home

dotnetfx40_full_setup.exe

The executable dotnetfx40_full_setup.exe has been detected as malware by 5 anti-virus scanners. The file has been seen being downloaded from go.vitzo.com.
MD5:
c630eef854c3882e35910b8b97698f44

SHA-1:
2135a351ba78c228b7a439dcac6330e672072a6c

SHA-256:
34aab227f14e8108a5955254de6d080f438160575f26eeb748edca2bb26dcf42

Scanner detections:
5 / 68

Status:
Malware

Analysis date:
4/19/2024 6:08:23 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:AutoRun-CWJ [Trj]
160518-2

Emsisoft Anti-Malware
Trojan.Generic.KDV.391478
16.07.16

ESET NOD32
Win32/AutoRun.Delf.LV worm
8.0.319.0

F-Prot
W32/Autorun.ZF
4.6.5.141

Microsoft Security Essentials
Threat.Undefined
1.225.1590.0

File size:
824.5 KB (844,288 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\dotnetfx40_full_setup.exe

File PE Metadata
Compilation timestamp:
10/18/2007 9:39:45 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:9wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEH888888888888W8888888J:xNzCtUpQ9WWPBSSRMTEpXNz

Entry address:
0xE0D66

Entry point:
4D, 5A, 50, 00, 02, 00, 00, 00, 04, 00, 0F, 00, FF, FF, 00, 00, B8, 00, 00, 00, 00, 00, 00, 00, 40, 00, 1A, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, BA, 10, 00, 0E, 1F, B4, 09, CD, 21, B8, 01, 4C, CD, 21, 90, 90, 54, 68, 69, 73, 20, 70, 72, 6F, 67, 72, 61, 6D, 20, 6D, 75, 73, 74, 20, 62, 65, 20, 72, 75, 6E, 20, 75, 6E, 64, 65, 72, 20, 57, 69, 6E, 33, 32, 0D, 0A, 24, 37, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.5110

Code size:
682.5 KB (698,880 bytes)

The file dotnetfx40_full_setup.exe has been seen being distributed by the following URL.

http://go.vitzo.com/dotnet-4-installer

Remove dotnetfx40_full_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.