home

Escndv.exe

EPSON Scan

SEIKO EPSON Corporation

This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler. The file has been seen being downloaded from mg.mail.yahoo.com and multiple other hosts.
Publisher:
SEIKO EPSON CORP.  (signed by SEIKO EPSON Corporation)

Product:
EPSON Scan

Version:
3.7.9.3

MD5:
1c7a945c46e853718474c3b4c3344a65

SHA-1:
927d0eb73d14cdd647fd675bd00736186cb5266a

SHA-256:
0eb215c6a7fd8ee74da04f3dc4a32c6ad260e1d67372d8a7e78b3aa87e18da0a

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 11:31:29 AM UTC  (today)

File size:
215.2 KB (220,320 bytes)

Product version:
3.7.9.0

Copyright:
Copyright (C) SEIKO EPSON CORP. 2002

Original file name:
Escndv.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\windows\twain_32\escndv\escndv.exe

Digital Signature
Signed by:
SEIKO EPSON Corporation

Authority:
VeriSign, Inc.

Valid from:
7/5/2012 2:00:00 AM

Valid to:
7/6/2013 1:59:59 AM

Subject:
CN=SEIKO EPSON Corporation, OU=Information Service & Support Department, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SEIKO EPSON Corporation, L=Suwa-shi, S=Nagano, C=JP

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0150B1D803F9F70294A501581DB63264

File PE Metadata
Compilation timestamp:
10/11/2012 11:36:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:V2W5P7eIAWsf9sJI3U0pycugnGEBAOVzhP:YWR7Af9TEJgnFR

Entry address:
0xFB51

Entry point:
E8, 06, 94, 00, 00, E9, 16, FE, FF, FF, 6A, 0C, 68, 80, 9E, 42, 00, E8, 09, 1F, 00, 00, 6A, 0E, E8, 57, 57, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, FC, C8, 42, 00, BA, F8, C8, 42, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, E8, EE, FF, FF, 59, FF, 76, 04, E8, DF, EE, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00, E8, F8, 1E, 00, 00, C3, 8B, D0, EB, C5, 6A, 0E, E8, 24, 56, 00, 00, 59, C3, CC, CC, CC, CC, CC, 8B...
 
[+]

Code size:
136 KB (139,264 bytes)

Scheduled Task
Task name:
{7E9E8F4B-6B20-447C-8DC4-67E35CC0DFB4}

Trigger:
Registration (Runs on registration)


The file Escndv.exe has been seen being distributed by the following 6 URLs.

https://mg.mail.yahoo.com/ya/download?mid=2_0_0_3_22861_AL9hUtQAAA8lUz5Z/.../hL4&fid=Draft&pid=3&clean=0&appid=YahooMailNeo

https://webmail1p.orange.fr/webmail/fr_FR/.../Download.html?CHECK_ATTACHEMENT=TRUE&NAME=escndv.exe

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-6jKa8SqVjY7EMAfpckhL-cY2W1MQQ2vSvjDIzUW_g8bI9GeHImE6GDoWwRVVP3iytuETplc2ZqDv1KJCKNhgDA/messages/@.id==AEZpimIAABC1VvWKgQE8aFA217g/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBbiOETDpq4nyJHH6k03oCgKXk2BZy2InD5gVgmE4-9SPatgezLTFbuWDfCaMFLPdGs&error=https://ar-mg5.mail.yahoo.com/.../iframemsg?id=704045c2-cc53-e80f-4448-a0418733d81e&ymreqid=049f31ea-d296-78f8-01a5-4f002c010000

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_2_204084_AKJUfbwAAAMEVBX2cAAAAHh6ieU&fid=Sent&pid=2&clean=0&appid=YahooMailNeo

https://mail-attachment.googleusercontent.com/attachment/u/.../?ui=2&ik=9d10a1196e&view=att&th=1471702e1d707629&attid=0.2&disp=safe&realattid=f_hxdholw01&zw&saduie=AG9B_P9HFe7LZ6cBOJJIGur0ZMsb&sadet=1404840398400&sads=d96mtCeX6lKrimJvqMsLYQ0L9gU

https://mail.google.com/mail/u/.../?ui=2&ik=9d10a1196e&view=att&th=1471702e1d707629&attid=0.2&disp=safe&realattid=f_hxdholw01&zw

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.