» full wholesale rate cuba good notification 25.02.2015.xlsx.exe
Overview
Analysis
File Details

full wholesale rate cuba good notification 25.02.2015.xlsx.exe

Select'Assistance Pro

The executable full wholesale rate cuba good notification 25.02.2015.xlsx.exe has been detected as malware by 11 anti-virus scanners.

File name:

Publisher:

Select'Assistance Pro (signed and verified)

MD5:

e6b9d303965bd2041552bd6f38999d91

SHA-1:

3a4e6c1ccfb0dd0044858496247c08edf93ed414

SHA-256:

75c8aeb6486251a143f4e5f098588595488e9531731d361f3de8102abe18eff8

Scanner detections:

11 / 68

Status:

Malware

Analysis date:

4/23/2024 10:43:37 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Trojan.Agent

7.1.1

Baidu Antivirus

Trojan.Win32.Agent

4.0.3.15410

Dr.Web

Trojan.DownLoader12.50414

9.0.1.0100

Fortinet FortiGate

W32/Agent.APGFC!tr

4/10/2015

K7 AntiVirus

Riskware

13.202.15459

Kaspersky

Trojan.Win32.Agent

14.0.0.2211

McAfee

Artemis!E6B9D303965B

5600.6799

NANO AntiVirus

Trojan.Win32.Agent.dpunaq

0.30.8.659

Panda Antivirus

Generic Suspicious

15.04.10.08

Trend Micro House Call

TROJ_GEN.R021H07D115

7.2.100

Zillya! Antivirus

Trojan.Agent.Win32.521025

2.0.0.2124

File size:

363.7 KB (372,423 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\appdata\roaming\skype\my skype received files\full wholesale rate cuba good notification 25.02.2015.xlsx.exe

Digital Signature

Signed by:

Select'Assistance Pro

Authority:

DigiCert Inc

Valid from:

4/3/2014 2:00:00 AM

Valid to:

4/7/2017 2:00:00 PM

Subject:

CN=Select'Assistance Pro, O=Select'Assistance Pro, L=Strasbourg, C=FR

Issuer:

CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

06CE209477F1AC19A2049BDC5846A831

File PE Metadata

Compilation timestamp:

3/2/2011 8:40:24 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:nFw8wzBh50UJ45mekZBRpsZIVk5QTFk0s3Mm9eOCrw508qfjUD45mrUrxDwQKG+:nFszBhnS5mBkZYgQm0s3Mn0551D4cYrS

Entry address:

0xB4B5

Entry point:

E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, 7F, 2D, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, 1E, A1, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 1C, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 1C, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, 47, A6, FF, FF, C3, 55, 8B, EC, 83, EC, 1C, 56, 33, F6, 56, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 48, 32, 41, 00, 85, C0, 74, 21, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 4C, 32, 41, 00, 8D, 45, E4... 
[+]

Code size:

70.5 KB (72,192 bytes)

Remove full wholesale rate cuba good notification 25.02.2015.xlsx.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.