home

comparecimento(intimacacao.pdf).exe

Request

The executable comparecimento(intimacacao.pdf).exe has been detected as malware by 23 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from storage-eu-11.sharefile.com.
Product:
Request

Version:
1.0.0.0

MD5:
be7e46e3eea222c44128221a6bb03043

SHA-1:
a0668d79b622c4b7cac0ab0eb70fffe718cf6dc6

SHA-256:
3c62817cabfbe272eeb5ebd98d0bcf0255f85a31ab9bda6c69b6cad5c8baf017

Scanner detections:
23 / 68

Status:
Malware

Analysis date:
4/30/2024 5:51:19 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Spyware/Win32.Limitail
2015.11.14

Arcabit
Trojan.Generic.D2B899F
1.0.0.593

avast!
Win32:Malware-gen
2014.9-160601

Baidu Antivirus
Trojan.MSIL.Banload
4.0.3.1661

Bitdefender
Trojan.GenericKD.2853279
1.0.20.765

Emsisoft Anti-Malware
Trojan.GenericKD.2853279
8.16.06.01.12

ESET NOD32
MSIL/TrojanDownloader.Banload.FF (variant)
10.12563

Fortinet FortiGate
MSIL/Banload.FG!tr.dldr
6/1/2016

F-Secure
Trojan.GenericKD.2853279
11.2016-01-06_4

G Data
Trojan.GenericKD.2853279
16.6.25

IKARUS anti.virus
Trojan-Downloader.MSIL.Banload
t3scan.1.9.5.0

K7 AntiVirus
Trojan-Downloader
13.212.17853

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.122

Malwarebytes
Trojan.Banker.IM
v2016.06.01.12

McAfee
RDN/Generic Downloader.x
5600.6381

Microsoft Security Essentials
TrojanDownloader:MSIL/Banload.AJ
1.1.12205.0

MicroWorld eScan
Trojan.GenericKD.2853279
17.0.0.459

nProtect
Trojan.GenericKD.2853279
15.11.13.01

Panda Antivirus
Trj/CI.A
16.06.01.12

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1077

Sophos
Mal/Generic-S
4.98

Trend Micro
TROJ_GEN.R047C0DK915
10.465.01

VIPRE Antivirus
Trojan.Win32.Generic
45202

File size:
205 KB (209,920 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2015

Original file name:
Request.exe

File type:
Executable application (Win64 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\comparecimento(intimacacao.pdf).exe

File PE Metadata
Compilation timestamp:
11/6/2015 9:47:36 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
80.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:p2ey8bMiSlA7uRcnM0N2XTv0faY1jzJ+lM+sEvWfROJLhfJpreQ00ws/R3b/rz32:p2e1b0xWROJNhpeBUDnq

Entry address:
0x3488A

Entry point:
4D, 5A, 90, 00, 03, 00, 00, 00, 04, 00, 00, 00, FF, FF, 00, 00, B8, 00, 00, 00, 00, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 80, 00, 00, 00, 0E, 1F, BA, 0E, 00, B4, 09, CD, 21, B8, 01, 4C, CD, 21, 54, 68, 69, 73, 20, 70, 72, 6F, 67, 72, 61, 6D, 20, 63, 61, 6E, 6E, 6F, 74, 20, 62, 65, 20, 72, 75, 6E, 20, 69, 6E, 20, 44, 4F, 53, 20, 6D, 6F, 64, 65, 2E, 0D, 0D, 0A, 24, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Code size:
202.5 KB (207,360 bytes)

The file comparecimento(intimacacao.pdf).exe has been seen being distributed by the following URL.

https://storage-eu-11.sharefile.com/.../I=

Remove comparecimento(intimacacao.pdf).exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.