home

dll_files_fixer_3_1.exe

Artem Pavlov

The application dll_files_fixer_3_1.exe by Artem Pavlov has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from downloader.disk.yandex.ru.
Publisher:
Artem Pavlov  (signed and verified)

MD5:
9671ef3216d2e6a3c760ff7153145dcc

SHA-1:
5d5f0c15019e3f77eb6615453cbafcea000ad1d3

SHA-256:
5cc59757c88f9bb7ed01b17b19e353b297e0ac773cc6be58e2a0d949120a8d62

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/20/2024 12:24:29 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ArtemPavlov (M)
16.1.23.10

File size:
3.5 MB (3,643,864 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\dll_files_fixer_3_1.exe

Digital Signature
Signed by:
Artem Pavlov

Authority:
thawte, Inc.

Valid from:
4/26/2015 5:00:00 PM

Valid to:
4/26/2016 4:59:59 PM

Subject:
CN=Artem Pavlov, OU=Individual Developer, O=No Organization Affiliation, L=Kiev, S=Kiev, C=UA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1209A99F1D019CE4742AE045D24C83FF

File PE Metadata
Compilation timestamp:
1/19/2016 6:51:34 PM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
12288:aIz90YZZHNKSuy72vnDOo5ffoUAYS7RMKGwMgCIthEru0JM8QjEcBmdopANpcHMt:8skPvnDOoJzfcGt3f2WpK1P7qKWIri9

Entry address:
0x350250

Entry point:
4D, 5A, 90, 00, 03, 00, 00, 00, 04, 00, 00, 00, FF, FF, 00, 00, B8, 00, 00, 00, 00, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, D8, 00, 00, 00, 0E, 1F, BA, 0E, 00, B4, 09, CD, 21, B8, 01, 4C, CD, 21, 54, 68, 69, 73, 20, 70, 72, 6F, 67, 72, 61, 6D, 20, 63, 61, 6E, 6E, 6F, 74, 20, 62, 65, 20, 72, 75, 6E, 20, 69, 6E, 20, 44, 4F, 53, 20, 6D, 6F, 64, 65, 2E, 0D, 0D, 0A, 24, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.0180

Code size:
3.3 MB (3,489,792 bytes)

The file dll_files_fixer_3_1.exe has been seen being distributed by the following URL.

https://downloader.disk.yandex.ru/disk/13c49b467fb63caf5c956827b44da9bca7c5a053d5d01f9d76ecf8d549ccde1a/569f33dc/4FFLEPSOMHw4mZe4BCgdB8i5DXyAvefVUT1MFnJVzSQyLbXmV_-n40IUA1YSfe56qYiH_Yq43rzIeGHJIgF9Ig==?uid=0&filename=Dll_Files_Fixer_3_1.exe&disposition=attachment&hash=q0m9fnFfYhj/gBgSno8yFPsC1OepwLH3ib6wfs/.../x-msdownload&fsize=3643864&hid=4a525af7eacaa417e464556b43a48fab&media_type=executable&tknv=v2

Remove dll_files_fixer_3_1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.