home

daohang4841.exe

WangYue HuDong Cultrue Media (Beijing) Co.,Ltd.

The executable daohang4841.exe has been detected as malware by 3 anti-virus scanners.
Publisher:
WangYue HuDong Cultrue Media (Beijing) Co.,Ltd.  (signed and verified)

MD5:
d2ac278c6df126b485cc3bf17670e0d1

SHA-1:
92411d05106e668aec88cbc55bfb2824dfaa7138

SHA-256:
3a25daedc4b05d41fa0192d96829278eda5e7eeae44884bdfee27a05498b3704

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
5/5/2024 1:29:01 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/ATRAPS.Gen2
7.11.149.128

Dr.Web
Trojan.PWS.LDPinch.12251
9.0.1.0275

McAfee
Artemis!D2AC278C6DF1
5600.6259

File size:
136.9 KB (140,192 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\daohang4841\daohang4841.exe

Digital Signature
Signed by:
WangYue HuDong Cultrue Media (Beijing) Co.,Ltd.

Authority:
WoSign eCommerce Services Limited

Valid from:
4/23/2012 11:37:28 AM

Valid to:
4/25/2013 7:40:03 AM

Subject:
E=wyhdcn@gmail.com, CN="WangYue HuDong Cultrue Media (Beijing) Co.,Ltd.", O="WangYue HuDong Cultrue Media (Beijing) Co.,Ltd.", L=Beijng, S=Beijing, C=CN

Issuer:
CN=WoSign Class 3 Code Signing CA, O=WoSign eCommerce Services Limited, C=CN

Serial number:
010EBCD1C4F3B9

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
3072:FPA7xPA7fhJ3ou9D2T3UOPw4Rxi1Eopy7:Q2jNa9jxi1S

Entry address:
0x124A0

Entry point:
55, 8B, EC, B9, 28, 00, 00, 00, 6A, 00, 6A, 00, 49, 75, F9, 51, 53, 56, B8, 00, 24, 41, 00, E8, 28, 2E, FF, FF, 33, C0, 55, 68, 39, 27, 41, 00, 64, FF, 30, 64, 89, 20, 6A, 00, E8, 9F, EC, FF, FF, B8, 04, 01, 00, 00, E8, 39, 3D, FF, FF, A3, 74, 48, 41, 00, B8, 04, 01, 00, 00, E8, 2A, 3D, FF, FF, A3, 78, 48, 41, 00, 33, C0, 55, 68, F2, 26, 41, 00, 64, FF, 30, 64, 89, 20, 68, 7C, 48, 41, 00, 6A, 1A, 6A, 00, E8, E9, FC, FF, FF, A1, 78, 48, 41, 00, 50, A1, 7C, 48, 41, 00, 50, E8, D0, FC, FF, FF, 8D, 55, EC, A1...
 
[+]

Entropy:
6.6524

Developed / compiled with:
Microsoft Visual C++

Code size:
70 KB (71,680 bytes)

Remove daohang4841.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.