home

office_pt-br_.exe

Microsoft Office

Microsoft Corporation

This is a setup program which is used to install the application. This is installed with Complementos de Navegador do Microsoft Office on Demand. The file has been seen being downloaded from r.office.microsoft.com.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft Office

Description:
Microsoft Office com Clique para Executar

Version:
15.0.4605.1002

MD5:
8ceef98b47ccbd1c88e5954eb16bfbbf

SHA-1:
f1e2532778eceb40125e9d060920be19694e7007

SHA-256:
f7fdbef8d3a2322ac6a4cf1a63bdd59d9c626d7a3b8fb0b06dd85f0caa659d29

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/24/2024 5:26:15 PM UTC  (today)

File size:
942.2 KB (964,824 bytes)

Product version:
15.0.4605.1002

Original file name:
Bootstrapper.exe

File type:
Executable application (Win32 EXE)

Language:
Brazilian Portuguese

Common path:
C:\users\{user}\downloads\office_pt-br_.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
1/24/2013 8:33:39 PM

Valid to:
4/24/2014 7:33:39 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000B011AF0A8BD03B9FDD0001000000B0

File PE Metadata
Compilation timestamp:
3/25/2014 5:35:17 AM

OS version:
5.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.10

CTPH (ssdeep):
24576:XYJW6+yk1yllGCXIGI0ml6NTi3aFk7AjON8BProRfSwQ:XYJW6+30B5SlIcuk7Ao8Bzo9Q

Entry address:
0x541AB

Entry point:
E8, DC, 4F, 00, 00, E9, 81, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, F9, 11, 00, 00, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, 35, B0, 12, 40, 00, 57, FF, 35, 68, 7D, 4C, 00, FF, D6, FF, 35, 64, 7D, 4C, 00, 8B, D8, 89, 5D, FC, FF, D6, 8B, F0, 3B, F3, 0F, 82, 81, 00, 00, 00, 8B, FE, 2B, FB, 8D, 47, 04, 83, F8, 04, 72, 75, 53, E8, 06, 51, 00, 00, 8B, D8, 8D, 47, 04, 59, 3B, D8, 73, 48, B8, 00, 08, 00, 00, 3B, D8, 73, 02, 8B, C3, 03, C3, 3B, C3, 72, 0F, 50, FF, 75, FC, E8, 94, 50, 00, 00, 59, 59, 85, C0, 75, 16, 8D...
 
[+]

Code size:
759.5 KB (777,728 bytes)

The file office_pt-br_.exe has been discovered within the following program.

Complementos de Navegador do Microsoft Office on Demand  by Microsoft Corporation
Publisher's description - “If you have Office 365 Home Premium and want to use it on PCs where it isn’t installed, you can. We call it Office on Demand.”
office.microsoft.com
9% remove it
 
Powered by Should I Remove It?

The file office_pt-br_.exe has been seen being distributed by the following URL.

https://r.office.microsoft.com/.../rlidJolokiaIE?p1=rtm&clid=1046

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.