rustv player.exe

Rus TV Player

Publisher:
Rus TV Player

Product:
Rus TV Player

Version:
2.6.1.1

MD5:
7a7d9b4aef537054401100ff212d3b79

SHA-1:
b06dab32c3de2771b36f9444071bad59e4f3c17e

SHA-256:
f1871b04fbd4ea711874d5d110e80a1b02523f3a30ec4f2b50c96c96a5c85569

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
5/24/2018 3:58:46 AM UTC  (a few moments ago)

Scan engine
Detection
Engine version

McAfee Web Gateway
BehavesLike.Win32.Backdoor.rc
7.6664

File size:
8.4 MB (8,814,592 bytes)

Product version:
2.6

Copyright:
Rus TV Player

Original file name:
Rus TV Player

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\rustv player\rustv player.exe

File PE Metadata
Compilation timestamp:
2/11/2014 6:20:41 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:qP2/ylGAp16hscJ7CKzPhMX9o6G9o6HwHPLQLFM+Phu3LNBox+8mylPkN9fwA:x/yGbhC2iNHPLQLFM+Phu3L98mkkvYA

Entry address:
0x40B618

Entry point:
55, 8B, EC, 83, C4, F0, 53, B8, D8, CE, 7F, 00, E8, FF, 2D, C0, FF, 8B, 1D, 48, B9, 81, 00, 8B, 03, E8, 8E, F1, DD, FF, 8B, 03, BA, 54, B7, 80, 00, E8, 32, EB, DD, FF, 8B, 0D, 58, BD, 81, 00, 8B, 03, 8B, 15, 08, 47, 7D, 00, E8, 87, F1, DD, FF, 8B, 0D, FC, B9, 81, 00, 8B, 03, 8B, 15, 24, EA, 7C, 00, E8, 74, F1, DD, FF, 8B, 0D, B8, B8, 81, 00, 8B, 03, 8B, 15, 18, 95, 7B, 00, E8, 61, F1, DD, FF, 8B, 0D, 68, BD, 81, 00, 8B, 03, 8B, 15, F8, A8, 7B, 00, E8, 4E, F1, DD, FF, 8B, 0D, 3C, B9, 81, 00, 8B, 03, 8B, 15...
 
[+]

Code size:
4 MB (4,235,264 bytes)

Windows Firewall Allowed Program
Name:
D:\Program Files\RusTV Player\RusTV Player.exe


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to thumbs01.begun.ru  (91.192.149.36:80)

TCP (HTTP):
Connects to static.131.23.46.78.clients.your-server.de  (78.46.23.131:80)

TCP (HTTP):
Connects to host52-203.promobit.ru  (193.169.52.203:80)

TCP (HTTP):
Connects to autocontext.begun.ru  (91.192.148.17:80)

Scan rustv player.exe - Powered by Reason Core Security