home

自動刷肥v1.635.exe

QMacro

fuzhou tian xia chuang shi digital Co.,Ltd

The executable 自動刷肥v1.635.exe, “QMacro's macro runner.” has been detected as malware by 8 anti-virus scanners.
Publisher:
vrBrothers Corporation.   (signed by fuzhou tian xia chuang shi digital Co.,Ltd)

Product:
QMacro

Description:
QMacro's macro runner.

Version:
9, 5, 0, 11671

MD5:
16bd47cc145e3d5c86a3fe6a0b40d21c

SHA-1:
53e85827fc49b82a8994c5b826cc29d8b8f2b399

SHA-256:
e67872af4a4682305859a7dc685f634b6077dcd62f8d7d6cf4960dc1a8675f0c

Scanner detections:
8 / 68

Status:
Malware

Analysis date:
4/23/2024 10:33:32 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Packed
7.1.1

AVG
Generic32
2017.0.2538

Dr.Web
Trojan.Packed.728
9.0.1.0340

McAfee
Artemis!16BD47CC145E
5600.6194

Norman
Smalltroj.ABDHX
11.20161205

Trend Micro House Call
TROJ_GEN.R0C1C0OAC15
7.2.340

Trend Micro
TROJ_GEN.R0C1C0OAC15
10.465.05

VIPRE Antivirus
Trojan.Win32.Generic
39106

File size:
4.6 MB (4,778,768 bytes)

Product version:
9, 5, 0, 11671

Copyright:
(C) vrBrothers Corporation. All rights reserved.

Original file name:
mymacro.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, PRC)

Digital Signature
Signed by:
fuzhou tian xia chuang shi digital Co.,Ltd

Authority:
VeriSign, Inc.

Valid from:
4/12/2011 8:00:00 AM

Valid to:
4/12/2013 7:59:59 AM

Subject:
CN="fuzhou tian xia chuang shi digital Co.,Ltd", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="fuzhou tian xia chuang shi digital Co.,Ltd", L=fuzhou, S=fujian, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
209E746C15A85E547AFAF6A4C3277C81

File PE Metadata
Compilation timestamp:
11/19/2012 12:53:05 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:Yuxcf0ZebExAtoGBAMzrwTDkgAgJpZS1wDmIVoS1Xu/dUrZyobx:YueDgAopYr5S1Xu/djobx

Entry address:
0x2E958A

Entry point:
68, 31, 14, A4, C2, E8, A5, 35, 02, 00, 7B, 8D, 25, B9, E3, 03, 60, 68, 0D, BF, D2, 28, 41, ED, 8E, DC, 53, AD, B6, 00, 6C, E3, 2E, BC, 82, F5, 68, A1, AD, F3, 67, E7, F3, BD, D4, D5, B5, CD, 22, A6, 9F, C1, 27, F9, 6D, 45, 0B, C1, CB, 50, 23, 5C, D5, 80, 49, 21, 5F, 1E, 99, 1C, 87, 1C, 24, 4B, 50, FF, E6, 11, CC, E6, B0, 29, 51, 99, C7, 77, 53, EF, B9, 95, 23, A6, D5, 7F, 9F, 77, 43, CF, BE, 86, 69, 76, 54, BA, 27, 92, 8B, 11, 93, 02, E7, 8D, BF, 97, 75, 4C, 3A, B0, 8A, DC, D2, 8A, C0, 77, 8E, 54, 35, B1...
 
[+]

Entropy:
6.9132

Code size:
3 MB (3,194,880 bytes)

Remove 自動刷肥v1.635.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.