home

contact_booking.doc.scr

Curse Client TEAM

Curse TEAM

The file contact_booking.doc.scr has been detected as malware by 23 anti-virus scanners. The file has been seen being downloaded from p-par13.pcloud.com.
Publisher:
Curse TEAM

Product:
Curse Client TEAM

Description:
Document

Version:
5.1.2.11

MD5:
e44071d0c03fa5594c582ba9d1f713bf

SHA-1:
25eb5a265665b8c22ec6d36286866c1d5a6917fb

SHA-256:
34e65454cee1ac6ae32c049d7ac5e9f3a013dfd7163c473d057d178e554d5e28

Scanner detections:
23 / 68

Status:
Malware

Analysis date:
5/15/2024 11:56:41 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.3130333
300

AegisLab AV Signature
Suspicious.Cloud.Gen!c
2.1.4+

Avira AntiVirus
TR/Dropper.MSIL.zwqc
8.3.3.4

Arcabit
Trojan.Generic.D2FC3DD
1.0.0.666

avast!
Win32:Malware-gen
2014.9-160410

AVG
MSIL9
2017.0.2778

Bitdefender
Trojan.GenericKD.3130333
1.0.20.505

Emsisoft Anti-Malware
Trojan.GenericKD.3130333
8.16.04.10.02

ESET NOD32
MSIL/Injector.ORK (variant)
10.13294

Fortinet FortiGate
MSIL/Kryptik.FQM!tr
4/10/2016

F-Prot
W32/MSIL_Injector.CM.gen
v6.4.7.1.166

F-Secure
Trojan.GenericKD.3130333
11.2016-10-04_1

G Data
Trojan.GenericKD.3130333
16.4.25

IKARUS anti.virus
Trojan.MSIL.Injector
t3scan.2.0.9.0

K7 AntiVirus
Trojan
13.221.19236

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.385

MicroWorld eScan
Trojan.GenericKD.3130333
17.0.0.303

nProtect
Trojan.GenericKD.3130333
16.04.06.01

Qihoo 360 Security
Win32/Trojan.Dropper.bfe
1.0.0.1120

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.16408

Sophos
Mal/Generic-S
4.98

Trend Micro
TROJ_GEN.R00XC0ED416
10.465.10

VIPRE Antivirus
Trojan.Win32.Generic
48438

File size:
216.5 KB (221,696 bytes)

Product version:
5.1.2.11

Copyright:
Copyright @ Curse 2009 TEAM

Original file name:
testi1.exe

Common path:
C:\users\{user}\downloads\contact_booking.doc.scr

File PE Metadata
Compilation timestamp:
3/30/2016 4:20:32 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:svVwTQuWvc5miYPLVHKxT+EMYjjvA8Oax/UPfUwk5yn2iMbppiWO2:8mv5mjPLVHcT+HYP7wc6nDMbp

Entry address:
0x26EDE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
148 KB (151,552 bytes)

The file contact_booking.doc.scr has been seen being distributed by the following URL.

https://p-par13.pcloud.com/.../Contact_booking.doc.scr

Remove contact_booking.doc.scr - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.