home

foto43.exe

The executable foto43.exe has been detected as malware by 30 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from hawaiimedicalassociation.com.
MD5:
8d292100fd87214370098ad48c36533a

SHA-1:
e9f1917765c73406ef3d7cfafb5ef6f6fa76dbc4

SHA-256:
d53c942bab29b25fa124692ce4225f650e7eff89ec047a949698ff04f51bf15c

Scanner detections:
30 / 68

Status:
Malware

Analysis date:
4/26/2024 1:33:25 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Agent
7.1.1

Avira AntiVirus
TR/Dropper.Gen
7.11.65.52

avast!
SFX:Bicololo-E [Trj]
2014.9-140203

AVG
DoS
2015.0.3575

Bitdefender
Trojan.Generic.KDV.843304
1.0.20.170

Comodo Security
Heur.Suspicious
15600

Dr.Web
Trojan.Hosts.6769
9.0.1.034

ESET NOD32
Win32/Dost.AD
8.8124

Fortinet FortiGate
W32/Dost.AD
2/3/2014

F-Prot
W32/Trojan2.NVNR
v6.4.7.1.166

F-Secure
Trojan.Generic.KDV.843304
11.2014-03-02_2

G Data
Trojan.Generic.KDV.843304
14.2.22

IKARUS anti.virus
BV.Bicololo
t3scan.2.0.0.0

K7 AntiVirus
Riskware
13.163.8375

Kaspersky
Trojan.Win32.Qhost
14.0.0.4369

Malwarebytes
Trojan.Qhost
v2014.02.03.03

McAfee
Artemis!8D292100FD87
5600.7231

Microsoft Security Essentials
Trojan:Win32/Comisproc
1.163.1557.0

MicroWorld eScan
Trojan.Generic.KDV.843304
15.0.0.102

NANO AntiVirus
Trojan.Win32.Hosts.bfzwwy
0.22.8.51249

Norman
Troj_Generic.HJUHF
11.20140203

nProtect
Trojan.Generic.KDV.843304
13.03.16.01

Panda Antivirus
Trj/OCJ.D
14.02.03.03

Quick Heal
Trojan.Agent.WD.cw3
2.14.12.00

Sophos
Mal/Generic-S
4.86

SUPERAntiSpyware
Trojan.Agent/Gen-Artemis
10807

Trend Micro House Call
TROJ_GEN.RCBCDBA
7.2.34

Trend Micro
TROJ_GEN.RCBCDBA
10.465.03

Vba32 AntiVirus
Trojan.Qhost.afda
3.12.20.2

VIPRE Antivirus
Trojan.Win32.Generic.pak!cobra
16100

File size:
2.5 MB (2,650,468 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\foto43.exe

File PE Metadata
Compilation timestamp:
6/9/2012 5:19:49 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:6y+C47P+4DsDfYwaPEPzbr9lGuGJMfbpA4eC3ak+tEwhKMBR4WojPp:6yeP+4DsDw8r9lG5efbPl3ak+7vBR47V

Entry address:
0xAC87

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, 9F, 30, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, 8F, AB, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 24, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 24, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, 0E, B1, FF, FF, C3, 56, 8B, F1, 8B, 06, 85, C0, 74, 07, 50, FF, 15, C4, 40, 41, 00, 83, 26, 00, 83, 66, 08, 00, 83, 66, 0C, 00, 5E, C3, 56, 8B, F1, 80, 7E, 04, 00, 75, 34, 68, F4, 44, 41, 00...
 
[+]

Code size:
73 KB (74,752 bytes)

The file foto43.exe has been seen being distributed by the following URL.

http://hawaiimedicalassociation.com/images/stories/.../skoraya_pomosh.jpg

Remove foto43.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.