home

loader64.exe

ExploitShield

ZeroVulnerabilityLabs, Inc.

It runs as a scheduled task under the Windows Task Scheduler named ExploitShield triggered to execute each time a user logs in. This is installed with ZeroVulnerabilityLabs ExploitShield version 0.8.1 beta.
Publisher:
ZeroVulnerabilityLabs, Inc.  (signed and verified)

Product:
ExploitShield

Description:
ExploitShield Loader

Version:
0.9.0.1

MD5:
d29b7cbd24b1770e931e37319c901112

SHA-1:
21d42cb89e92c53c825ab26f135b14a7fa351074

SHA-256:
68861dda006132843a1d86c3cfd7bf82436c6e470e2e7de62e903da528cacb85

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 3:19:07 PM UTC  (today)

File size:
56.2 KB (57,560 bytes)

Product version:
0.9.0.1

Copyright:
(c) 2012 ZeroVulnerabilityLabs, Inc.

Original file name:
Loader

File type:
Executable application (Win64 EXE)

Language:
English

Common path:
C:\Program Files\zerovulnerabilitylabs\exploitshield\loader64.exe

Digital Signature
Signed by:
ZeroVulnerabilityLabs, Inc.

Authority:
DigiCert Inc

Valid from:
5/29/2012 2:00:00 AM

Valid to:
6/3/2013 2:00:00 PM

Subject:
CN="ZeroVulnerabilityLabs, Inc.", O="ZeroVulnerabilityLabs, Inc.", L=San Jose, S=California, C=US

Issuer:
CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
07CA76C80E17FD2CA42587E9B14D22CE

File PE Metadata
Compilation timestamp:
3/28/2013 2:32:47 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows Console

Linker version:
10.0

CTPH (ssdeep):
384:oFv9OqBQsgFmnli+xxAxL3x0gh/h2KOejF8/nXQvgQUqWZGtaTnGYZyNzOzQkx5W:Pq/Xnl1a2KO+avQzUnOm58hhukaKg8

Entry address:
0x2C10

Entry point:
48, 83, EC, 28, E8, 07, 0F, 00, 00, E8, 12, 00, 00, 00, 48, 83, C4, 28, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 48, 83, EC, 68, 48, C7, 44, 24, 40, 00, 00, 00, 00, E8, FE, 01, 00, 00, 48, 8B, 40, 08, 48, 89, 44, 24, 38, C7, 44, 24, 30, 00, 00, 00, 00, 48, 8B, 44, 24, 38, 48, 89, 44, 24, 58, 48, 8D, 0D, C4, 8A, 00, 00, 33, C0, 48, 8B, 54, 24, 58, F0, 48, 0F, B1, 11, 48, 89, 44, 24, 40, 48, 83, 7C, 24, 40, 00, 74, 23, 48, 8B, 44, 24, 38, 48, 39, 44, 24, 40, 75, 0A, C7, 44, 24, 30, 01, 00, 00...
 
[+]

Entropy:
4.6495

Code size:
24 KB (24,576 bytes)

Scheduled Task
Task name:
ExploitShield

Trigger:
Logon (Runs on logon)


The file loader64.exe has been discovered within the following program.

ZeroVulnerabilityLabs ExploitShield version 0.8.1 beta  by ZeroVulnerabilityLabs
Publisher's description - “Every week new financial, state-sponsored and commercial espionage targeted attacks are discovered. These sophisticated advanced persistent threats use arsenals of vulnerability exploits that are weaponized to steal confidential information and trade secrets.”
www.zerovulnerabilitylabs.com
About 13% of users remove it
 
Powered by Should I Remove It?

Scan loader64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.