home

root.exe

SystemNode

Maxiget Limited

This is part of a bundled installer which provides applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application root.exe by Maxiget Limited has been detected as adware by 13 anti-malware scanners.
Publisher:
SwapSystem  (signed by Maxiget Limited)

Product:
SystemNode

Description:
SystemComponent

Version:
4, 0, 27, 0

MD5:
b89be8b3bae472f77ecb80d540eccaae

SHA-1:
f89e03124c5f30eb5eadd5d615ef64f984bf2130

SHA-256:
bdb866cb40c59ef0b139d6a675701b60e9dbcb59c30f68ffe7a97b5c9dbe46a6

Scanner detections:
13 / 68

Status:
Adware

Explanation:
This is a modified installer version of the software and bundles additional offers including adware.

Analysis date:
4/26/2024 1:49:14 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Trojan/Win32.Agent
2014.11.28

Avira AntiVirus
APPL/4Shared.43944
7.11.189.70

Comodo Security
Application.Win32.4Shared.FG
20215

Dr.Web
Adware.Downware.9208
9.0.1.05190

ESET NOD32
Win32/4Shared.AC potentially unwanted application
7.0.302.0

IKARUS anti.virus
PUA.4Shared
t3scan.1.8.3.0

K7 AntiVirus
Unwanted-Program
13.186.14161

McAfee
4shared
5600.6933

NANO AntiVirus
Riskware.Win32.Downware.djhyre
0.28.6.63726

Panda Antivirus
Trj/Genetic.gen
14.11.28.02

Reason Heuristics
PUP.MaxigetLimited.E
14.11.28.2

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Threat.4150696
35088

File size:
42.7 KB (43,768 bytes)

Product version:
4, 0, 27, 0

Copyright:
2014

Trademarks:
SmallTrade Inc.

Original file name:
0008.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\root.exe

Digital Signature
Signed by:
Maxiget Limited

Authority:
Starfield Technologies, Inc.

Valid from:
11/4/2014 11:59:17 AM

Valid to:
8/15/2016 8:41:32 AM

Subject:
CN=Maxiget Limited, O=Maxiget Limited, L=Limassol, S=Cyprus, C=CY

Issuer:
CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2B6558A31AA7EB

File PE Metadata
Compilation timestamp:
11/12/2014 8:15:22 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
384:s3FLzKXqF8emdriRDdyQm7hq18ha50qXUlfzAQ3myyqAV10gOCooqDG8pplDMDbe:sVL0BL7m/0qXURMayjyptHVWt9Va

Entry address:
0x2F16

Entry point:
55, 8B, EC, 83, EC, 10, 53, 56, 57, 8D, 45, F0, 50, C7, 45, F0, 08, 00, 00, 00, C7, 45, F4, 20, 00, 00, 00, FF, 15, 00, 40, 40, 00, 68, 28, 0A, 00, 00, BE, B8, A4, BB, 00, 56, 33, DB, 53, FF, 15, 98, 40, 40, 00, 53, 68, 80, 00, 00, 00, 6A, 03, 53, 6A, 01, 68, 00, 00, 00, 80, 56, FF, 15, 90, 40, 40, 00, 8B, F0, 83, FE, FF, 0F, 84, 0A, 01, 00, 00, 56, E8, FA, E6, FF, FF, 59, 56, 88, 45, FF, FF, 15, 94, 40, 40, 00, 38, 5D, FF, 0F, 84, F0, 00, 00, 00, 68, 90, 01, 00, 00, BF, 14, 51, 40, 00, 57, FF, 15, 5C, 40...
 
[+]

Entropy:
5.8843

Developed / compiled with:
Microsoft Visual C++

Code size:
8.5 KB (8,704 bytes)

Remove root.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.