» DVR.exe
Overview
Analysis
File Details
Network (1)

DVR.exe

Argus Surveillance DVR

PY Software

File name:

DVR.exe

Publisher:

Argus Surveillance Inc. (signed by PY Software)

Product:

Argus Surveillance DVR

Version:

4, 0, 0, 0

MD5:

fdcdfd22a2abf48b070573110ed12e65

SHA-1:

9a24be9c5bb43b8ea148c075fb325d943df8ca25

SHA-256:

32f4300a4e3e61103ac850b82e3bbf00ddb7861c259cdc6c99ae151ca3c99e14

Scanner detections:

5 / 68

Status:

Inconclusive (not enough data for an accurate detection)

Analysis date:

4/23/2024 9:28:54 PM UTC (today)

Scan engine

Detection

Engine version

Dr.Web

DLOADER.Trojan

9.0.1.0197

F-Prot

W32/Heuristic-210

v6.4.5.1.85

IKARUS anti.virus

not-a-virus:Monitor.Win32.KGBSpy

t3scan.1.1.80.0

Quick Heal

(Suspicious) - DNAScan

7.14.10.00

Rising Antivirus

Backdoor.Win32.DelgenU.a

23.00.65.14714

File size:

643.3 KB (658,760 bytes)

Product version:

4, 0, 0, 0

Trademarks:

Argus Surveillance Inc.

Original file name:

DVR.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\argus surveillance dvr\dvr.exe

Digital Signature

Signed by:

PY Software

Authority:

VeriSign, Inc.

Valid from:

5/27/2008 8:00:00 AM

Valid to:

6/12/2009 7:59:59 AM

Subject:

CN=PY Software, OU=Software Development, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=PY Software, L=Toronto, S=ONTARIO, C=CA

Issuer:

CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

16501EDA11E10DAD178B52BE55F86F5E

File PE Metadata

Compilation timestamp:

6/20/1992 6:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:0BWJ1uGHupswsNkUQfgdqRMaD3jG+Be1dTdxGmnO8XLHL:oGuGHu6krgdqZD3jG2QdTH7RH

Entry address:

0x1000

Entry point:

68, 01, C0, 5F, 00, E8, 01, 00, 00, 00, C3, C3, 38, 9E, 1D, 9D, CC, 24, 2C, DF, 65, F4, 5C, 90, 79, 2D, CD, 13, 9D, 20, F5, A7, D6, C0, 55, A6, CA, 6A, 13, 48, FD, DD, 13, 05, BA, 4E, A7, C5, 31, F7, 39, D1, 0A, 1E, CB, E4, 67, EF, 27, A2, 02, 84, A0, F6, 85, 8C, A4, 59, 01, 5B, E0, 61, A7, E4, A0, EF, 43, 53, FE, DE, 60, CD, 37, EE, EA, BD, 96, D9, F5, E1, 16, 6F, 26, 20, 35, 5B, EB, 18, A4, D4, D8, 2F, 3A, 67, 05, B6, 02, F8, C9, 6B, 33, 76, 00, 07, F5, 3C, 21, AF, 4C, C8, D5, A7, 37, 05, 18, B0, E3, D3... 
[+]

Entropy:

7.7815

Packer / compiler:

ASProtect v1.2x (New Strain)

Code size:

780 KB (798,720 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to p3nw8shg252.shr.prod.phx3.secureserver.net (184.168.193.43:80)

Scan DVR.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.