» ExeScriptEditor.exe
Overview
Analysis
File Details
Programs (1)

ExeScriptEditor.exe

ExeScript Editor

Everstrike OOO

The application ExeScriptEditor.exe, “ExeScript Editor Application” by Everstrike OOO has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program ExeScript Editor by Everstrike Software.

File name:

ExeScriptEditor.exe

Publisher:

Everstrike Software (signed by Everstrike OOO)

Product:

ExeScript Editor

Description:

ExeScript Editor Application

Version:

2.8.0.0

MD5:

8049bbe3d83855da3d8b8aa03b254735

SHA-1:

2a0dbac0bc977da4f292ad35bc84b8952e175227

SHA-256:

3b3212adedb3af56d165c4461b553ab69cc2c308c6d4b0db780be4a1ab1b3c69

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

4/26/2024 10:10:00 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Everstri (M)

16.6.16.20

File size:

4.5 MB (4,691,808 bytes)

Product version:

2.8.0.0

Original file name:

ExeScriptEditor.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\exescript editor\exescripteditor.exe

Digital Signature

Signed by:

Everstrike OOO

Authority:

VeriSign, Inc.

Valid from:

12/17/2010 7:00:00 AM

Valid to:

1/14/2012 6:59:59 AM

Subject:

CN=Everstrike OOO, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Everstrike OOO, L=Ulyanovsk, S=n/a, C=RU

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

1C6FEBAF7115A5C4FFAEAACEC3EA4FF1

File PE Metadata

Compilation timestamp:

10/28/2011 9:00:54 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

98304:zFkXddhN2S1Yc7LtzWdy46BByCBFSbcH2s/N5MrT+9QTDkq:zFkLhj1YyJSc4iBPGcHdgX+9fq

Entry address:

0x7182AC

Entry point:

9C, C6, 04, 24, FE, E9, AF, DD, 03, 00, 1E, 0A, 21, BA, 95, 5F, 15, 5C, 87, F6, 87, F5, C7, F6, 0B, 7F, 8B, 5F, E3, BD, 2E, 2B, 75, 6C, 10, 41, F0, 5F, 3F, AC, 6A, 34, 6E, 09, A7, 34, 2A, 09, 4A, 0D, 5A, 5D, 4D, A9, 6B, F8, 98, 0D, 76, 9D, 17, F9, 4A, 3D, C6, BA, 63, 59, 60, 1A, A4, BC, C5, EF, D0, 96, 57, B9, 7F, A4, FA, 53, 64, 3F, A1, 1D, 63, B8, 45, 8F, 2D, A5, DF, 29, 7E, 47, BC, B9, A9, 2A, 76, B9, 95, 5F, DB, 03, 10, AB, 79, AB, 1A, 44, B0, 8C, 9E, E0, F3, 48, D6, 02, A8, 3B, 43, 8D, 58, 1E, 63, F3... 
[+]

Entropy:

7.9228 (probably packed)

Code size:

3.4 MB (3,611,648 bytes)

The file ExeScriptEditor.exe has been discovered within the following program.

ExeScript Editor by Everstrike Software

www.scriptcode.com

About 7% of users remove it

Remove ExeScriptEditor.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.