home

microsoft.exe

The executable microsoft.exe has been detected as malware by 31 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘system’. While running, it connects to the Internet address host-41.46.40.52.tedata.net on port 442.
MD5:
e8a6ab3df11215992acf920dc7321cb2

SHA-1:
0173a105d3563637ab06327764a0237c848c1781

SHA-256:
dc29f96b0e67d403e1d9d03393d1c1ca252f0edd8c0ed34218f5f00bb03784da

Scanner detections:
31 / 68

Status:
Malware

Analysis date:
4/26/2024 7:54:43 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
MemScan:Trojan.Agent.AXRZ
1022

AhnLab V3 Security
Trojan/Win32.Injector
2014.02.21

Avira AntiVirus
TR/Crypt.MWPM.Gen
7.11.132.236

avast!
Win32:Dropper-gen [Drp]
2014.9-140418

AVG
BackDoor.Agent
2015.0.3500

Baidu Antivirus
Backdoor.Win32.Agent
4.0.3.14418

Bitdefender
MemScan:Trojan.Agent.AXRZ
1.0.20.540

Bkav FE
HW32.CDB
1.3.0.4924

Comodo Security
TrojWare.Win32.Vilsel.G
17818

Dr.Web
DDoS.MP.5
9.0.1.0108

Emsisoft Anti-Malware
MemScan:Trojan.Agent.AXRZ
8.14.04.18.01

ESET NOD32
Win32/Delf.OGV
8.9448

F-Secure
MemScan:Trojan.Agent.AXRZ
11.2014-18-04_6

G Data
MemScan:Trojan.Agent.AXRZ
14.4.24

IKARUS anti.virus
Trojan-Dropper.Agent
t3scan.2.2.29

K7 AntiVirus
Trojan
13.176.11210

Kaspersky
Backdoor.Win32.Agent
14.0.0.3997

Malwarebytes
Backdoor.Agent.FR
v2014.04.18.01

McAfee
RDN/Generic.bfr!fs
5600.7156

Microsoft Security Essentials
Trojan:Win32/Ceatrg.A
1.10302

MicroWorld eScan
MemScan:Trojan.Agent.AXRZ
15.0.0.324

Norman
Troj_Generic.RZURC
11.20140418

nProtect
MemScan:Trojan.Agent.AXRZ
14.02.20.01

Panda Antivirus
Trj/CI.A
14.04.18.01

Quick Heal
(Suspicious) - DNAScan
4.14.12.00

Rising Antivirus
PE:Trojan.Win32.Injector.fr!1075352319
23.00.65.14416

Sophos
Mal/Generic-S
4.97

Trend Micro House Call
TROJ_GEN.R0CBC0UAC14
7.2.108

Trend Micro
TROJ_GEN.R0CBC0UAC14
10.465.18

Vba32 AntiVirus
Backdoor.Agent
3.12.24.3

VIPRE Antivirus
Trojan.Win32.Generic
26664

File size:
87 KB (89,088 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\microsoft.exe

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:g39pEa1BK9ChqbU5gY4qdwznsRYtiCw3UG34HxD7QCi3+fnLFZLWeAU/w:g3Tp1bu29/px3QqCiIvWeW

Entry address:
0x12D9

Entry point:
55, 8B, EC, 6A, FF, 68, 00, 00, 00, 00, 68, 00, 00, 00, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, E8, 33, FF, FF, FF, 55, E8, 2E, FF, FF, FF, 68, B8, A7, 69, E5, 53, 51, E8, B3, FF, FF, FF, 68, B7, C7, 97, 5C, 52, E8, B0, FF, FF, FF, FF, 33, 5E, 68, AA, 01, 96, EA, 68, 01, C5, 50, 14, 68, 6C, 5A, 20, B0, 68, DB, 92, A6, E6, E8, 61, FF, FF, FF, 55, 68, 7E, AA, CA, A8, 56, E8, 07, FF, FF, FF, 68, C5, CF, F5, 34, E8, DF, FE, FF, FF, 68, 60, FE, EF, 27, 56, 68, 3F, 1E, 59, BA, E8, DD, FE, FF...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
130.5 KB (133,632 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
system

Command:
C:\users\{user}\appdata\roaming\microsoft.exe


The executing file has been seen to make the following network communication in live environments.

TCP:
Connects to host-41.46.40.52.tedata.net  (41.46.40.52:442)

Remove microsoft.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.