home

viewer.exe

The application viewer.exe has been detected as a potentially unwanted program by 19 anti-malware scanners. Accoriding to the detections, this has been classified as a kyelogger which is capable of recoring a user's keystrokes.
MD5:
ce2d9db11143902418aedc3e32cefe69

SHA-1:
61829659f781f7a41f5a750fc6936d2467483ddf

Scanner detections:
19 / 68

Status:
Potentially unwanted

Analysis date:
4/19/2024 12:36:49 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.KeyLogger
7.1.1

Avira AntiVirus
SPR/Ardamax.AB
7.11.109.96

AVG
Ardamax
2015.0.3253

Baidu Antivirus
HackTool.Win32.Monitor
4.0.3.141222

Comodo Security
UnclassifiedMalware
16821

Dr.Web
BackDoor.Xbot.1446
9.0.1.0356

ESET NOD32
Win32/KeyLogger.Ardamax.NBG (variant)
8.8726

Fortinet FortiGate
Riskware/Ardamax
12/22/2014

IKARUS anti.virus
not-a-virus:Monitor.Win32.Ardamax
t3scan.2.0.127

Kaspersky
not-a-virus:Monitor.Win32.Ardamax
14.0.0.3448

McAfee
Artemis!A87CC4FFFC74
5600.6909

NANO AntiVirus
Trojan.Win32.KeyLogger.bxmcso
0.26.0.53954

Panda Antivirus
Suspicious file
14.12.22.01

Reason Heuristics
Threat.Win.Reputation.IMP
14.12.22.1

Rising Antivirus
Trojan.Win32.Generic.14AA1B9A
23.00.65.141220

Sophos
Generic PUA GB
4.91

Trend Micro House Call
TROJ_GEN.R0CBH01H213
7.2.218

Trend Micro
TROJ_GEN.R0CBC0OJO13
10.465.22

VIPRE Antivirus
Trojan.Win32.Generic
22702

File size:
791 KB (809,984 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\Application data\xyn\viewer.exe

File PE Metadata
Compilation timestamp:
7/14/2013 1:11:31 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:vMeUlGT8WjxijRGPsdnu/y8X6aBH6+NLGXOpsZMJGGP5pWhotBkkTBT1TFniK:YlGTLjxORzk6UnNUOpsZ7sS2iK

Entry address:
0x29F1A

Entry point:
E8, EF, 82, 00, 00, E9, 79, FE, FF, FF, 6A, 0C, 68, D8, 90, 48, 00, E8, C4, 14, 00, 00, 6A, 0E, E8, 7A, 1A, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, 14, 85, 49, 00, BA, 10, 85, 49, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, EE, E4, FF, FF, 59, FF, 76, 04, E8, E5, E4, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00, E8, B3, 14, 00, 00, C3, 8B, D0, EB, C5, 6A, 0E, E8, 45, 19, 00, 00, 59, C3, CC, CC, CC, CC, CC, CC...
 
[+]

Code size:
444 KB (454,656 bytes)

Remove viewer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.