Utility

Version:
1, 0, 3, 2011

MD5:
50d1db7077b89e975de393b2ac980e5c

SHA-1:
7819b1a28b024d67d7dfed40674606b2c943bad6

SHA-256:
c1660b24f6c61c6462b4017aa1ca7dc025d37010658511ec4995c667f4c0c274

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 7:40:23 PM UTC  (today)

File size:
1 MB (1,065,041 bytes)

Product version:
1, 0, 3, 2011

Copyright:
Copyright (C) 2008

Original file name:
ARUWizard.EXE

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\{50f2f878-636a-496f-a7cb-544c067e0c4b}\aruwizard.exe

File PE Metadata
Compilation timestamp:
5/6/2011 5:23:06 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:Lvj9sDkr9wrmzQoDUKT4tNwanpUdlQPMvO:Lvj9NrGazVDUi4tNwanptPMG

Entry address:
0x23226

Entry point:
55, 8B, EC, 6A, FF, 68, 48, 8B, 42, 00, 68, F8, 34, 42, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, 5F, 57, FF, 15, 5C, 64, 42, 00, 59, 83, 0D, 60, 70, 43, 00, FF, 83, 0D, 64, 70, 43, 00, FF, FF, 15, 58, 64, 42, 00, 8B, 0D, 54, 70, 43, 00, 89, 08, FF, 15, 54, 64, 42, 00, 8B, 0D, 50, 70, 43, 00, 89, 08, A1, 50, 64, 42, 00, 8B, 00, A3, 5C, 70, 43, 00, E8, 4E, 02, 00, 00, 39, 1D, 10, 6E, 43, 00, 75, 0C, 68, E2, 34, 42, 00, FF, 15...
 
[+]

Entropy:
4.9915

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
148 KB (151,552 bytes)

The file ARUWizard.EXE has been seen being distributed by the following 3 URLs.

https://doc-04-48-docsviewer.googleusercontent.com/viewer/securedownload/udkuotktjdhr9h7gnfda2tcq9dl7sbm7/p6flnb5cl1nj2n3uuprbgjurhblhhj8f/1373738400000/ZXhwbG9yZXI=/.../MEJ4NHpmMjVORUthVWMwSm1VR3QzVjFWWE0yYw==?a=dl&filename=x920d S-OFF????.rar&sec=AHSqidZ23Ob7HbvHwZfrAZ1W32Jaqo7f-Q_uE2F2relJpi8YkSQC4TbKlC0GwhReE_oTRoKKEyHY&rel=rar;r5;ARUWizard.exe

https://docs.google.com/viewer/noncesigner?nonce=id3qlgtt308fm&continue=https://doc-04-48-docsviewer.googleusercontent.com/viewer/securedownload/udkuotktjdhr9h7gnfda2tcq9dl7sbm7/p6flnb5cl1nj2n3uuprbgjurhblhhj8f/1373738400000/ZXhwbG9yZXI=/.../MEJ4NHpmMjVORUthVWMwSm1VR3QzVjFWWE0yYw==?sec=AHSqidZ23Ob7HbvHwZfrAZ1W32Jaqo7f-Q_uE2F2relJpi8YkSQC4TbKlC0GwhReE_oTRoKKEyHY&a=dl&filename=x920d S-OFF????.rar&rel=rar;r5;ARUWizard.exe&hash=en89podqal295l023etaokqmmu8a6vv5

https://doc-04-48-docsviewer.googleusercontent.com/viewer/securedownload/udkuotktjdhr9h7gnfda2tcq9dl7sbm7/p6flnb5cl1nj2n3uuprbgjurhblhhj8f/1373738400000/ZXhwbG9yZXI=/.../MEJ4NHpmMjVORUthVWMwSm1VR3QzVjFWWE0yYw==?sec=AHSqidZ23Ob7HbvHwZfrAZ1W32Jaqo7f-Q_uE2F2relJpi8YkSQC4TbKlC0GwhReE_oTRoKKEyHY&a=dl&filename=x920d S-OFF????.rar&rel=rar;r5;ARUWizard.exe&nonce=id3qlgtt308fm&user=AGZ5hq8m43samZEfH-KX7gcsU36y&hash=qfctgofirashrr8jjs8n44sesvdoi52r

Scan ARUWizard.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.