home

new order.exe

{70166A21-2F6A-4CC0-822C-607696D8F4B7}

The executable new order.exe has been detected as malware by 9 anti-virus scanners.
Publisher:
{70166A21-2F6A-4CC0-822C-607696D8F4B7}  (signed and verified)

MD5:
ab8ce5f97eac051cfbe690bdbbf1d78b

SHA-1:
7c0623422ec936543b28ffd720cddf37095ae6e5

SHA-256:
f543a9df20b1248b8410cb54dff50e2e51bb479a91ad338c97ebbe747e460155

Scanner detections:
9 / 68

Status:
Malware

Analysis date:
4/25/2024 11:14:47 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Baidu Antivirus
Trojan.Win32.Generic
4.0.3.14810

ESET NOD32
MSIL/Injector.DNK (variant)
8.9792

Fortinet FortiGate
W32/Generic.DNK!tr
8/10/2014

IKARUS anti.virus
Trojan-Signed:Agent
t3scan.1.6.1.0

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.3428

McAfee
PWSZbot-FXD!AB8CE5F97EAC
5600.7043

Qihoo 360 Security
Win32/Trojan.e6d
1.0.0.1015

Sophos
Troj/MSIL-RD
4.98

VIPRE Antivirus
Trojan.Win32.Generic
29156

File size:
1.1 MB (1,171,488 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\datawork\new order.exe

Digital Signature
Signed by:
{70166A21-2F6A-4CC0-822C-607696D8F4B7}

Authority:
{70166A21-2F6A-4CC0-822C-607696D8F4B7}

Valid from:
4/19/2014 5:47:18 AM

Valid to:
4/19/2015 11:47:18 AM

Subject:
CN={70166A21-2F6A-4CC0-822C-607696D8F4B7}

Issuer:
CN={70166A21-2F6A-4CC0-822C-607696D8F4B7}

Serial number:
3F0DF1EBD88FB1B94D119CFFAC6B01C9

File PE Metadata
Compilation timestamp:
5/5/2014 10:03:51 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:npnvWp0hfLVdC2IHIiEMMMMMMMMMMMMMMMMMMMMMMMM9MMMMMMMMMMMMMMMMMMMR:ndaNHmMMMMMMMMMMMMMMMMMMMMMMMM9G

Entry address:
0xC4EDE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1693

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
780 KB (798,720 bytes)

User Start Menu Item
Name:
new order.exe


Remove new order.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.