home

c2e1.tmp.exe

Vba32 Quarantine

VIRUSBLOKADA ODO

The executable c2e1.tmp.exe, “Quarantine Maintenance GUI” has been detected as malware by 30 anti-virus scanners.
Publisher:
VirusBlockAda Ltd.  (signed by VIRUSBLOKADA ODO)

Product:
Vba32 Quarantine

Description:
Quarantine Maintenance GUI

Version:
3.12.0.0

MD5:
d4cd748a0e48675ad7e63931fce6fe46

SHA-1:
751b9cded095af395eadf2ea95e2ee5c30d5b405

SHA-256:
78dadaa49306337c5971efe29888ca892cec8d31008fe57db6e28795883fc557

Scanner detections:
30 / 68

Status:
Malware

Analysis date:
4/25/2024 2:53:19 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.305902
297

Agnitum Outpost
Trojan.Refeys
7.1.1

AhnLab V3 Security
Trojan/Win32.Loader
2015.03.05

Avira AntiVirus
TR/Rogue.1440349
7.11.213.138

avast!
Win32:Malware-gen
2014.9-160412

AVG
BackDoor.Generic17
2017.0.2775

Baidu Antivirus
Trojan.Win32.Refeys
4.0.3.16412

Bitdefender
Gen:Variant.Kazy.305902
1.0.20.515

Comodo Security
UnclassifiedMalware
21295

Emsisoft Anti-Malware
Gen:Variant.Kazy.305902
8.16.04.12.01

ESET NOD32
Win32/Refeys
10.11270

Fortinet FortiGate
W32/Shiz.NCF!tr
4/12/2016

F-Secure
Gen:Variant.Kazy.305902
11.2016-12-04_3

G Data
Gen:Variant.Kazy.305902
16.4.25

IKARUS anti.virus
Win32.SuspectCrc
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.200.15159

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.372

McAfee
Artemis!D4CD748A0E48
5600.6431

Microsoft Security Essentials
Trojan:Win32/Refeys.B
1.1.11400.0

MicroWorld eScan
Gen:Variant.Kazy.305902
17.0.0.309

NANO AntiVirus
Trojan.Win32.Cevantor.cqkges
0.30.0.296

Norman
Suspicious_Gen4.FMEOR
11.20160412

Panda Antivirus
Generic Malware
16.04.12.01

Qihoo 360 Security
Win32/Backdoor.a8f
1.0.0.1015

Quick Heal
TrojanBanker.Loader.r4
4.16.14.00

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.16410

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_SPNR.15AF14
7.2.103

Trend Micro
TROJ_SPNR.15AF14
10.465.12

VIPRE Antivirus
Trojan.Win32.Generic
38128

File size:
77.9 KB (79,800 bytes)

Product version:
3.12.0.0

Copyright:
Copyright (C) 1993 - 2012 by VirusBlokAda Ltd.

Original file name:
QtnMaintGUI.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\c2e1.tmp.exe

Digital Signature
Signed by:
VIRUSBLOKADA ODO

Authority:
VeriSign, Inc.

Valid from:
2/22/2012 3:00:00 AM

Valid to:
2/22/2014 2:59:59 AM

Subject:
CN=VIRUSBLOKADA ODO, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=VIRUSBLOKADA ODO, L=Minsk, S=BY, C=BY

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2DA05BBFA05778B979ACB88C01FF8E27

File PE Metadata
Compilation timestamp:
7/24/2012 11:15:16 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
1536:Pu6KCqx5x+So0M7DkPF1XuoCyQVlsE9O6S:Pu6KCqcSo0vd1Xuos6ZR

Entry address:
0x2FE4

Entry point:
55, 8B, EC, 83, EC, 70, FF, 05, 4E, FD, 40, 00, 6A, FF, 68, 08, 10, 08, 00, FF, 15, 68, B0, 40, 00, 89, 45, 98, 6A, 00, FF, 15, 20, B0, 40, 00, 01, 05, 13, FD, 40, 00, 85, C0, 0F, 84, A1, E0, FF, FF, 6A, 00, 6A, 4D, 50, 68, 86, FD, 40, 00, 6A, 00, 6A, 20, 6A, 00, 8D, 05, 59, FE, 40, 00, 50, 68, 62, FE, 40, 00, FF, 35, 91, FD, 40, 00, 6A, 73, E8, 7D, F1, FF, FF, 83, C4, 04, 84, C0, 75, 12, 81, C7, 37, 00, 00, 00, BE, 29, 00, 00, 00, 83, C8, 7F, 48, 89, 75, CC, 29, 05, 9B, FD, 40, 00, 50, 6A, 02, A1, F0, FC...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
40 KB (40,960 bytes)

Remove c2e1.tmp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.