home

flexcrypt.exe

Nordic Information Security Group AB

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Flexcrypt’.
Publisher:
Nordic Information Security Group AB  (signed and verified)

MD5:
d2b591a63a66e87c6b84a0f1b458be08

SHA-1:
1a9077a5f92555620675ebf20fd17d8ddd581da8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 1:25:47 AM UTC  (today)

File size:
2.5 MB (2,594,000 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\flexcrypt\flexcrypt.exe

Digital Signature
Signed by:
Nordic Information Security Group AB

Authority:
GlobalSign nv-sa

Valid from:
6/7/2011 1:51:26 AM

Valid to:
7/22/2012 6:46:39 PM

Subject:
CN=Nordic Information Security Group AB, O=Nordic Information Security Group AB, L=182 16 Danderyd, S=182 16 Danderyd, C=SE

Issuer:
CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:
010000000001306676A962

File PE Metadata
Compilation timestamp:
5/1/2012 1:53:00 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:m91miNdLWIu+pEKdLdlt2m74AuNF4FDSBTLHv/hxtlS06M:u1miNdLWIu+pEKdLdlt2m74AMF4VSVLX

Entry address:
0x427E0

Entry point:
FF, 25, 78, 32, 44, 00, CC, CC, 03, 30, 01, 00, 07, 00, 00, 00, 00, 00, 00, 00, 16, 80, 0C, 00, 00, 04, 2A, CC, 03, 30, 01, 00, 07, 00, 00, 00, 00, 00, 00, 00, 16, 80, 02, 00, 00, 04, 2A, CC, 03, 30, 01, 00, 07, 00, 00, 00, 00, 00, 00, 00, 16, 80, 07, 00, 00, 04, 2A, CC, 03, 30, 01, 00, 07, 00, 00, 00, 00, 00, 00, 00, 16, 80, 0F, 00, 00, 04, 2A, CC, 03, 30, 01, 00, 07, 00, 00, 00, 00, 00, 00, 00, 16, 80, 0A, 00, 00, 04, 2A, CC, 03, 30, 01, 00, 07, 00, 00, 00, 00, 00, 00, 00, 16, 80, 12, 00, 00, 04, 2A, CC...
 
[+]

Entropy:
6.1033

Code size:
262.5 KB (268,800 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Flexcrypt

Command:
"C:\Program Files\flexcrypt\flexcrypt.exe" minimized winstart


Scan flexcrypt.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.