home

snezhnaya koroleva vizit snezhnoj korolevy vmusice net.exe

OOO IT Service

The application snezhnaya koroleva vizit snezhnoj korolevy vmusice net.exe by OOO IT Service has been detected as adware by 25 anti-malware scanners.
Publisher:
OOO IT Service  (signed and verified)

MD5:
7e9ff4af280a478e2271846de15c3f06

SHA-1:
6a70082a13ed62f0663ba7daf5c263a6b3391433

SHA-256:
80845f7a99e75f8f33a6bbc2c63ba6cc9ca7392c38b1b30a35db88a56250570f

Scanner detections:
25 / 68

Status:
Adware

Analysis date:
4/23/2024 9:32:43 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.429389
6489932

Avira AntiVirus
APPL/LoadMoney.qoabn
7.11.206.0

AVG
Win32/Heur
2014.0.4257

Bitdefender
Gen:Variant.Adware.Kazy.429389
1.0.20.150

Comodo Security
MalCrypt.Indus!
20902

Dr.Web
Trojan.LoadMoney.444
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.429389
9.0.0.4799

ESET NOD32
Win32/Adware.LoadMoney.AFH application
7.0.302.0

F-Secure
Gen:Variant.Adware.Kazy.429389
5.13.68

G Data
Gen:Variant.Adware.Kazy.429389
15.1.25

K7 AntiVirus
Unwanted-Program
13.193.14817

Kaspersky
not-a-virus:Downloader.Win32.LMN
15.0.0.543

McAfee
Generic Obfuscated.g
5600.6869

Microsoft Security Essentials
Threat.Undefined
1.191.3639.0

MicroWorld eScan
Gen:Variant.Adware.Kazy.429389
16.0.0.90

NANO AntiVirus
Trojan.Win32.LMN.dmrlea
0.30.0.65070

Norman
Gen:Variant.Adware.Kazy.429389
03.12.2014 13:20:04

Panda Antivirus
Trj/Genetic.gen
15.01.30.01

Reason Heuristics
PUP.OOOITService
15.1.30.13

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
23.00.65.15128

Sophos
Virus 'Mal/LdMon-B'
5.10

Total Defense
Win32/Ogimant.CGIFVdC
37.0.11411

Vba32 AntiVirus
SScope.Downware.LMN
3.12.26.3

VIPRE Antivirus
Threat.4080917
36666

Zillya! Antivirus
Downloader.LMN.Win32.328785
2.0.0.2049

File size:
584.1 KB (598,136 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\snezhnaya koroleva vizit snezhnoj korolevy vmusice net.exe

Digital Signature
Signed by:
OOO IT Service

Authority:
Thawte, Inc.

Valid from:
10/17/2014 3:00:00 AM

Valid to:
10/18/2015 2:59:59 AM

Subject:
CN=OOO IT Service, OU=OOO IT Service, O=OOO IT Service, L=Moscow, S=Moscow region, C=RU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
7A7E5E3CC949C470ED95B81AD98FC138

File PE Metadata
Compilation timestamp:
1/20/2015 4:41:20 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.14

CTPH (ssdeep):
12288:RSg5Z/qrqGFq3eJOry4jIIM8NJ/V4jo7kqozst7/kgQXvgZFuWjJ0iGd:arqGFqfrysJN4jbqt7/kfXvI90iG

Entry address:
0xCE54

Entry point:
A1, CD, 08, 45, 00, C1, CF, 00, 2B, 5C, 24, 0C, 8B, 44, 24, F4, 89, CD, F8, 29, D3, 90, F8, C1, D2, 1B, 81, C2, B9, F2, D8, 66, 19, D8, 81, D2, C7, AF, BA, D7, F7, 44, 24, 04, 75, 51, BB, 3E, F9, 89, E1, D1, E2, FC, 0F, BA, E0, 1E, C1, EA, 1E, 0F, BA, FB, 11, 25, 28, EB, 32, 64, 19, F9, 13, 5C, 24, 04, 97, 03, 5C, 24, 0C, F9, 81, 3D, 03, 3D, 42, 00, 7C, 2E, 0E, 58, 0F, BA, E1, 00, 0F, BA, E8, 1C, C1, E2, 04, F7, D1, F7, D2, 13, 3C, 24, 41, 85, 6C, 24, F8, 0F, BA, F8, 17, 2B, 6C, 24, 08, 8B, 15, 57, 9D, 40...
 
[+]

Code size:
523 KB (535,552 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.