home

iswchar.exe

Internet SagiWall

BB Softservice Corp.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘iswchar2’.
Publisher:
BB Softservice Corp  (signed by BB Softservice Corp.)

Product:
Internet SagiWall

Version:
2, 3, 0, 0

MD5:
9944c14a6ee0e734131340328bd77ede

SHA-1:
a96d983dd09242f3b1ecd97856b5a055099a8f09

SHA-256:
38ae5f1c4bc48e08740648e1e1903521b088c30ff225176c72518e778bbbcc14

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 8:24:31 AM UTC  (today)

File size:
391.1 KB (400,520 bytes)

Product version:
2, 3, 0, 0

Copyright:
Copyright (C) BB Softservice Corp. All rights reserved.

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\securebrain\internet sagiwall\iswchar.exe

Digital Signature
Signed by:
BB Softservice Corp.

Authority:
VeriSign, Inc.

Valid from:
1/24/2012 9:00:00 AM

Valid to:
1/24/2013 8:59:59 AM

Subject:
CN=BB Softservice Corp., OU=Business Division, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=BB Softservice Corp., L=Minato-ku, S=Tokyo, C=JP

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
1747BF85CC3E7F284E0F5CCF9B687FFF

File PE Metadata
Compilation timestamp:
10/12/2012 7:43:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:LUZ3HC+Upd0aAJaJ9dbAKhSCxdmqFduOJ/nj:oZXqRPXxkqLuOJ/nj

Entry address:
0x3CE0

Entry point:
E8, BD, 4F, 00, 00, E9, 16, FE, FF, FF, 56, 6A, 01, 68, E4, 42, 41, 00, 8B, F1, E8, 3D, 50, 00, 00, C7, 06, 20, 07, 41, 00, 8B, C6, 5E, C3, C7, 01, 20, 07, 41, 00, E9, 98, 50, 00, 00, 56, 8B, F1, C7, 06, 20, 07, 41, 00, E8, 8A, 50, 00, 00, F6, 44, 24, 08, 01, 74, 07, 56, E8, 4D, 10, 00, 00, 59, 8B, C6, 5E, C2, 04, 00, 56, FF, 74, 24, 08, 8B, F1, E8, 12, 50, 00, 00, C7, 06, 20, 07, 41, 00, 8B, C6, 5E, C2, 04, 00, 55, 8B, EC, 83, EC, 0C, EB, 0D, FF, 75, 08, E8, 09, 53, 00, 00, 85, C0, 59, 74, 0F, FF, 75, 08...
 
[+]

Entropy:
6.2948

Code size:
60 KB (61,440 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
iswchar2

Command:
C:\Program Files\securebrain\internet sagiwall\iswchar.exe


Scan iswchar.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.