home

srptm.exe

srptm

ReSoft LTD.

The application srptm.exe by ReSoft has been detected as adware by 14 anti-malware scanners. This file is typically installed with the program LPT System Updater Service by Linkury Ltd. which is a potentially unwanted software program. While running, it connects to the Internet address 82-166-201-184.barak-online.net on port 80 using the HTTP protocol.
Publisher:
ReSoft LTD.  (signed and verified)

Product:
srptm

Version:
1.0.0.0

MD5:
c727a9c77f9b470a853a2dab51e36ffd

SHA-1:
306277de055c1af30f865cffa7300ec87e8278f0

SHA-256:
13c5a311cd1098c84f46f3963a1f82f2d3b9379faea9d95b544d0a108cf3ad62

Scanner detections:
14 / 68

Status:
Adware

Analysis date:
4/19/2024 10:40:10 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Adware.Heur.bm1@gjai8!h
804

Avira AntiVirus
TR/Trash.Gen
7.11.140.82

Bitdefender
Gen:Adware.Heur.bm1@gjai8!h
1.0.20.1630

Dr.Web
Trojan.Damaged.1
9.0.1.0326

Emsisoft Anti-Malware
Gen:Adware.Heur.bm1@gjai8!h
8.14.11.22.05

F-Secure
Gen:Adware.Heur.bm1@gjai8!h
11.2014-22-11_7

G Data
Gen:Adware.Heur.bm1@gjai8!h
14.11.24

IKARUS anti.virus
PUA.Linkury
t3scan.1.6.1.0

Malwarebytes
PUP.Optional.VeriStaff
v2014.11.22.05

MicroWorld eScan
Gen:Adware.Heur.bm1@gjai8!h
15.0.0.978

Reason Heuristics
PUP.ReSoft.F
14.11.22.17

SUPERAntiSpyware
Trojan.Agent/Gen-Nullo[Short]
10222

Trend Micro House Call
Suspicious_GEN.F47V0716
7.2.326

VIPRE Antivirus
Adware.Linkury
34998

File size:
24 KB (24,608 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
srptm.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\lpt\srptm.exe

Digital Signature
Signed by:
ReSoft LTD.

Authority:
COMODO CA Limited

Valid from:
7/31/2013 5:00:00 PM

Valid to:
8/1/2015 4:59:59 PM

Subject:
CN=ReSoft LTD., O=ReSoft LTD., STREET=4th Hanevi'im, L=Tel Aviv, S=Israel, PostalCode=64356, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
51FA31336CEC649121E9A908289950D2

File PE Metadata
Compilation timestamp:
11/19/2014 5:07:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
384:CD61eDGi1XIgNmiqz2aQNFNybKuFlG7+IFttIpbYBuG+nhCxYPLg8JO:Cx1Yghf7B5ntIpsUXMEM

Entry address:
0x599E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 50, 00, 00, 0C, 00, 00, 00, A0, 39, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.4155

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
14.5 KB (14,848 bytes)

The file srptm.exe has been discovered within the following program.

LPT System Updater Service  by Linkury Ltd.
This is a potentially unwanted web browser extension this is distributed and installed by PINWID LTD, ReSoft LTD., MY POP SHOP LTD and Linkury. It will display advertisements including banners and popups in the user's web browser.
81% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-69-221-139.us-west-2.compute.amazonaws.com  (54.69.221.139:80)

TCP (HTTP):
Connects to ip-184-168-221-96.ip.secureserver.net  (184.168.221.96:80)

TCP (HTTP):
Connects to ec2-52-77-163-162.ap-southeast-1.compute.amazonaws.com  (52.77.163.162:80)

TCP (HTTP):
Connects to a72-247-178-42.deploy.akamaitechnologies.com  (72.247.178.42:80)

TCP (HTTP):
Connects to 82-166-201-184.barak-online.net  (82.166.201.184:80)

Remove srptm.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.