home

keygen_p.exe

The executable keygen_p.exe has been detected as malware by 9 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from docviewer.yandex.com.
Version:
1.0.0.0

MD5:
a108d1b53e336d8929c4b5f155622680

SHA-1:
66623d5fb421ca13d857643fd3b7e076a08b3258

SHA-256:
0ec3bee245b38448b84c748981559f02fc69edf7fe10ce5f52567d467c0e0cf9

Scanner detections:
9 / 68

Status:
Malware

Analysis date:
4/26/2024 4:22:59 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
2014.9-160128

Baidu Antivirus
Hacktool.Win32.Packed.Themida
4.0.3.16128

Bkav FE
W32.HfsAutoB
1.3.0.7383

Comodo Security
UnclassifiedMalware
23596

ESET NOD32
Win32/Packed.Themida suspicious (variant)
10.12571

G Data
Win32.Application.Agent.2DKAFA
16.1.25

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.16126

Sophos
Generic PUA GG (PUA)
4.98

VIPRE Antivirus
Trojan.Win32.Generic
45232

File size:
4.1 MB (4,255,232 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\keygen_p.exe

File PE Metadata
Compilation timestamp:
8/4/2014 11:00:38 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:k7NQnfN/Omf6Nk6DAxVs3JL96JGJBKAH/92m9qcA1AU84MMI:kZQnxONNk6DGs3Jp6JO92ICAF42

Entry address:
0x85F000

Entry point:
56, 50, 53, E8, 01, 00, 00, 00, CC, 58, 89, C3, 40, 2D, 00, 40, 1D, 00, 2D, 41, 81, 83, 04, 05, 38, 81, 83, 04, 80, 3B, CC, 75, 19, C6, 03, 00, BB, 00, 10, 00, 00, 68, 39, C9, 29, 6C, 68, B9, 8F, AA, 6E, 53, 50, E8, 0A, 00, 00, 00, 83, C0, 00, 89, 44, 24, 08, 5B, 58, C3, 55, 89, E5, 50, 53, 51, 56, 8B, 75, 08, 8B, 4D, 0C, C1, E9, 02, 8B, 45, 10, 8B, 5D, 14, 85, C9, 74, 0A, 31, 06, 01, 1E, 83, C6, 04, 49, EB, F2, 5E, 59, 5B, 58, C9, C2, 10, 00, 4B, 5E, C0, 02, 9B, BD, 72, 4D, B8, F8, 58, 00, A1, 1F, AA, 05...
 
[+]

Entropy:
7.9803  (probably packed)

Code size:
1.7 MB (1,832,448 bytes)

The file keygen_p.exe has been seen being distributed by the following URL.

https://docviewer.yandex.com/source?id=ltssu-68za4wa0ncc6i40ioblun146oxllcqw4yy4ajw4l8z56r6jw4qyuk6smyaibw326ui5l7hfqhboalfpitl62ur2r5bd0jc89mli&archive-path=//keygen_p.exe&ts=14ef14de0d6&token=UloWvFxByDBNT rC lTUJQ==&name=calterm.7z

Remove keygen_p.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.