» Eraser.EXE
Overview
Analysis
File Details
Behaviors (1)

Eraser.EXE

Eraser

Heidi Computers Ltd

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Eraser’.

File name:

Eraser.EXE

Publisher:

The Eraser Project (signed by Heidi Computers Ltd)

Product:

Eraser

Description:

Eraser.

Version:

5.86.1

MD5:

46b54734d62fe2e094e2852c36cb9a61

SHA-1:

ac42f5e9641f6bc7c77505170e64ff50e6cce920

SHA-256:

61702c9e6d0793d48c8d6434afc2d042603ad4336c0f8560bdce15fb942760a7

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/26/2024 5:53:01 AM UTC (today)

File size:

894.8 KB (916,240 bytes)

Product version:

5.86.1

Original file name:

Eraser.EXE

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\eraser\eraser.exe

Digital Signature

Signed by:

Heidi Computers Ltd

Authority:

VeriSign, Inc.

Valid from:

7/12/2007 8:00:00 PM

Valid to:

7/12/2009 7:59:59 PM

Subject:

CN=Heidi Computers Ltd, OU=Distribution, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Heidi Computers Ltd, L=Greystones, S=Co Wicklow, C=IE

Issuer:

CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

389B5BEE7B82C6246175313086E6B39A

File PE Metadata

Compilation timestamp:

12/22/2007 5:53:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

3072:0vPHFyYw5WgjPcyGAFhV4lKHiOjM4eH1+CcHvmYXal+2mln5IKI36J:2PHZw5WgjPspm4TH1+CcHvVKlnu5I36

Entry address:

0x1000

Entry point:

B8, 88, 1A, 46, 00, 50, 64, FF, 35, 00, 00, 00, 00, 64, 89, 25, 00, 00, 00, 00, 33, C0, 89, 08, 50, 45, 43, 6F, 6D, 70, 61, 63, 74, 32, 00, 45, 08, 60, F5, 2A, C9, F2, 4F, 6A, A1, 37, 2B, 0A, 46, E5, 13, 13, 84, 3D, 6E, 28, 66, E2, C2, CE, F3, B6, 70, C6, EE, A2, 08, 3B, EF, 79, 38, B0, E9, 69, 04, CC, 98, 0C, E7, 0C, F1, E9, 7B, 80, E9, D8, DC, 45, 06, E6, FB, A5, 6B, 68, 10, B7, F3, 67, 04, D5, A8, 2E, E6, C7, 08, 95, D5, 4C, 81, 57, 86, A1, 69, FD, 1A, 0D, 6F, CF, 65, 9B, EA, 9B, E1, 41, 11, 44, 74, A5... 
[+]

Entropy:

1.6790

Packer / compiler:

PECompact v2

Code size:

236 KB (241,664 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Eraser

Command:

C:\Program Files\eraser\eraser.exe -hide

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.