home

gypper.exe

Dawing

Belies

The executable gypper.exe has been detected as malware by 23 anti-virus scanners. While running, it connects to the Internet address advancedsearch.virginmedia.com on port 80 using the HTTP protocol.
Publisher:
Belies

Product:
Dawing

Description:
Bubble

Version:
1.0.0.1

MD5:
81ce4dbd540515a0e6d721c3d22bc11e

SHA-1:
8d32cdf217538b574a01e78ca03c0d7ba037ab17

SHA-256:
55f3cea320bbf811ef517a93942b23a47c4f2289f2d38b07ea76026d30b7a33d

Scanner detections:
23 / 68

Status:
Malware

Analysis date:
5/8/2024 5:12:09 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.9034837
261

AegisLab AV Signature
Troj.MSIL.Agent
2.1.4+

Avira AntiVirus
TR/Rogue.9034837
7.11.214.38

avast!
MSIL:Agent-AGH [Trj]
2014.9-160518

AVG
MSIL
2017.0.2739

Baidu Antivirus
Trojan.MSIL.Agent
4.0.3.16518

Bitdefender
Trojan.Generic.9034837
1.0.20.695

Comodo Security
UnclassifiedMalware
21311

Dr.Web
Trojan.DownLoader8.56090
9.0.1.0139

Emsisoft Anti-Malware
Trojan.Generic.9034837
8.16.05.18.09

ESET NOD32
MSIL/Agent.FJ (variant)
10.11277

Fortinet FortiGate
MSIL/Agent.FJ
5/18/2016

F-Secure
Trojan.Generic.9034837
11.2016-18-05_4

G Data
Trojan.Generic.9034837
16.5.25

IKARUS anti.virus
Trojan.Msil
t3scan.1.8.6.0

K7 AntiVirus
Backdoor
13.200.15178

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.190

McAfee
Artemis!81CE4DBD5405
5600.6395

MicroWorld eScan
Trojan.Generic.9034837
17.0.0.417

Norman
Troj_Generic.RIIVJ
11.20160518

nProtect
Trojan.Generic.9034837
15.03.06.01

Sophos
Mal/Generic-S
4.98

VIPRE Antivirus
Trojan.Win32.Generic
38164

File size:
53.5 KB (54,784 bytes)

Product version:
1.0.0.1

Copyright:
Tittie

Trademarks:
Beaked

Original file name:
Jarrah.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\c2zbwjzgfexdrpt0qni2s0e0pak\gypper.exe

File PE Metadata
Compilation timestamp:
4/27/2013 9:42:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
768:vTd8VnkubJCzSxFhOMF7yI96zrD362QkXJ:CVPvtR96zv362Qq

Entry address:
0xC32E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.0894

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
41 KB (41,984 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to advancedsearch.virginmedia.com  (81.200.64.50:80)

Remove gypper.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.