» dvdfabpasskey.exe
Overview
Analysis
File Details
Behaviors (1)

dvdfabpasskey.exe

DVDFab Passkey

Alipay.com Corporation

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘DVDFab Passkey’.

File name:

dvdfabpasskey.exe

Publisher:

Fengtao Software Inc. (signed by Alipay.com Corporation)

Product:

DVDFab Passkey

Description:

DVDFab Passkey is a Windows-based driver that works on-the-fly to unprotect encrypted movie DVDs and Blu-ray discs. - x86

Version:

8.0.5.8

MD5:

0e7a59ded289eff973128d33142d3f8a

SHA-1:

487745e3ea5df5e7072760f0a2ae094bcde2ebff

SHA-256:

3740145795167b78d33a0105ccacc1986582708ec37ca89ffaefa540f72d2459

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/26/2024 8:51:28 AM UTC (today)

File size:

1.3 MB (1,378,280 bytes)

Product version:

8.0.5.8

Original file name:

dvdfabpasskey.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\dvdfab passkey\dvdfabpasskey.exe

Digital Signature

Signed by:

Alipay.com Corporation

Authority:

Alipay.com Corporation

Valid from:

3/8/2012 3:15:48 PM

Valid to:

3/8/2014 3:15:48 PM

Subject:

T=m-alipay, O=Alipay.com Corporation, OU=CA Center, CN=f79ab2d42437fa5a046ddb5a171bcb7c

Issuer:

CN=Alipay.com Corporation Machine CA, OU=Machine CA Center, O=Alipay.com Corporation

Serial number:

0095BC2436D17D80640532296A300A17C3

File PE Metadata

Compilation timestamp:

4/1/2012 1:40:29 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:hwi1bkxF4xtO89wH2/p8Y4k0hW5BmVSVb4R9GRwnJE2j+o2STW1HGIa9iSR2MXQL:hwi1bIGwmOYSimVSVkRsNE+bSKwInSRI

Entry address:

0x1000

Entry point:

68, 01, 60, 89, 00, E8, 01, 00, 00, 00, C3, C3, 92, 97, EC, 34, 21, C9, F5, 78, D8, FB, 7B, 31, 6F, 73, AF, 95, 9A, 35, 68, 93, B8, EE, 28, B3, 5F, 38, 3F, AE, B9, B9, E3, 3B, 10, 79, AE, 6C, 99, 3D, 38, 6B, CE, FF, 44, BE, AE, C3, CF, B4, 56, C9, B2, D2, 7E, DD, BF, DC, E9, 23, 9E, D8, 5E, F5, DB, 92, AE, 90, 96, 6C, 03, 82, C3, 31, 6D, 91, 3F, AF, 06, 63, 77, 92, 80, 82, D5, DE, 4B, AF, EE, 3F, 1F, 91, 94, 5E, A0, EE, 44, 2F, 55, 51, F5, 1D, C0, 4D, C1, C7, FB, 8B, 8F, 5B, 16, 93, E3, 5D, EC, FD, CF, D3... 
[+]

Packer / compiler:

ASProtect v1.2x (New Strain)

Code size:

1.6 MB (1,637,376 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

DVDFab Passkey

Command:

"C:\Program Files\dvdfab passkey\dvdfabpasskey.exe"

Scan dvdfabpasskey.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.