home

preagentpkg_agent.exe

ZENworks Configuration Management

Internal Certificate Authority

Publisher:
Novell, Inc.  (signed by Internal Certificate Authority)

Product:
ZENworks Configuration Management

Description:
Exe Wrapped Installer

Version:
11.4.2.11050

MD5:
40778215ecf3c679e88e3bba2b258015

SHA-1:
7a4a77c228db12cf34417e9ea7c878c4c91c991a

SHA-256:
2341f29ea147485b0276f9f3b911a3aebd3886285c19cfb46a29a23c32929ca9

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/6/2024 6:52:42 AM UTC  (today)

File size:
1.8 MB (1,869,057 bytes)

Product version:
11.4.2.11050

Copyright:
Copyright © Novell, Inc. 2016

Original file name:
exewrap.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\preagentpkg_agent.exe

Digital Signature
Signed by:
Internal Certificate Authority

Authority:
Internal Certificate Authority

Valid from:
11/12/2012 12:53:15 PM

Valid to:
11/10/2022 12:53:15 PM

Subject:
CN=zcm1.sevier.org, OU=ZENworks, O=Internal Certificate Authority

Issuer:
CN=zcm1.sevier.org, OU=ZENworks, O=Internal Certificate Authority

Serial number:
50A1378B

File PE Metadata
Compilation timestamp:
4/12/2016 5:37:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:/f/LRT9/h38TxXUz81D2Q1C58T4H9gKKI4qrZxGxy:/bh9/h3AU41DWVH9gBI4qxOy

Entry address:
0x9CCA

Entry point:
E8, 32, BA, 00, 00, E9, 16, FE, FF, FF, 55, 8B, EC, 83, EC, 34, 8B, 4D, 08, 81, C1, 94, F8, FF, FF, 56, 33, F6, 83, F9, 46, 89, 75, F8, 89, 75, F4, 89, 75, FC, 89, 4D, F0, 7C, 08, 81, F9, 4C, 04, 00, 00, 7E, 23, E8, AC, F4, FF, FF, 56, 56, 56, 56, 56, C7, 00, 16, 00, 00, 00, E8, 18, 06, 00, 00, 83, C4, 14, 83, C8, FF, 83, CA, FF, E9, 3D, 02, 00, 00, 53, 8B, 5D, 0C, 8D, 43, FF, 83, F8, 0B, 77, 12, 83, 7D, 14, 17, 77, 0C, 83, 7D, 18, 3B, 77, 06, 83, 7D, 1C, 3B, 76, 23, E8, 6B, F4, FF, FF, 56, 56, 56, 56, 56...
 
[+]

Entropy:
6.0029

Code size:
160 KB (163,840 bytes)

The file preagentpkg_agent.exe has been seen being distributed by the following URL.

http://zcm1.sevier.org/zenworks-downloads/setup/.../PreAgentPkg_Agent.exe

Scan preagentpkg_agent.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.