home

tsatmim.exe

台新網路ATM即時通

InfoThink Technology CO., LTD.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘tsatmim’.
Publisher:
InfoThink Technology CO., LTD.  (signed and verified)

Product:
台新網路ATM即時通

Version:
3, 0, 0, 0

MD5:
fe7ae7c6ad78c42946d76cc31fd6cd26

SHA-1:
1745100e125bc8cf9b190a1f4b603b1d77e4b182

SHA-256:
555d1ee6a0cff44947b4c38a1b063fb7abf4b335fcd420c018396c3abf40b867

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 5:47:22 AM UTC  (today)

File size:
1.1 MB (1,113,000 bytes)

Product version:
3, 0, 0, 0

Copyright:
Copyright (c) InfoThink. 2003 - 2008

Original file name:
tsatmim.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\taishin\atmmessenger\tsatmim.exe

Digital Signature
Signed by:
InfoThink Technology CO., LTD.

Authority:
The USERTRUST Network

Valid from:
4/9/2008 8:00:00 AM

Valid to:
4/10/2010 7:59:59 AM

Subject:
CN="InfoThink Technology CO., LTD.", OU=I-TRAVEL, O="InfoThink Technology CO., LTD.", STREET="2F., No.508, Sec. 5, Zhongxiao E. Rd., Xinyi District, Taipei City 11083, Taiwan(R.O.C.)", L=TAIPEI, S=N/A, PostalCode=11083, C=TW

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
00BA911C76C69A639A52A544D895669E90

File PE Metadata
Compilation timestamp:
8/6/2008 3:45:14 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:PDNRPnZ5DYvXIT/pM1nMlDw2Ck2QUaf2J7p:DZ+v1MlD7B2hh/

Entry address:
0x7361F

Entry point:
E8, 4B, C5, 00, 00, E9, 16, FE, FF, FF, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, BC, 70, 4B, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, BC, 70, 4B, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B...
 
[+]

Entropy:
6.8358

Code size:
584 KB (598,016 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
tsatmim

Command:
C:\Program Files\taishin\atmmessenger\tsatmim.exe


Scan tsatmim.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.