home

totalcmd.exe

Total Commander

Ghisler Software GmbH

The executable totalcmd.exe, “Total Commander 32 bit” has been detected as malware by 13 anti-virus scanners.
Publisher:
Ghisler Software GmbH  (signed and verified)

Product:
Total Commander

Description:
Total Commander 32 bit

Version:
7.50a

MD5:
976c54f322876a22828122e87d285f54

SHA-1:
3d954d78d5d1e7b2d2a6ecfbdbce603c6eaf8356

SHA-256:
187fee211f531f5af991b5a03c153631f638b00e7f2410c050ef389332317ebf

Scanner detections:
13 / 68

Status:
Malware

Analysis date:
4/26/2024 4:35:51 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Mabezat [Wrm]
160204-3

AVG
Win32/Mabezat
2015.0.4477

Dr.Web
Win32.HLLW.Tazebama
9.0.1.05190

Emsisoft Anti-Malware
Win32.Worm.Mabezat.Gen
10.0.0.5366

ESET NOD32
Win32/Mabezat.A virus
7.0.302.0

F-Prot
W32/Mabezat.A-1
4.6.5.141

F-Secure
Win32.Worm.Mabezat.Gen
5.15.21

Kaspersky
Worm.Win32.Mabezat
15.0.0.562

McAfee
Virus.W32/Mabezat.a
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.5484.0

Norman
Win32.Worm.Mabezat.Gen
03.02.2016 07:38:05

Sophos
Virus 'W32/Mabezat-B'
5.23

VIPRE Antivirus
Threat.303962
46992

File size:
3.5 MB (3,682,927 bytes)

Product version:
7.50a

Copyright:
Copyright © 1993-2009 Christian Ghisler

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Ghisler Software GmbH

Authority:
The USERTRUST Network

Valid from:
8/26/2009 4:00:00 AM

Valid to:
8/27/2010 3:59:59 AM

Subject:
CN=Ghisler Software GmbH, O=Ghisler Software GmbH, STREET=Huehnerbuehlstr. 45, L=Bolligen, S=BE, PostalCode=3065, C=CH

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
37A0B91E847470CFEBB8C5A4FB26561B

File PE Metadata
Compilation timestamp:
6/20/1992 2:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:Mh42NossEWIdB8TyvhD2jDqVTJ7joq3wZ6xsfioYpd2S:MhdXbWIMTyvhD2jDqVTTm6xsaP

Entry address:
0x29ED74

Entry point:
BB, 6C, E6, 69, 00, FF, E3, 00, 57, 33, C0, 89, 45, F0, 89, 45, EC, E8, C2, 47, D6, FF, E8, FD, 63, D6, FF, E8, 24, AE, D6, FF, E8, 63, 26, D7, FF, E8, D2, 36, D7, FF, E8, 25, C4, D7, FF, E8, 64, E6, D7, FF, E8, 5F, 18, D8, FF, E8, 96, 36, D8, FF, E8, C9, BF, D8, FF, E8, 74, C6, D8, FF, E8, 87, 92, DA, FF, E8, F6, 58, DB, FF, E8, ED, D6, DB, FF, E8, 94, 8B, DC, FF, E8, 63, 9B, DC, FF, E8, 2A, DF, DC, FF, E8, 79, E6, DC, FF, E8, 70, EB, DC, FF, E8, 8F, 5A, DD, FF, E8, 42, B7, DD, FF, E8, 59, 2C, DE, FF, E8...
 
[+]

Code size:
2.6 MB (2,745,344 bytes)

Remove totalcmd.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.