» dvdfabpasskey.exe
Overview
Analysis
File Details
Behaviors (1)

dvdfabpasskey.exe

DVDFab Passkey

Alipay.com Corporation

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘DVDFab Passkey’.

File name:

dvdfabpasskey.exe

Publisher:

Fengtao Software Inc. (signed by Alipay.com Corporation)

Product:

DVDFab Passkey

Description:

DVDFab Passkey is a Windows-based driver that works on-the-fly to unprotect encrypted movie DVDs and Blu-ray discs. - x86

Version:

8.0.5.6

MD5:

589ef8e6419d0f9a2ecb9d94a487fbba

SHA-1:

7b468c1589f92dce2c4f94e548436f0c3f9a8fc3

SHA-256:

4ed0db3cf4fbcc3440f6d821c94bed6d81489c1786394ac8387f412325fa6535

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

4/25/2024 7:38:40 AM UTC (today)

Scan engine

Detection

Engine version

Clam AntiVirus

PUA.Packed.ASPack

0.98/18155

File size:

1.3 MB (1,376,232 bytes)

Product version:

8.0.5.6

Original file name:

dvdfabpasskey.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\dvdfab passkey\dvdfabpasskey.exe

Digital Signature

Signed by:

Alipay.com Corporation

Authority:

Alipay.com Corporation

Valid from:

3/8/2012 4:15:48 AM

Valid to:

3/8/2014 4:15:48 AM

Subject:

T=m-alipay, O=Alipay.com Corporation, OU=CA Center, CN=f79ab2d42437fa5a046ddb5a171bcb7c

Issuer:

CN=Alipay.com Corporation Machine CA, OU=Machine CA Center, O=Alipay.com Corporation

Serial number:

0095BC2436D17D80640532296A300A17C3

File PE Metadata

Compilation timestamp:

3/17/2012 12:07:00 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:x78Xql0iNzh3VkdWuiVkszxtco2STW1HGdyQtiUTut9qJNT:xAcn1jkdWztVCbSKwd/UUfJNT

Entry address:

0x1000

Entry point:

68, 01, 60, 89, 00, E8, 01, 00, 00, 00, C3, C3, C8, 6A, 1B, 04, F9, ED, DB, 46, E9, BE, B6, CE, 83, 8A, FB, 78, DA, 1F, 95, 54, 74, F8, BE, DA, 35, 59, 4C, 69, BA, 93, 45, 21, 6D, AD, 7B, 76, 6E, 14, 7A, 20, 07, 20, D8, 28, 8D, 5D, 81, 26, 79, F6, F5, 4A, D4, FD, 37, 1B, E8, 5F, A3, 75, 8C, 8C, 30, F2, BE, CA, 47, 5C, 86, 7A, 23, B5, 3E, E2, 93, B5, 5F, 18, F2, 34, 06, C1, 81, EF, 55, 90, 88, F0, A4, CC, BC, C7, DD, 5E, DD, 18, 4A, E5, FC, D7, 2C, 9E, 18, 5B, AE, 6F, FA, 7E, F0, 55, 0A, 13, E8, 66, F3, 9F... 
[+]

Entropy:

7.9079

Packer / compiler:

ASProtect v1.2x (New Strain)

Code size:

1.6 MB (1,634,816 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

DVDFab Passkey

Command:

"C:\Program Files\dvdfab passkey\dvdfabpasskey.exe"

Scan dvdfabpasskey.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.