home

srv44736.exe

win32exe

The application srv44736.exe, “win32exe installer” has been detected as a potentially unwanted program by 33 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Product:
win32exe

Description:
win32exe installer

Version:
1.0.2.684

MD5:
2f586f2c3ce4e893d593c481b1bdf9c4

SHA-1:
6e8be84caec81796972378d15c94b47322344b54

SHA-256:
2cddee2c290167cbba56af002e6a1211c83b89062fb08c2e7944e11e46ad2147

Scanner detections:
33 / 68

Status:
Potentially unwanted

Analysis date:
4/20/2024 2:15:56 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.477123
6213306

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetize
2014.11.11

Avira AntiVirus
ADWARE/Adware.Gen4
7.11.183.254

avast!
Win32:Trojan-gen
141214-1

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.141222

Bitdefender
Gen:Variant.Adware.Kazy.477123
1.0.20.1780

Bkav FE
HW32.Packed
1.3.0.4959

Comodo Security
ApplicUnwnt
20045

Dr.Web
Trojan.Adfltnet.1
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.477123
9.0.0.4668

ESET NOD32
Win32/Amonetize.BW potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Amonetize
12/22/2014

F-Prot
W32/A-c685077f
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Kazy.477123
5.13.68

G Data
Gen:Variant.Adware.Kazy.477123
14.12.24

IKARUS anti.virus
PUA.Amonetize
t3scan.1.8.3.0

K7 AntiVirus
Trojan
13.185.13965

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
15.0.0.543

McAfee
RDN/Generic PUP.x!cps
5600.6909

MicroWorld eScan
Gen:Variant.Adware.Kazy.477123
15.0.0.1068

NANO AntiVirus
Riskware.Win32.NetFilter.dgvyzb
0.28.6.62995

Norman
Gen:Variant.Adware.Kazy.477123
04.12.2014 14:30:06

nProtect
Trojan-Clicker/W32.Amonetize.689152
14.11.28.01

Panda Antivirus
Trj/Genetic.gen
14.12.22.07

Qihoo 360 Security
Win32/Trojan.c90
1.0.0.1015

Reason Heuristics
Threat.Win.Reputation.IMP
14.12.22.7

Sophos
Generic PUA EA
4.98

Trend Micro House Call
TROJ_GEN.R0C2C0VK614
7.2.356

Trend Micro
TROJ_GEN.R0C2C0VK614
10.465.22

Vba32 AntiVirus
AdWare.Amonetize
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic.pak!cobra
34688

Zillya! Antivirus
Backdoor.PePatch.Win32.49296
2.0.0.1980

File size:
674 KB (690,176 bytes)

Copyright:
Copyright 2013-2014

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\srv44736.exe

File PE Metadata
Compilation timestamp:
10/14/2014 12:21:50 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:I+1VlCxzXBInIv+iZXStVT4txn7KULbFkfOSoDyCB/srpB/8dx+S7/wFY0H1mksr:DVIxy0hS/T433x/Dj14B0d8Sr+HIk

Entry address:
0x11D8A

Entry point:
E8, E8, 69, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 9C, 5E, 38, 00, 00, 75, 18, E8, C7, 5E, 00, 00, 6A, 1E, E8, 11, 5D, 00, 00, 68, FF, 00, 00, 00, E8, 7C, F3, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 9C, 5E, 38, 00, FF, 15, EC, A0, 37, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 9C, 5E, 38, 00, 00, 75, 18, E8, 7D, 5E, 00, 00, 6A, 1E, E8, C7, 5C, 00, 00, 68, FF, 00, 00, 00, E8, 32, F3, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Code size:
163 KB (166,912 bytes)

Remove srv44736.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.