home

bnd_ar_20131018175329.exe

Beijing ELEX Technology Co.,Ltd

The application bnd_ar_20131018175329.exe by Beijing ELEX Technology Co.,Ltd has been detected as a potentially unwanted program by 36 anti-malware scanners. It is also typically executed from the user's temporary directory.
Publisher:
Beijing ELEX Technology Co.,Ltd  (signed and verified)

Version:
2.0.2.2666

MD5:
998a00dc3d42aef4125512620b0e9c79

SHA-1:
b6ef7c220d5b1fdb8c5b52a25180acde78d0406d

SHA-256:
0627988e8c1473cae4b7f4bd1fc68d69d97f530132d815fac7acf21a80878684

Scanner detections:
36 / 68

Status:
Potentially unwanted

Analysis date:
4/19/2024 7:03:05 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.ExqPage.3
1138

Agnitum Outpost
Trojan.Agent
7.1.1

AhnLab V3 Security
Win-Trojan/Clicker.702616
2013.12.30

Avira AntiVirus
TR/Wysotot.Gen
7.11.122.176

avast!
Win32:Malware-gen
2014.9-131224

AVG
Skodna.Generic_r
2014.0.3616

Bitdefender
Gen:Variant.Application.ExqPage.3
1.0.20.1790

Bkav FE
W32.MyvideLTAQ.Trojan
1.3.0.4613

Comodo Security
TrojWare.Win32.StartPage.~CJAB
17425

Dr.Web
Adware.Mutabaha.38
9.0.1.0358

Emsisoft Anti-Malware
Gen:Variant.Application.ExqPage
8.14.01.02.12

ESET NOD32
Win32/ELEX (variant)
7.9190

Fortinet FortiGate
W32/Generic.BT!tr
12/24/2013

F-Prot
W32/Backdoor2.HTFP
v6.4.7.1.166

F-Secure
Gen:Variant.Application.ExqPage
11.2014-02-01_5

G Data
Gen:Variant.Application.ExqPage
13.12.22

IKARUS anti.virus
Trojan.Win32.StartPage
t3scan.2.2.29

K7 AntiVirus
Unwanted-Program
13.174.10656

Kaspersky
Trojan.Win32.StartPage
14.0.0.4574

Malwarebytes
PUP.Optional.Elex.A
v2013.12.24.05

McAfee
PUP-FFP!998A00DC3D42
5600.7272

Microsoft Security Essentials
TrojanDownloader:Win32/Wysotot.A
1.165.247.01

MicroWorld eScan
Gen:Variant.Application.ExqPage.3
14.0.0.1074

NANO AntiVirus
Trojan.Win32.Mutabaha.cqkbby
0.28.0.57029

Norman
Suspicious_Gen4.FFFFA
11.20140102

nProtect
Trojan/W32.Agent.770704
13.12.29.01

Panda Antivirus
Trj/Elex.A
13.12.24.05

Quick Heal
TrojanDownloader.Wysotot.A5
12.13.12.00

Reason Heuristics
PUP.BeijingELEXTechnologyCoLtd.V
14.7.10.2

Sophos
Elex
4.96

SUPERAntiSpyware
Trojan.Agent/Gen-ELEX
10870

Total Defense
Win32/Wysotot.OIAEWXD
37.0.10498

Trend Micro House Call
TROJ_SPNR.0BJQ13
7.2.2

Trend Micro
TROJ_SPNR.0BJQ13
10.465.02

VIPRE Antivirus
Trojan.Win32.Generic
24894

ViRobot
Adware.Agent.770704
2011.4.7.4223

File size:
752.6 KB (770,704 bytes)

Product version:
2.0.2.2666

Copyright:
Copyright (C) 2013

Original file name:
iXB.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\bnd_ar_20131018175329.exe

Digital Signature
Signed by:
Beijing ELEX Technology Co.,Ltd

Authority:
GlobalSign nv-sa

Valid from:
7/26/2013 7:54:20 AM

Valid to:
7/27/2014 7:54:20 AM

Subject:
CN="Beijing ELEX Technology Co.,Ltd", O="Beijing ELEX Technology Co.,Ltd", L=Beijing, S=Beijing, C=CN

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112131F67BDEA1D6D12E11D656C8BE509ECE

File PE Metadata
Compilation timestamp:
10/18/2013 8:47:40 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:+mEBTASggJMutz4hDhFEouFeED0NO3yEU8m/udmipauZZZZ37nvEo8uICH8WQpb1:KBTNJMuJ0NovlbSWcbPQg/ooon/VM5j1

Entry address:
0x54FD7

Entry point:
E8, 20, F4, 00, 00, E9, 39, FE, FF, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 85, FF, 74, 13, 8B, 4D, 0C, 85, C9, 74, 0C, 8B, 55, 10, 85, D2, 75, 1A, 33, C0, 66, 89, 07, E8, 2C, 8C, 00, 00, 6A, 16, 5E, 89, 30, E8, 80, 5A, 00, 00, 8B, C6, 5F, 5E, 5D, C3, 8B, F7, 66, 83, 3E, 00, 74, 06, 83, C6, 02, 49, 75, F4, 85, C9, 74, D4, 2B, F2, 0F, B7, 02, 66, 89, 04, 16, 8D, 52, 02, 66, 85, C0, 74, 03, 49, 75, EE, 33, C0, 85, C9, 75, D0, 66, 89, 07, E8, E8, 8B, 00, 00, 6A, 22, EB, BA, 55, 8B, EC, 51, 33, C0, 89, 45, FC, 39...
 
[+]

Entropy:
6.6796

Code size:
515 KB (527,360 bytes)

Remove bnd_ar_20131018175329.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.