home

unhttp.exe

The executable unhttp.exe has been detected as malware by 14 anti-virus scanners.
MD5:
6a1c97e4c641a988b8a98e151246ae67

SHA-1:
45c002feaa56732098b0d37046a878d1400bbf3a

SHA-256:
f6e03ba998e89a07b009d956d7184379419a004cfc8977d971f6caab9447952b

Scanner detections:
14 / 68

Status:
Malware

Analysis date:
4/19/2024 10:37:48 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.10403726
1023

Avira AntiVirus
TR/Rogue.10403726
7.11.130.78

Baidu Antivirus
Trojan.Win32.Agent
4.0.3.14418

Bitdefender
Trojan.Generic.10403726
1.0.20.540

Emsisoft Anti-Malware
Trojan.Generic.10403726
8.14.04.18.01

F-Secure
Trojan.Generic.10403726
11.2014-18-04_6

G Data
Trojan.Generic.10403726
14.4.24

Kaspersky
Trojan.Win32.Agent
14.0.0.4000

McAfee
Artemis!6A1C97E4C641
5600.7157

MicroWorld eScan
Trojan.Generic.10403726
15.0.0.324

nProtect
Trojan.Generic.10403726
14.02.09.01

Quick Heal
Trojan.Agent.adhcq
4.14.12.00

Trend Micro House Call
TROJ_GEN.R0CBOH0AG14
7.2.108

VIPRE Antivirus
Trojan.Win32.Generic
26298

File size:
45.8 KB (46,873 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Windows\System32\unhttp.exe

File PE Metadata
Compilation timestamp:
3/19/2005 6:58:24 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
768:o9qrF6FbV5v+rf2C+9ReyFJefClbu9svHtLE8JlPjZbrmn7QCEdShdj:o8rF6Fjs2Buk40uJ8JfXm7QzSt

Entry address:
0x3E6D

Entry point:
83, EC, 20, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 68, 91, 40, 00, C6, 44, 24, 14, 20, FF, 15, 28, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 68, 88, 92, 40, 00, 68, 40, 3B, 42, 00, A3, F0, 43, 42, 00, E8, AF, 27, 00, 00, BE, 00, B4, 42, 00, BF, 00, 04, 00, 00, 56, 57, FF, 15, C8, 70, 40, 00, E8, 7A, FF, FF, FF, 8B, 2D, 8C, 70, 40, 00, 85, C0, 75, 21, 68, FB, 03, 00, 00, 56, FF, 15, C4, 70, 40, 00, 68, 80, 92, 40, 00, 56, FF, D5, E8, 57, FF, FF, FF, 85, C0, 0F, 84, 47, 01, 00, 00, BE, 00, A0...
 
[+]

Entropy:
6.4455

Code size:
22.5 KB (23,040 bytes)

Startup File (All Users Run Once)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:
HTTP Monitor

Command:
unhttp.exe -remove


Remove unhttp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.