home

tmp1b9d.exe

Microsoft Office Help Viewer

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The executable tmp1b9d.exe has been detected as malware by 22 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft Office Help Viewer

Version:
12.0.6606.1000

MD5:
58b4f98f36ca092351d0db6cde2234c7

SHA-1:
e01e2d5500504105638a4433324480afc9088b3b

SHA-256:
2c4a628b39f5a4aac2a0fb2c7e1e591b8abb41a31c39ee36e80c81ce30d0e8b7

Scanner detections:
22 / 68

Status:
Malware

Analysis date:
4/25/2024 4:18:42 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.453229
856

AhnLab V3 Security
Trojan/Win32.Miuref
2014.09.17

Avira AntiVirus
TR/Kazy.453229
7.11.172.232

avast!
Win32:Malware-gen
2014.9-141002

AVG
Crypt_s
2015.0.3334

Bitdefender
Gen:Variant.Kazy.453229
1.0.20.1375

Dr.Web
Trojan.Siggen6.23087
9.0.1.0275

Emsisoft Anti-Malware
Gen:Variant.Kazy.453229
8.14.10.02.04

ESET NOD32
Win32/Boaxxe.BR
8.10430

Fortinet FortiGate
W32/Yakes.BR!tr
10/2/2014

F-Secure
Gen:Variant.Kazy.453229
11.2014-02-10_5

G Data
Gen:Variant.Kazy.453229
14.10.24

Kaspersky
Trojan.Win32.Yakes
14.0.0.3164

Malwarebytes
Trojan.FakeMS.ED
v2014.10.02.04

McAfee
Packed-CH!58B4F98F36CA
5600.6990

Microsoft Security Essentials
Trojan:Win32/Miuref.F
1.11005

MicroWorld eScan
Gen:Variant.Kazy.453229
15.0.0.825

NANO AntiVirus
Trojan.Win32.Yakes.deytfy
0.28.2.62151

Qihoo 360 Security
Win32/Trojan.ee8
1.0.0.1015

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_GEN.R011C0DIG14
7.2.275

Trend Micro
TROJ_GEN.R011C0DIG14
10.465.02

File size:
140 KB (143,360 bytes)

Product version:
12.0.6606.1000

Copyright:
© 2006 Microsoft Corporation. All rights reserved.

Original file name:
clview.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\ProgramData\application data\microsoft\crypto\rsa64\temp\tmp1b9d.exe

File PE Metadata
Compilation timestamp:
11/1/2014 7:30:34 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:Xg/NRda4+V7P8EJXoPjSIE0+/MIUuAv+:Q/NR8JVD8EcM0+/B

Entry address:
0x1270

Entry point:
55, 8B, EC, 83, EC, 08, 6A, 01, FF, 15, C0, 81, 41, 00, 6A, 01, FF, 15, C4, 81, 41, 00, A1, F4, CC, 41, 00, 50, FF, 15, C8, 81, 41, 00, 8B, 0D, F4, CC, 41, 00, 69, C9, D7, 01, 00, 00, 89, 0D, F4, CC, 41, 00, 68, D7, 10, 00, 00, 6A, 00, FF, 15, D0, 81, 41, 00, 85, C0, 74, 07, 33, C0, E9, 5F, 02, 00, 00, 8B, 15, F4, CC, 41, 00, 81, EA, 7A, 01, 00, 00, 89, 15, F4, CC, 41, 00, A1, F4, CC, 41, 00, 05, 90, 0C, 00, 00, A3, F4, CC, 41, 00, 8B, 0D, F4, CC, 41, 00, 81, C1, 1A, 0C, 00, 00, 89, 0D, F4, CC, 41, 00, 8B...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
88.5 KB (90,624 bytes)

Remove tmp1b9d.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.