home

dobroe utro.exe

Total Commander

IT River

The application dobroe utro.exe, “Total Commander 32 bit international version, file manager replacement for Windows” by IT River has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
C. Ghisler & Co.  (signed by IT River)

Product:
Total Commander

Description:
Total Commander 32 bit international version, file manager replacement for Windows

Version:
6.01

MD5:
573281aed367e21f0101368cc28aa91f

SHA-1:
bf1fcc73328f8cb4d3c3810e177ac03b5545f8ca

SHA-256:
2b9d6772a1a52c1c8d13cbd89ef1e87e9393902aafda0b23a3751b940f3f4d3c

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/25/2024 11:44:27 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ITRiver (M)
16.2.13.9

File size:
297.3 KB (304,424 bytes)

Product version:
6.01

Copyright:
Copyright © 1993-2003 Christian Ghisler

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\dobroe utro.exe

Digital Signature
Signed by:
IT River

Authority:
COMODO CA Limited

Valid from:
2/25/2014 2:00:00 AM

Valid to:
2/26/2015 1:59:59 AM

Subject:
CN=IT River, O=IT River, STREET="Obolenskiy, 9", L=Moscow, S=Moscow oblast, PostalCode=119021, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0F02E0C593A3B9A15B22F5853C90D66B

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:McjlNvkzmojQ7k7fGR478Td9kpJaye1kOg8dECWu:9jlN8yojQ4ydKnVGkO5dEC7

Entry address:
0x1000

Entry point:
E9, 63, F6, 03, 00, 89, 3D, 21, 30, 44, 00, 3B, 5C, 24, DC, 7C, 14, C7, 05, EC, 30, 44, 00, 81, 6A, 01, 00, 89, 0D, DE, 30, 44, 00, 8B, 44, 24, 08, 87, 3D, CE, 30, 44, 00, 89, 1D, 39, 30, 44, 00, 29, 0D, 74, 30, 44, 00, 8B, 7C, 24, 18, 89, 1D, 2A, 30, 44, 00, C3, 8B, C0, C3, 8D, 40, 00, FF, 25, 24, 30, 44, 00, B8, 44, 10, 40, 00, C3, 89, 3D, 21, 30, 44, 00, 3B, 5C, 24, DC, 7C, 14, C7, 05, EC, 30, 44, 00, 81, 6A, 01, 00, 89, 0D, DE, 30, 44, 00, 8B, 44, 24, 08, 87, 3D, CE, 30, 44, 00, 89, 1D, 39, 30, 44, 00...
 
[+]

Packer / compiler:
Xtreme-Protector v1.05

Code size:
254.5 KB (260,608 bytes)

Remove dobroe utro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.