home

drive.exe

The application drive.exe has been detected as a potentially unwanted program by 21 anti-malware scanners.
Version:
1.0.0.0

MD5:
0c86b655a7aeb49c73b98398f81b5cc1

SHA-1:
f031ff14eafb0e700b1628a8f7669493f7ce4b4e

Scanner detections:
21 / 68

Status:
Potentially unwanted

Analysis date:
4/16/2024 8:09:58 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Zusy.141531
391

Agnitum Outpost
Trojan.Agent
7.1.1

avast!
Win32:Adware-gen [Adw]
2014.9-160109

Baidu Antivirus
Adware.Win32.BrowSecX
4.0.3.1619

Bitdefender
Gen:Variant.Zusy.141531
1.0.20.45

Bkav FE
W32.AgentDelfB.Trojan
1.3.0.6379

Dr.Web
Trojan.DownLoader13.14603
9.0.1.09

Emsisoft Anti-Malware
Gen:Variant.Zusy.141531
8.16.01.09.03

ESET NOD32
Win32/Adware.BrowSecX (variant)
10.11639

Fortinet FortiGate
Riskware/BrowSecX
1/9/2016

F-Secure
Gen:Variant.Zusy.141531
11.2016-09-01_7

G Data
Gen:Variant.Zusy.141531
16.1.25

K7 AntiVirus
Adware
13.204.15935

Kaspersky
Trojan.Win32.Agent
14.0.0.842

McAfee
Artemis!0C86B655A7AE
5600.6525

MicroWorld eScan
Gen:Variant.Zusy.141531
17.0.0.27

Qihoo 360 Security
HEUR/QVM11.1.Malware.Gen
1.0.0.1015

Sophos
Generic PUA PA
4.98

Trend Micro House Call
TROJ_GEN.R021B01EG15
7.2.9

VIPRE Antivirus
Trojan.Win32.Generic
40308

ViRobot
Trojan.Win32.A.Agent.1641472.B[h]
2014.3.20.0

File size:
1.6 MB (1,641,472 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Documents and Settings\{user}\AppData\google\update\drive.exe

File PE Metadata
Compilation timestamp:
5/8/2015 7:42:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:tVZaibP5hatmIUsYH0UbDw2G9Le/vuVMW7NBTB+1BRX:t7jP5hYHtU/GUvuaWJBB+1XX

Entry address:
0x451C70

Entry point:
60, BE, 00, 30, 6C, 00, 8D, BE, 00, E0, D3, FF, C7, 87, 10, FC, 31, 00, 70, 16, 4C, DF, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:
1.6 MB (1,634,304 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-72-9-51.eu-west-1.compute.amazonaws.com  (54.72.9.51:80)

TCP (HTTP):
Connects to 186.216.160.251.user.vctelecom.com.br  (186.216.160.251:80)

TCP (HTTP):
Connects to 186.216.160.250.user.vctelecom.com.br  (186.216.160.250:80)

TCP (HTTP):
Connects to server-52-85-165-241.gru1.r.cloudfront.net  (52.85.165.241:80)

TCP (HTTP):
Connects to server-52-84-174-103.gru50.r.cloudfront.net  (52.84.174.103:80)

TCP (HTTP SSL):
Connects to ec2-52-3-176-101.compute-1.amazonaws.com  (52.3.176.101:443)

TCP (HTTP SSL):
Connects to ec2-52-201-97-156.compute-1.amazonaws.com  (52.201.97.156:443)

TCP (HTTP SSL):
Connects to ec2-52-7-255-219.compute-1.amazonaws.com  (52.7.255.219:443)

TCP (HTTP):
Connects to server-54-230-59-91.gru1.r.cloudfront.net  (54.230.59.91:80)

TCP (HTTP):
Connects to server-54-230-59-156.gru1.r.cloudfront.net  (54.230.59.156:80)

TCP (HTTP SSL):
Connects to ec2-52-7-154-8.compute-1.amazonaws.com  (52.7.154.8:443)

TCP (HTTP SSL):
Connects to ec2-52-55-195-249.compute-1.amazonaws.com  (52.55.195.249:443)

TCP (HTTP):
Connects to a23-61-187-27.deploy.static.akamaitechnologies.com  (23.61.187.27:80)

Remove drive.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.