home

WEXTRACT.EXE

Système d'exploitation Microsoft Windows

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The file WEXTRACT.EXE , “Auto-extracteur de fichier CAB Win32” has been detected as a potentially unwanted program by 6 anti-malware scanners. The file has been seen being downloaded from jeux.cartes.free.fr.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Système d'exploitation Microsoft® Windows®

Description:
Auto-extracteur de fichier CAB Win32

Version:
6.00.2900.5512 (xpsp.080413-2105)

MD5:
5d515a051a2447baccd28e9d1f22b6ec

SHA-1:
5f3d418c79fd7fca26eca3f0dad048e80804a502

SHA-256:
7203c609202afd4c427b343896b35882f3065e31a2f44467a56d942cc199ce73

Scanner detections:
6 / 68

Status:
Potentially unwanted

Analysis date:
4/19/2024 9:18:44 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:PUP-gen [PUP]
2014.9-130829

Baidu Antivirus
HackTool.Win32.Blat
4.0.3.131127

Bkav FE
W32.Clod2bb.Trojan
1.3.0.4613

Kaspersky
not-a-virus:Client-SMTP.Win32.Blat
14.0.0.3808

Sophos
Generic PUA FP
4.96

Trend Micro House Call
TROJ_GEN.F47V0801
7.2.241

File size:
3.1 MB (3,261,440 bytes)

Product version:
6.00.2900.5512

Copyright:
© Microsoft Corporation. Tous droits réservés.

Original file name:
WEXTRACT.EXE

Language:
French (France)

Common path:
C:\users\{user}\downloads\wextract.exe

File PE Metadata
Compilation timestamp:
4/13/2008 11:32:45 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
98304:0RXN2c6ZFM4T2G3sqJDe0ZEE/cL/flX6F5kBAhsg+jpE:FZFLT2qLJesEE/gflkk+s5e

Entry address:
0x645C

Entry point:
E8, 0A, 00, 00, 00, E9, 7A, FF, FF, FF, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, D0, B2, 00, 01, 85, C0, 74, 07, 3D, 40, BB, 00, 00, 75, 4D, 56, 8D, 45, F8, 50, FF, 15, 70, 11, 00, 01, 8B, 75, FC, 33, 75, F8, FF, 15, 6C, 11, 00, 01, 33, F0, FF, 15, 68, 11, 00, 01, 33, F0, FF, 15, 64, 11, 00, 01, 33, F0, 8D, 45, F0, 50, FF, 15, 60, 11, 00, 01, 8B, 45, F4, 33, 45, F0, 33, C6, 25, FF, FF, 00, 00, 5E, 75, 05, B8, 40, BB, 00, 00, A3, D0, B2, 00, 01, F7, D0, A3, CC, B2, 00, 01, C9, C3, CC, CC, CC...
 
[+]

Entropy:
7.9944  (probably packed)

Code size:
38.5 KB (39,424 bytes)

The file WEXTRACT.EXE has been seen being distributed by the following URL.

http://jeux.cartes.free.fr/.../post-net.install.exe

Remove WEXTRACT.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.