home

stkeys2-gui.exe

The application stkeys2-gui.exe has been detected as a potentially unwanted program by 26 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from dc581.2shared.com and multiple other hosts.
MD5:
d1453918e8faeca72331436632491e0c

SHA-1:
6397da13aff0cac8956b89ad82e2f0f018cc853a

SHA-256:
e62bc1b16b10cd9711632d483aa8c20036d1450b62acec1c0f20a65acfdfed78

Scanner detections:
26 / 68

Status:
Potentially unwanted

Analysis date:
4/24/2024 1:20:37 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Backdoor.Generic.351421
966

AegisLab AV Signature
Hoax.W32.Getpin
2.1.4+

Avira AntiVirus
DR/Getpin.ET
7.11.153.220

AVG
HackTool
2015.0.3444

Baidu Antivirus
Trojan.Win32.BadJoke
4.0.3.14613

Bitdefender
Backdoor.Generic.351421
1.0.20.820

Bkav FE
W32.Cloda78.Trojan
1.3.0.4959

Comodo Security
ApplicUnsaf.Win32.Hoax.Getpin.et
18475

Emsisoft Anti-Malware
Backdoor.Generic.351421
11.5.0.6191

Fortinet FortiGate
Riskware/Getpin
6/13/2014

F-Secure
Backdoor.Generic.351421
5.15.21

G Data
Backdoor.Generic.351421
14.6.24

IKARUS anti.virus
Joke.Getpin
t3scan.1.6.1.0

K7 AntiVirus
Riskware
13.1712333

Malwarebytes
PUP.Hoax.Stkeys
v2014.06.13.02

McAfee
Artemis!D1453918E8FA
5600.7100

MicroWorld eScan
Backdoor.Generic.351421
15.0.0.492

Norman
Backdoor.Generic.351421
02.04.2016 17:35:19

nProtect
Joke/W32.Getpin.1289278
14.06.05.01

Qihoo 360 Security
Win32/Trojan.Dropper.60a
1.0.0.1015

Rising Antivirus
PE:Trojan.Win32.Generic.12A81252!313004626
23.00.65.14611

Trend Micro House Call
TROJ_SPNR.03D811
7.2.164

Trend Micro
TROJ_SPNR.03D811
10.465.13

VIPRE Antivirus
Hoax.Win32.Getpin.et (not malicious)
30076

ViRobot
Hoax.Getpin.1289278
2011.4.7.4223

XVirus List
Win32.Detected
2.6.13

File size:
1.2 MB (1,289,278 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
8/16/2009 2:05:35 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:jUWqistYozkb30xafoAYZzaWB1d2qxQcVw3qx0bR2zDsPPbmlXEimDOVKoXSBG:jUU7b3safonBvzG+wax6xeYOVFsG

Entry address:
0xA7D8

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, 54, 2B, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, E2, A7, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 1C, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 1C, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, C1, AC, FF, FF, C3, 55, 8B, EC, 83, EC, 1C, 56, 33, F6, 56, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 30, 22, 41, 00, 85, C0, 74, 21, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 34, 22, 41, 00, 8D, 45, E4...
 
[+]

Code size:
66 KB (67,584 bytes)

The file stkeys2-gui.exe has been seen being distributed by the following 2 URLs.

http://dc581.2shared.com/download/.../stKeys2-GUI.exe

http://fs09n1.sendspace.com/dl/966d43fe76a59fe31443dea5e3cde442/52cf54bd59bfbaf8/.../Speed Touch Key Generator [Jose0726].exe

Remove stkeys2-gui.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.