home

f678e59d4004e3c53d33ee25a84db6f0.pe

Microsoft Windows 2000 Operating System

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The file f678e59d4004e3c53d33ee25a84db6f0.pe, “Microsoft (R) Windows Explorer” has been detected as malware by 42 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft(R) Windows(R) 2000 Operating System

Description:
Microsoft (R) Windows Explorer

Version:
5.50.4134.100

MD5:
f678e59d4004e3c53d33ee25a84db6f0

SHA-1:
59eb571fd5f40843827dba76587eebd8f3880b9c

SHA-256:
ae69bb331e1bf51c16c1d23b9bcc7288c8f25aad0d0b3c729ce2188c9d2bafdf

Scanner detections:
42 / 68

Status:
Malware

Analysis date:
4/19/2024 9:17:14 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Worm.Generic.557195
658

Agnitum Outpost
Worm.Agent
7.1.1

AhnLab V3 Security
Trojan/Win32.Gen
2015.04.09

Avira AntiVirus
TR/Downloader.Gen
3.6.1.96

avast!
Win32:GenMalicious-HDP [Trj]
2014.9-150418

AVG
SHeur4
2016.0.3136

Baidu Antivirus
Worm.Win32.Kedebe
4.0.3.15418

Bitdefender
Worm.Generic.557195
1.0.20.540

Bkav FE
W32.HfsIemusi
1.3.0.6379

Clam AntiVirus
Trojan.Mybot-12000
0.98/21511

Comodo Security
TrojWare.Win32.Cosmu.NJC
21697

Dr.Web
Trojan.Click2.53073
9.0.1.0108

Emsisoft Anti-Malware
Worm.Generic.557195
8.15.04.18.09

ESET NOD32
Win32/Agent.NJC (variant)
9.11445

Fortinet FortiGate
W32/Agent.NJC!tr
4/18/2015

F-Prot
W32/Busky.B.gen
v6.4.7.1.166

F-Secure
Worm.Generic.557195
11.2015-18-04_7

G Data
Worm.Generic.557195
15.4.25

herdProtect (fuzzy)
variant of virussign.com_18fb6867fe0e63f15d20c4a82bfb8790.vir
2015.7.19.21

IKARUS anti.virus
Trojan.Win32.Sisron
t3scan.1.8.9.0

K7 AntiVirus
Trojan
13.202.15530

Kaspersky
Worm.Win32.Kedebe
14.0.0.2173

Malwarebytes
Backdoor.Agent
v2015.04.18.09

McAfee
Downloader-FCK
5600.6792

Microsoft Security Essentials
Trojan:Win32/Phishbank.A
1.1.11502.0

MicroWorld eScan
Worm.Generic.557195
16.0.0.324

NANO AntiVirus
Trojan.Win32.Drill.dqaaor
0.30.10.952

Norman
Obfuscated_O
11.20150418

nProtect
Worm.Generic.557195
15.04.07.01

Panda Antivirus
Trj/Genetic.gen
15.04.18.09

Qihoo 360 Security
HEUR/QVM07.1.Malware.Gen
1.0.0.1015

Quick Heal
Troja.PhishBank.A3
4.15.14.00

Rising Antivirus
PE:Trojan.Agent!1.9D2A
23.00.65.15416

Sophos
Troj/Dloadr-DSZ
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-FraudSoft
9928

Total Defense
Win32/Tnega.PKPFODB
37.0.11539

Trend Micro House Call
TROJ_COSMU.SMJ0
7.2.108

Trend Micro
TROJ_PHISHBANK.BMC
10.465.18

Vba32 AntiVirus
Worm.Kedebe
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Agent.njc
39184

ViRobot
Trojan.Win32.Agent.64520[h]
2014.3.20.0

Zillya! Antivirus
Worm.Agent.Win32.6812
2.0.0.2132

File size:
71.5 KB (73,180 bytes)

Product version:
5.50.4134.100

Copyright:
Copyright (C) Microsoft Corp. 1981-2000

Original file name:
servicess.exe

Language:
Russian (Russia)

Common path:
C:\users\{user}\downloads\f678e59d4004e3c53d33ee25a84db6f0.pe

File PE Metadata
Compilation timestamp:
10/2/2012 3:05:07 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:BNxUYW+73uSpWose/m2LzMyOTybynhpppj:xUYW+qDosefcTTd

Entry address:
0xA41F

Entry point:
55, 8B, EC, 6A, FF, 68, D8, 26, 40, 00, 68, A0, A5, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, E8, 10, 40, 00, 59, 83, 0D, 08, D9, E6, 04, FF, 83, 0D, 0C, D9, E6, 04, FF, FF, 15, EC, 10, 40, 00, 8B, 0D, E8, A5, 40, 00, 89, 08, FF, 15, F0, 10, 40, 00, 8B, 0D, E4, A5, 40, 00, 89, 08, A1, F4, 10, 40, 00, 8B, 00, A3, 04, D9, E6, 04, E8, 11, 01, 00, 00, 39, 1D, F0, 67, 40, 00, 75, 0C, 68, 9C, A5, 40, 00, FF, 15, F8, 10...
 
[+]

Entropy:
6.8620

Developed / compiled with:
Microsoft Visual C++ v6.0

Remove f678e59d4004e3c53d33ee25a84db6f0.pe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.