home

d81a0bdeaf96646c97125c45c1b15970.pe

Microsoft DirectPlay Voice Test

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The file d81a0bdeaf96646c97125c45c1b15970.pe, “Microsoft DirectPlay Voice Test” has been detected as malware by 34 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft® Windows® Operating System

Description:
Microsoft DirectPlay Voice Test

Version:
5.03.2600.5512 (xpsp.080413-0845)

MD5:
d81a0bdeaf96646c97125c45c1b15970

SHA-1:
3213bbc02580bff3bde311f8c6690a82324724d0

SHA-256:
9991b4c11fe37d4b91fd85b9d65b37bfa03e0ccc82aa74d1310790c33c105ab6

Scanner detections:
34 / 68

Status:
Malware

Analysis date:
4/25/2024 1:21:12 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Lecky.A
658

Agnitum Outpost
Win32.Kelly.A
7.1.1

AhnLab V3 Security
Win32/Elly
2014.09.18

Avira AntiVirus
W32/Kelly
7.11.172.254

avast!
Win32:Kelly-A
2014.9-150418

AVG
Win32/Kelly.A
2016.0.3136

Bitdefender
Win32.Lecky.A
1.0.20.540

Clam AntiVirus
W32.Elly
0.98/21411

Comodo Security
Virus.Win32.Elly.A
19542

Dr.Web
Win32.Kelly.23998
9.0.1.0108

Emsisoft Anti-Malware
Win32.Lecky
8.15.04.18.08

ESET NOD32
Win32/Elly
9.10431

Fortinet FortiGate
W32/Elly.A
4/18/2015

F-Prot
W32/Elly.A
v6.4.7.1.166

F-Secure
Win32.Lecky.A
11.2015-18-04_7

G Data
Win32.Lecky
15.4.24

IKARUS anti.virus
Virus.Win32.Elly
t3scan.1.7.8.0

Kaspersky
Virus.Win32.Elly
14.0.0.2173

McAfee
W32/Elly
5600.6792

Microsoft Security Essentials
Virus:Win32/Elly.A
1.11005

MicroWorld eScan
Win32.Lecky.A
16.0.0.324

NANO AntiVirus
Virus.Win32.Elly.fmya
0.28.2.62151

Norman
Elly.F
11.20150418

nProtect
Win32.Lecky.A
14.09.17.01

Panda Antivirus
W32/YlleK.A
15.04.18.08

Qihoo 360 Security
Virus.Win32.Kelly.A
1.0.0.1015

Quick Heal
W32.Elly.A
4.15.14.00

Rising Antivirus
PE:Win32.Kelly!198427
23.00.65.15416

Sophos
W32/Elly-B
4.98

Trend Micro House Call
PE_KELLY.A
7.2.108

Trend Micro
PE_KELLY.A
10.465.18

Vba32 AntiVirus
Virus.Win32.Kelly
3.12.26.3

VIPRE Antivirus
Virus.Win32.Elly.a
33198

Zillya! Antivirus
Virus.Elly.Win32.1
2.0.0.1926

File size:
105 KB (107,520 bytes)

Product version:
5.03.2600.5512

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
dpvsetup.exe

Language:
English (United States)

Common path:
C:\users\{user}\downloads\d81a0bdeaf96646c97125c45c1b15970.pe

File PE Metadata
Compilation timestamp:
4/13/2008 11:33:17 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
3072:fWGKMrz0w6UclGqnTBIVNhci62Ps4VLJY:Fvr3c4kTgn/PP

Entry address:
0x17000

Entry point:
8B, 44, 24, 08, 57, 56, 55, 8B, EC, 81, EC, E4, 00, 00, 00, 89, 45, B8, 83, 65, F4, 00, 80, 65, 93, 00, 83, 65, 9C, 00, 83, 65, B4, 00, 83, 65, 84, 00, 83, A5, 6C, FF, FF, FF, 00, 83, A5, 70, FF, FF, FF, 00, 83, A5, 74, FF, FF, FF, 00, 83, 65, FC, 00, 83, 65, 88, 00, 83, 65, CC, 00, 83, 65, A0, 00, 83, 65, C0, 00, 83, 65, D0, 00, E8, D1, 53, 00, 00, 2D, E4, 12, 40, 00, 05, 8C, 12, 40, 00, 89, 45, C4, B8, 4B, 70, 40, 00, 2D, 8C, 12, 40, 00, 89, 45, C8, B8, 4F, 6B, 40, 00, E8, B1, 53, 00, 00, 8B, 00, 89, 45...
 
[+]

Entropy:
6.2120

Code size:
73 KB (74,752 bytes)

Remove d81a0bdeaf96646c97125c45c1b15970.pe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.