home

explorer.exe

Select'Assistance Pro

The executable explorer.exe has been detected as malware by 28 anti-virus scanners. Although this file uses the name explorer.exe, this is NOT the File Explorer program distributed with the Windows OS that is found in C:\Windows.
Publisher:
Windows Installer  (signed by Select'Assistance Pro)

Product:
Windows Installer

Version:
11.1.5.5

MD5:
becb3545fdd3b37c81d5c545b6ec1930

SHA-1:
bac4f13e3ffc7a60581371694ecf7f87543f19a3

SHA-256:
facad374092825d76671861594608fe48ca77479b25a73b737b4396672697a14

Scanner detections:
28 / 68

Status:
Malware

Analysis date:
4/27/2024 12:00:48 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Zusy.97884
186

Agnitum Outpost
Trojan.Spatet
7.1.1

Avira AntiVirus
TR/Spate.A.4
8.3.1.6

avast!
MSIL:GenMalicious-FJ [Trj]
2014.9-160801

AVG
MSIL3
2017.0.2664

Baidu Antivirus
Trojan.Win32.Spatet
4.0.3.1681

Bitdefender
Gen:Variant.Zusy.97884
1.0.20.1070

Bkav FE
W32.AdzdigM.Trojan
1.3.0.6379

Comodo Security
UnclassifiedMalware
22258

Dr.Web
BackDoor.Siggen.49176
9.0.1.0214

Emsisoft Anti-Malware
Gen:Variant.Zusy.97884
8.16.08.01.04

ESET NOD32
Win32/Spatet
10.11700

Fortinet FortiGate
W32/Spatet.A!tr
8/1/2016

F-Secure
Gen:Variant.Zusy.97884
11.2016-01-08_2

G Data
Gen:Variant.Zusy.97884
16.8.25

IKARUS anti.virus
Trojan.MSIL3
t3scan.1.9.2.0

McAfee
Artemis!BECB3545FDD3
5600.6320

Microsoft Security Essentials
Backdoor:MSIL/Bladabindi
1.1.11701.0

MicroWorld eScan
Gen:Variant.Zusy.97884
17.0.0.642

NANO AntiVirus
Trojan.Win32.Siggen.dbqfwg
0.30.24.1636

Qihoo 360 Security
Trojan.Generic
1.0.0.1015

Quick Heal
Backdoor.BLA.r4
8.16.14.00

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_SPNR.0CJ314
7.2.214

Trend Micro
TROJ_SPNR.0CJ314
10.465.01

VIPRE Antivirus
Trojan.Win32.Generic
40630

ViRobot
Trojan.Win32.S.Agent.673976[h]
2014.3.20.0

Zillya! Antivirus
Trojan.Spatet.Win32.5900
2.0.0.2193

File size:
658.2 KB (673,976 bytes)

Product version:
11.1.5.5

Copyright:
© 2014 Microsoft Inc. All rights reserved.

Trademarks:
Microsoft Inc

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Windows\System32\drivers\explorer.exe

Digital Signature
Signed by:
Select'Assistance Pro

Authority:
DigiCert Inc

Valid from:
4/3/2014 3:00:00 AM

Valid to:
4/7/2017 3:00:00 PM

Subject:
CN=Select'Assistance Pro, O=Select'Assistance Pro, L=Strasbourg, C=FR

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
06CE209477F1AC19A2049BDC5846A831

File PE Metadata
Compilation timestamp:
4/25/2014 3:23:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:jdxj0nMqrTYqe3fKTBERH5kYQqzwBiHOS2GP7wBDsHUeHfaByl/hc+ui:jsnM+TZSfKtERZkg0iHOS2GP7w2UeHf5

Entry address:
0xA374E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.3753

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
646 KB (661,504 bytes)

Policies Explorer Run
Name:
Microsoft


Remove explorer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.