home

outlookrecovery_301012.exe

OfficeRecovery LLP

This is a setup program which is used to install the application. The file has been seen being downloaded from www.officerecovery.com.
Publisher:
OfficeRecovery LLP  (signed and verified)

MD5:
5b676c6d9ff17db0ab259e332f286905

SHA-1:
6c9231ce8793f71bad988717b3a50f96b4f081e6

SHA-256:
11fd58c3373094633ebda12307c0226a378896ea9319e8d43f1bb8a8b3adc922

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 5:26:44 AM UTC  (today)

File size:
3.9 MB (4,066,304 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\outlookrecovery_301012.exe

Digital Signature
Signed by:
OfficeRecovery LLP

Authority:
GoDaddy.com, Inc.

Valid from:
2/27/2014 5:06:40 PM

Valid to:
2/27/2015 5:06:40 PM

Subject:
CN=OfficeRecovery LLP, O=OfficeRecovery LLP, L=Edinburgh, C=GB

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2B94F59EF33D15

File PE Metadata
OS version:
0.65534

OS bitness:
Win64

Linker version:
254.255

.NET CLR dependent:
Yes

CTPH (ssdeep):
98304:CXuXIlh/jXFyNg359JB9JhvNUVjgROJMnljkRFa:YeIbXcNg359JLJhvyVj2O6nlW

Entry address:
0x3F0000

Entry point:
D0, CF, 11, E0, A1, B1, 1A, E1, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 3E, 00, 03, 00, FE, FF, 09, 00, 06, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 3F, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 10, 00, 00, 02, 00, 00, 00, 02, 00, 00, 00, FE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 7F, 00, 00, 00, 00, 01, 00, 00, 7F, 01, 00, 00, 00, 02, 00, 00, 7F, 02, 00, 00, 00, 03, 00, 00, 7F, 03, 00, 00, 00, 04, 00, 00, 7F, 04, 00, 00, 00, 05, 00, 00, 7F, 05, 00, 00, 00, 06, 00, 00...
 
[+]

Code size:
384 KB (393,225 bytes)

The file outlookrecovery_301012.exe has been seen being distributed by the following URL.

http://www.officerecovery.com/.../olrdemo.exe

Scan outlookrecovery_301012.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.