iSafeNetFilter.sys

YAC Security Protection

Elex do Brasil Participações Ltda

The file iSafeNetFilter.sys, “iSafeNetFilter SDK WFP Driver (WPP)” by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 4 anti-malware scanners. It runs as a Windows 64-bit kernel mode device driver named “iSafeNetFilter”.
Remove iSafeNetFilter.sys - Powered by Reason Core Security
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
YAC Security Protection

Description:
iSafeNetFilter SDK WFP Driver (WPP)

Version:
1.4.3.9 built by: WinDDK

MD5:
59c600b0dc9e78b73b723e71eddcc5f2

SHA-1:
982e8e9a6f625e554e2f5bb6703fabf1272913c3

SHA-256:
2b059f3d17187e066d50bf8c49d9e42bc487a8f4fe50b641e21bfaddf7e3f688

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
12/11/2016 12:45:54 PM UTC  (today)

Scan engine
Detection
Engine version

Antiy Labs AVL
Trojan/Win32.SGeneric
0.1.0.1

ESET NOD32
Win32/RiskWare.NetFilter.A application
8.7.0.302.0

Reason Heuristics
PUP.Optional.ElexdoBrasilParticipacoesa.R
14.6.10.10

Trend Micro House Call
TROJ_GEN.F47V1108
7.2.161

Remove iSafeNetFilter.sys - Powered by Reason Core Security
File size:
47.5 KB (48,640 bytes)

Product version:
1.4.3.9

Copyright:
Copyright (c) 2011-2013 Elex do Brasil Participações Ltda

Original file name:
iSafeNetFilter.sys

File type:
Driver (Win64 SYS)

Language:
English (United States)

Common path:
C:\Program Files\isafe\isafenetfilter.sys

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
9/24/2013 12:46:21 AM

Valid to:
8/17/2014 3:28:53 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=Consolação, S=São Paulo, C=BR

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11215F51916F2BB9F54E82871FEA88CE8F5E

File PE Metadata
Compilation timestamp:
4/27/2014 9:19:31 PM

OS version:
6.1

OS bitness:
Win64

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
768:L7G1TQ+Hb165ylJI6XdW9ebe9nRXzKwyP4C1XgN1mwlZDV6Inc2vVyiOKE:/CTPZJI6s41XS1Xpki5E

Entry address:
0xC064

Entry point:
48, 83, EC, 28, 4C, 8B, C2, 4C, 8B, C9, E8, 95, FF, FF, FF, 49, 8B, D0, 49, 8B, C9, 48, 83, C4, 28, E9, E2, 50, FF, FF, CC, CC, 78, C2, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 5C, C6, 00, 00, A0, 91, 00, 00, 28, C1, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, E2, CA, 00, 00, 50, 90, 00, 00, D8, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, DA, CB, 00, 00, 00, 90, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, BE, CB, 00, 00, 00, 00, 00, 00, AA, CB, 00, 00...
 
[+]

Code size:
34.5 KB (35,328 bytes)

Driver
Display name:
iSafeNetFilter

Type:
Kernel device driver (KernelDriver)

Group:
PNP_TDI


Remove iSafeNetFilter.sys - Powered by Reason Core Security