home

pdf24.exe

PDF24 Creator

Geek Software GmbH

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PDFPrint’.
Publisher:
Geek Software GmbH  (signed and verified)

Product:
PDF24 Creator

Version:
2.6.3

MD5:
3b11bd06040b1af37aa6a0d132f501f5

SHA-1:
d5a919e828ea87d2f1c3b92b7622052137bb9af4

SHA-256:
eaf0ed15bf700966b49a71b12580b7406567a7b0602c08b27b6530d538d1b654

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 9:29:43 AM UTC  (today)

File size:
202.6 KB (207,504 bytes)

Product version:
2.6.3

Copyright:
Geek Software GmbH

File type:
Executable application (Win32 EXE)

Language:
German (Germany)

Common path:
C:\Program Files\pdf24\pdf24.exe

Digital Signature
Signed by:
Geek Software GmbH

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
9/2/2009 6:00:00 AM

Valid to:
9/3/2010 5:59:59 AM

Subject:
CN=Geek Software GmbH, OU=Secure Application Development, O=Geek Software GmbH, L=Berlin, S=Berlin, C=DE

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
4BF87B8114E9DC990E2CB15E7060C3EB

File PE Metadata
Compilation timestamp:
12/15/2009 2:59:44 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:q+zXLYRg4TAMj3ygHyCs5s9wlfqT0iPDTtp7:q+zXLKgtMjLDZ9wlM/7b

Entry address:
0x5191

Entry point:
E8, 75, 40, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 27, F8, FF, FF, 8B, FF, 55, 8B, EC, 83, 7D, 0C, 00, 74, 0B, 6A, 2D, 5A, 66, 89, 11, 83, C1, 02, F7, D8, 56, 8B, F1, 33, D2, F7, 75, 08, 83, FA, 09, 76, 05, 83, C2, 57, EB, 03, 83, C2, 30, 66, 89, 11, 41, 41, 85, C0, 77, E5, 33, C0, 66, 89, 01, 49, 49, 66, 8B, 16, 0F, B7, 01, 66, 89, 11, 49, 66, 89, 06, 49, 46, 46, 3B, F1, 72, EC, 5E, 5D, C2, 08, 00, 8B, FF, 55, 8B, EC, 83, 7D, 10, 0A, 8B, 45, 08, 75, 0A, 85, C0, 7D, 06, 6A, 01, 6A, 0A, EB...
 
[+]

Entropy:
5.5219

Code size:
63 KB (64,512 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PDFPrint

Command:
C:\Program Files\pdf24\pdf24.exe


Scan pdf24.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.