home

e3b54315a6f29c3f9f34c0b81b742590.pe

Microsoft Windows 2000 Operating System

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The file e3b54315a6f29c3f9f34c0b81b742590.pe, “Microsoft (R) Windows Explorer” has been detected as malware by 39 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft(R) Windows(R) 2000 Operating System

Description:
Microsoft (R) Windows Explorer

Version:
5.50.4134.100

MD5:
e3b54315a6f29c3f9f34c0b81b742590

SHA-1:
a54e2fb60399d18dc662e66e4f998a6e9ea691ca

SHA-256:
ec5e8e649dcc2058c1de7baa8b2619bdb10d666fd7f006016a38dffdd9671a9a

Scanner detections:
39 / 68

Status:
Malware

Analysis date:
4/24/2024 1:53:26 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Worm.Generic.557195
658

Agnitum Outpost
Worm.Agent
7.1.1

AhnLab V3 Security
Trojan/Win32.Gen
2015.04.09

avast!
Win32:GenMalicious-HDP [Trj]
2014.9-150418

AVG
SHeur4
2016.0.3136

Baidu Antivirus
Worm.Win32.Kedebe
4.0.3.15418

Bitdefender
Worm.Generic.557195
1.0.20.540

Bkav FE
W32.HfsIemusi
1.3.0.6379

Clam AntiVirus
Trojan.Mybot-12000
0.98/21511

Comodo Security
TrojWare.Win32.Cosmu.NJC
21697

Dr.Web
Trojan.Click2.53073
9.0.1.0108

Emsisoft Anti-Malware
Worm.Generic.557195
8.15.04.18.08

ESET NOD32
Win32/Agent.NJC (variant)
9.11445

Fortinet FortiGate
W32/Agent.NJC!tr
4/18/2015

F-Prot
W32/Busky.B.gen
v6.4.7.1.166

F-Secure
Worm.Generic.557195
11.2015-18-04_7

G Data
Worm.Generic.557195
15.4.25

IKARUS anti.virus
Trojan.Win32.Sisron
t3scan.1.8.9.0

K7 AntiVirus
Trojan
13.202.15530

Kaspersky
Worm.Win32.Kedebe
14.0.0.2173

Malwarebytes
Backdoor.Agent
v2015.04.18.08

McAfee
Downloader-FCK
5600.6792

Microsoft Security Essentials
Trojan:Win32/Phishbank.A
1.1.11502.0

MicroWorld eScan
Worm.Generic.557195
16.0.0.324

NANO AntiVirus
Trojan.Win32.Drill.dqaaor
0.30.10.952

Norman
Obfuscated_O
11.20150418

nProtect
Worm.Generic.557195
15.04.07.01

Panda Antivirus
Trj/Genetic.gen
15.04.18.08

Qihoo 360 Security
HEUR/QVM07.1.Malware.Gen
1.0.0.1015

Quick Heal
Troja.PhishBank.A3
4.15.14.00

Rising Antivirus
PE:Trojan.Agent!1.9D2A
23.00.65.15416

Sophos
Troj/Dloadr-DSZ
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-FraudSoft
9928

Total Defense
Win32/Tnega.PKPFODB
37.0.11539

Trend Micro House Call
TROJ_COSMU.SMJ0
7.2.108

Trend Micro
TROJ_PHISHBANK.BMC
10.465.18

Vba32 AntiVirus
Worm.Kedebe
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
39184

Zillya! Antivirus
Worm.Agent.Win32.6812
2.0.0.2132

File size:
53.3 KB (54,620 bytes)

Product version:
5.50.4134.100

Copyright:
Copyright (C) Microsoft Corp. 1981-2000

Original file name:
servicess.exe

Language:
Russian (Russia)

Common path:
C:\users\{user}\downloads\e3b54315a6f29c3f9f34c0b81b742590.pe

File PE Metadata
Compilation timestamp:
10/2/2012 3:05:07 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:BNxUYW+73uSpWose/m2LzMyOTNd9BdqC+Yd:xUYW+qDosefcTTD9BMkd

Entry address:
0xA41F

Entry point:
55, 8B, EC, 6A, FF, 68, D8, 26, 40, 00, 68, A0, A5, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, E8, 10, 40, 00, 59, 83, 0D, 08, D9, E6, 04, FF, 83, 0D, 0C, D9, E6, 04, FF, FF, 15, EC, 10, 40, 00, 8B, 0D, E8, A5, 40, 00, 89, 08, FF, 15, F0, 10, 40, 00, 8B, 0D, E4, A5, 40, 00, 89, 08, A1, F4, 10, 40, 00, 8B, 00, A3, 04, D9, E6, 04, E8, 11, 01, 00, 00, 39, 1D, F0, 67, 40, 00, 75, 0C, 68, 9C, A5, 40, 00, FF, 15, F8, 10...
 
[+]

Entropy:
6.7557

Developed / compiled with:
Microsoft Visual C++ v6.0

Remove e3b54315a6f29c3f9f34c0b81b742590.pe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.