home

tsatmim.exe

台新網路ATM即時通

InfoThink Technology Co., LTD.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘tsatmim’.
Publisher:
InfoThink Technology CO., LTD.  (signed by InfoThink Technology Co., LTD.)

Product:
台新網路ATM即時通

Version:
3, 1, 2, 0

MD5:
4567299a66cb82bbfcf9da9b5f7c21d1

SHA-1:
ee3ac2c7449965b5b80ac9eb75dc2841942efefe

SHA-256:
54054f5d2daf9d1e04fd68527b502f68d899fef643e7f5c68a5a67a9a0c3dffa

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 8:51:43 AM UTC  (today)

File size:
1.1 MB (1,111,608 bytes)

Product version:
3, 1, 2, 0

Copyright:
Copyright (c) InfoThink. 2003 - 2014

Original file name:
tsatmim.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\taishin\atmmessenger\tsatmim.exe

Digital Signature
Signed by:
InfoThink Technology Co., LTD.

Authority:
COMODO CA Limited

Valid from:
3/5/2013 8:00:00 AM

Valid to:
3/5/2016 7:59:59 AM

Subject:
CN="InfoThink Technology Co., LTD.", OU=I-TRAVEL, O="InfoThink Technology Co., LTD.", STREET="7F-1., No.510, Sec. 5, Zhongxiao E. Rd., Xinyi District, Taipei City 11083, Taiwan(R.O.C.)", L=Taipei City, S=Taipei, PostalCode=11077, C=TW

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
756DA513E4C4AA0E05AACBB13CFAEB33

File PE Metadata
Compilation timestamp:
12/18/2013 6:40:09 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:wwWuwigKyaqgBoeryAVSr9BZbHX/GSfmHJOGg2QUaf2J7+:XOwqgBoeryAVSr9BZjfmHJON2hhs

Entry address:
0x7302F

Entry point:
E8, 4B, C5, 00, 00, E9, 16, FE, FF, FF, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, BC, 60, 4B, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, BC, 60, 4B, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B...
 
[+]

Entropy:
6.8485

Code size:
580 KB (593,920 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
tsatmim

Command:
C:\Program Files\taishin\atmmessenger\tsatmim.exe


Scan tsatmim.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.