home

TDSSKiller.exe

TDSSKiller

Kaspersky Lab

This is a setup program which is used to install the application. The file has been seen being downloaded from support.kaspersky.com and multiple other hosts.
Publisher:
Kaspersky Lab ZAO  (signed by Kaspersky Lab)

Product:
TDSSKiller

Description:
TDSS rootkit removing tool

Version:
3.0.0.14

MD5:
efde3843dde0d1d30161ff27a17d135c

SHA-1:
fd88d164c6d5d87fd65149f72d86adbbf1e68040

SHA-256:
e360492692010450a605e1e7124536ceff139ccd758908f474eb6e95f6811e61

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/27/2024 1:36:47 AM UTC  (today)

File size:
3.9 MB (4,121,952 bytes)

Product version:
3.0.0.14

Copyright:
© 1997-2013 Kaspersky Lab ZAO.

Trademarks:
Kaspersky™ Anti-Virus ® is registered trademark of Kaspersky Lab ZAO.

Original file name:
TDSSKiller.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\tdsskiller.exe

Digital Signature
Signed by:
Kaspersky Lab

Authority:
DigiCert Inc

Valid from:
2/21/2013 5:00:00 PM

Valid to:
4/28/2015 6:00:00 AM

Subject:
CN=Kaspersky Lab, O=Kaspersky Lab, L=Moscow, C=RU

Issuer:
CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0226E6BDA76DAE711E3DB2321E3B5308

File PE Metadata
Compilation timestamp:
10/15/2013 5:36:04 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:1e6VlMkp6HgnSZM2+ju60jGU0GcTBoRdbzVSmVtLBFooWkGF5M/U:1e6VIHgnSZl+jtG03oRBVSmVtLToo0f

Entry address:
0x8613E0

Entry point:
50, 9C, 60, E8, 0C, 01, 00, 00, 01, 00, 00, 00, 00, 00, 40, 00, 00, 00, 00, 00, E0, 13, 86, 00, 51, 52, 3E, 00, 4C, 13, 86, 00, 91, 00, 00, 00, 98, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, C0, A4, 85, 00, 48, 01, 86, 00, CC, 04, 86, 00, 0C, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 10, 46, 00, 51, 52, 3E, 00, 00, 98, 3F, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.9979  (probably packed)

Code size:
4 MB (4,169,728 bytes)

The file TDSSKiller.exe has been seen being distributed by the following 3 URLs.

http://support.kaspersky.com/downloads/.../tdsskiller.exe

http://media.kaspersky.com/utilities/VirusUtilities/.../tdsskiller.exe

http://media.kaspersky.com/utilities/VirusUtilities/.../tdsskiller.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.