home

{blocked}.exe

ZoomText 10.1

Algorithmic Implementations, Inc.

This is a setup program which is used to install the application. The file has been seen being downloaded from 192.168.1.1.
Publisher:
Ai Squared   (signed by Algorithmic Implementations, Inc.)

Product:
ZoomText 10.1

Description:
ZoomText 10.1 Help

Version:
10.10.8.90

MD5:
19ed69f17a48aa20daa67fe59350847a

SHA-1:
3f3304a185c106c4fed446aa7dd2c599e008d1d9

SHA-256:
08b25639154e0ad25d9a6d6c41ba3ca3f9a65e7d190f5342e2a94e914a4e7734

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 5:15:04 PM UTC  (today)

File size:
17.5 MB (18,319,088 bytes)

Product version:
10.10.8.90

Copyright:
Copyright © Ai Squared 1988-2014, All Rights Reserved

Trademarks:
ZoomText is a registered trademark of Ai Squared.

Original file name:
ZoomText Update

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\10.10.7.149_to_10.10.8.90_cum.exe

Digital Signature
Signed by:
Algorithmic Implementations, Inc.

Authority:
DigiCert Inc

Valid from:
2/6/2014 7:00:00 PM

Valid to:
2/9/2015 7:00:00 AM

Subject:
CN="Algorithmic Implementations, Inc.", O="Algorithmic Implementations, Inc.", L=Manchester Center, S=Vermont, C=US, PostalCode=05255, STREET=130 Taconic Business Park, SERIALNUMBER=0109458, OID.1.3.6.1.4.1.311.60.2.1.2=Vermont, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization

Issuer:
CN=DigiCert EV Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
03FEE0148DF4B2FCDE0860B5109C7F9B

File PE Metadata
Compilation timestamp:
11/6/2014 2:58:16 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
393216:3Tw9NNg25n6dde3vXYcKEtHDNk6NMCuX2QS0HbcZL:3TB256ddqv5vlC5mQFbcZL

Entry address:
0xEF05

Entry point:
E8, A0, 04, 00, 00, E9, DD, FC, FF, FF, 3B, 0D, 70, EB, 41, 00, 75, 02, F3, C3, E9, 20, 05, 00, 00, 6A, 14, 68, E0, B3, 41, 00, E8, 8E, 03, 00, 00, FF, 35, C4, 0C, 42, 00, 8B, 35, C0, 11, 41, 00, FF, D6, 59, 89, 45, E4, 83, F8, FF, 75, 0C, FF, 75, 08, FF, 15, C4, 11, 41, 00, 59, EB, 67, 6A, 08, E8, FA, 05, 00, 00, 59, 83, 65, FC, 00, FF, 35, C4, 0C, 42, 00, FF, D6, 89, 45, E4, FF, 35, C0, 0C, 42, 00, FF, D6, 59, 59, 89, 45, E0, 8D, 45, E0, 50, 8D, 45, E4, 50, FF, 75, 08, 8B, 35, D8, 11, 41, 00, FF, D6, 59...
 
[+]

Entropy:
7.9872  (probably packed)

Code size:
64 KB (65,536 bytes)

The file {blocked}.exe has been seen being distributed by the following URL.

http://192.168.1.1:8181/http://.../10.10.7.149_to_10.10.8.90_cum.exe

Scan {blocked}.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.