home

edwedrfeddf-3.exe

SAPO

The executable edwedrfeddf-3.exe has been detected as malware by 16 anti-virus scanners.
Publisher:
SAPO  (signed and verified)

Version:
17.0.0.188

MD5:
79594c2c66700334102ea6fad76f877e

SHA-1:
4b000ab73c0266d61f06ef410f2504f64faa5808

SHA-256:
5309c92822eae575402d74de735f5958bb546f37cc7a0f9116e13f79d704e33c

Scanner detections:
16 / 68

Status:
Malware

Analysis date:
5/6/2024 1:20:24 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2479608
386

Arcabit
Trojan.Generic.D25D5F8
1.0.0.425

Baidu Antivirus
Trojan.Win32.Banload
4.0.3.16114

Bitdefender
Trojan.GenericKD.2479608
1.0.20.70

Emsisoft Anti-Malware
Trojan.GenericKD.2479608
8.16.01.14.12

F-Secure
Trojan.GenericKD.2479608
11.2016-14-01_5

G Data
Trojan.GenericKD.2479608
16.1.25

IKARUS anti.virus
Trojan-Downloader.MSIL.Banload
t3scan.1.9.5.0

Kaspersky
Trojan-Downloader.MSIL.Banload
14.0.0.817

Malwarebytes
Trojan.Agent
v2016.01.14.12

McAfee
Artemis!79594C2C6670
5600.6520

MicroWorld eScan
Trojan.GenericKD.2479608
17.0.0.42

nProtect
Trojan.GenericKD.2479608
15.06.12.01

Panda Antivirus
Generic Suspicious
16.01.14.12

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
Suspicious_GEN.F47V0612
7.2.14

File size:
441.6 KB (452,240 bytes)

Product version:
17.0.0.188

Original file name:
ZIPLoader.exe

File type:
Executable application (Win64 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\edwedrfeddf-3.exe

Digital Signature
Signed by:
SAPO

Authority:
SAPO

Valid from:
6/5/2015 2:08:35 PM

Valid to:
6/5/2016 2:08:35 PM

Subject:
E=cmd@sapo.pt, CN=SAPO.PT, OU=SAPO Division of Protocol, O=SAPO, L=Opalo, S=Jobila, C=AS

Issuer:
E=cmd@sapo.pt, CN=SAPO.PT, OU=SAPO Division of Protocol, O=SAPO, L=Opalo, S=Jobila, C=AS

Serial number:
00A7AB2CD21ECC7345

File PE Metadata
Compilation timestamp:
6/10/2015 10:58:46 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:ACXd7Tpv5BA7IjaNyhTcDO+sVpcc9kZb5ZYkNWcSCSLeyYcEeI/KQ73WmiaDPxJ0:TB/jFcDO7X9kZVmWJgLmbTzPyTh

Entry address:
0x44F06

Entry point:
4D, 5A, 90, 00, 03, 00, 00, 00, 04, 00, 00, 00, FF, FF, 00, 00, B8, 00, 00, 00, 00, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 80, 00, 00, 00, 0E, 1F, BA, 0E, 00, B4, 09, CD, 21, B8, 01, 4C, CD, 21, 54, 68, 69, 73, 20, 70, 72, 6F, 67, 72, 61, 6D, 20, 63, 61, 6E, 6E, 6F, 74, 20, 62, 65, 20, 72, 75, 6E, 20, 69, 6E, 20, 44, 4F, 53, 20, 6D, 6F, 64, 65, 2E, 0D, 0D, 0A, 24, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Code size:
268 KB (274,432 bytes)

Remove edwedrfeddf-3.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.