home

teacher.exe

Teacher Application

LanSchool Technologies, llc

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Teacher’.
Publisher:
LanSchool Technologies, llc  (signed and verified)

Product:
Teacher Application

Description:
Teacher Application

Version:
7,5,0,10

MD5:
3690d52b24fc63460fd8191281de1e56

SHA-1:
2b2d28fd3b78f92978df0a568597cba90b7ebf2c

SHA-256:
4bc13754751849eabe3017bc47da661886fa8426d2b400f89eb9528932b9da5b

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
4/26/2024 2:12:47 AM UTC  (today)

Scan engine
Detection
Engine version

Norman
Malware
11.20160211

Trend Micro House Call
Suspicious_GEN.F47V1107
7.2.42

File size:
2.6 MB (2,745,648 bytes)

Product version:
7,5,0,10

Copyright:
Copyright (c) 2002-2010, LanSchool Technologies, llc

Original file name:
teacher.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\lanschool\teacher.exe

Digital Signature
Signed by:
LanSchool Technologies, llc

Authority:
VeriSign, Inc.

Valid from:
11/19/2007 5:00:00 PM

Valid to:
1/18/2011 4:59:59 PM

Subject:
CN="LanSchool Technologies, llc", OU=main, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="LanSchool Technologies, llc", L=Orem, S=Utah, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
010617E3D711761162551A7D396E4E43

File PE Metadata
Compilation timestamp:
10/25/2010 11:03:34 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:zhmV16gn+5I558q5nZSRomg149eTuUC50hR/mSU56aZu2:8Dn+5k5m4G9eTuUC50hR/mSU56aZu2

Entry address:
0x92866

Entry point:
E8, 9B, D0, 00, 00, E9, 16, FE, FF, FF, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 24, 23, 4E, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 24, 23, 4E, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B...
 
[+]

Entropy:
6.2582

Code size:
772 KB (790,528 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Teacher

Command:
C:\Program Files\lanschool\teacher.exe


Scan teacher.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.