» protocol.dll
Overview
Analysis
File Details

protocol.dll

PEEPLEware protocol

PEEPLEware Co., Ltd

File name:

protocol.dll

Publisher:

PEEPLEware (signed by PEEPLEware Co., Ltd)

Product:

PEEPLEware protocol

Description:

protocol

Version:

3, 0, 0, 101

MD5:

e5f22dd4d53c1684dd79803c3b663223

SHA-1:

969633852b472c6ccf7b4af7dd3d3f6368676b34

SHA-256:

e6f928f276137c723dec1b3a124f7d8534e08f62fed1a4582ddc8f2180725742

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

4/19/2024 4:47:04 PM UTC (today)

Scan engine

Detection

Engine version

Emsisoft Anti-Malware

Win32.Sality

8.16.07.19.09

File size:

32.4 KB (33,216 bytes)

Product version:

3, 0, 0, 1

Original file name:

protocol.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\modules\protocol.dll

Digital Signature

Signed by:

PEEPLEware Co., Ltd

Authority:

Thawte, Inc.

Valid from:

7/13/2013 2:00:00 AM

Valid to:

9/12/2014 1:59:59 AM

Subject:

CN="PEEPLEware Co., Ltd", O="PEEPLEware Co., Ltd", L=Gangnam-gu, S=SEOUL, C=KR

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

5F2CD9FA01BA15C573869CD6F23A3F04

File PE Metadata

Compilation timestamp:

7/22/2013 11:03:56 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

192:g6Mg4O3guyJXBzszBg0Cs/ox7/aIIjEzWEOubtn/ntO8z2e+PjPoW17fv:gdFF+i7yIRzWEFn/tOPLdn

Entry address:

0x2BD7

Entry point:

55, 8B, EC, 53, 8B, 5D, 08, 56, 8B, 75, 0C, 57, 8B, 7D, 10, 85, F6, 75, 09, 83, 3D, DC, 45, 00, 10, 00, EB, 26, 83, FE, 01, 74, 05, 83, FE, 02, 75, 22, A1, EC, 45, 00, 10, 85, C0, 74, 09, 57, 56, 53, FF, D0, 85, C0, 74, 0C, 57, 56, 53, E8, 15, FF, FF, FF, 85, C0, 75, 04, 33, C0, EB, 4E, 57, 56, 53, E8, 59, FD, FF, FF, 83, FE, 01, 89, 45, 0C, 75, 0C, 85, C0, 75, 37, 57, 50, 53, E8, F1, FE, FF, FF, 85, F6, 74, 05, 83, FE, 03, 75, 26, 57, 56, 53, E8, E0, FE, FF, FF, 85, C0, 75, 03, 21, 45, 0C, 83, 7D, 0C, 00... 
[+]

Developed / compiled with:

Microsoft Visual C++ 6.0

Code size:

8 KB (8,192 bytes)

Scan protocol.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.