isaferkscanshell64.dll

YAC Security Protection

Elex do Brasil Participações Ltda

The module isaferkscanshell64.dll, “iSafeScan Shell Context Menu” by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Remove isaferkscanshell64.dll - Powered by Reason Core Security
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
YAC Security Protection

Description:
iSafeScan Shell Context Menu

Version:
0.0.0.1

MD5:
249be3955b477e00ec56a9f2c629371f

SHA-1:
7881aa17b0cfa3bb5005cc1a63ca24041de3540d

SHA-256:
b16f8f21ecbc92e448fc532d67f2e0cf6697a45248e02a9b0a007df9952ec94a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/10/2016 11:57:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Optional.ElexdoBrasilParticipacoesa.S
14.6.10.10

Remove isaferkscanshell64.dll - Powered by Reason Core Security
File size:
295.2 KB (302,248 bytes)

Product version:
0.0.0.1

Copyright:
Copyright (c) 2011-2014 Elex do Brasil Participações Ltda

Original file name:
iSafeRKScanshellctx.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Program Files\isafe\isaferkscanshell64.dll

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
9/24/2013 12:46:21 AM

Valid to:
8/17/2014 3:28:53 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=Consolação, S=São Paulo, C=BR

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11215F51916F2BB9F54E82871FEA88CE8F5E

Registration
CLSIDs:
{0EB9B9FE-3CEF-43E1-882A-853FC80021CE}, {5411D116-5A37-47D4-B154-5F7FCD9062F0}

COM registered:
Yes

File PE Metadata
Compilation timestamp:
4/18/2014 4:27:39 AM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:DI7aMWMgeqokmRSTZPBvvizCalr23UBzTnkEecgo0EVgNu8X+ushXv9DazynNZkt:DI20gNWSTZPBvvimajBzTfeGeIwmDw

Entry address:
0x16F5C

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, 17, 8A, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, 70, FC, 02, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF...
 
[+]

Code size:
165.5 KB (169,472 bytes)

Approved Shell Extension
Name:
iSafeRKScan Shell Extension

CLSID:
{5411D116-5A37-47D4-B154-5F7FCD9062F0}

CLSID name:
OShellContextMenu Class


Remove isaferkscanshell64.dll - Powered by Reason Core Security