» WinAuditu.exe
Overview
Analysis
File Details
Programs (1)
Downloads (7)

WinAuditu.exe

Parmavex Services WinAudit

Parmavex Services

This is a setup program which is used to install the application. This is installed with Parmavex Services WinAudit. The file has been seen being downloaded from docs.google.com and multiple other hosts.

File name:

WinAuditu.exe

Publisher:

Parmavex Services

Product:

Parmavex Services WinAudit

Description:

Parmavex WinAudit Freeware [Unicode]

Version:

2.2.9.0

MD5:

85d91e5f9b06f263ffb4b64abaa91d44

SHA-1:

44144df1fab1445f86e32a983ac676ab0f545b60

SHA-256:

7982a30474212eeae950bdf1c09c5ef600a0fbf9d940714062b75012ed002f24

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/26/2024 4:23:11 AM UTC (today)

File size:

1.1 MB (1,122,304 bytes)

Product version:

2.2.9.0

Original file name:

WinAuditu.exe

File type:

Executable application (Win32 EXE)

Language:

English (United Kingdom)

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\winauditu.exe

File PE Metadata

Compilation timestamp:

7/11/2011 12:07:40 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:vWG67j+rh4QZuIISK++5aoJ77ygWpR6bSCZnqVwL:vGerGpIMD5aoJ77ygWpR6f1

Entry address:

0x3818B0

Entry point:

60, BE, 00, 10, 68, 00, 8D, BE, 00, 00, D8, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Entropy:

7.8509

Packer / compiler:

UPX 2.90LZMA]

Code size:

1 MB (1,052,672 bytes)

The file WinAuditu.exe has been discovered within the following program.

Parmavex Services WinAudit by Parmavex Services

About 9% of users remove it

The file WinAuditu.exe has been seen being distributed by the following 7 URLs.

https://docs.google.com/uc?authuser=0&id=0BwT28n1xPexebmRmekVLQnRIM2s&export=download

https://docs.google.com/uc?authuser=1&id=0BwT28n1xPexebmRmekVLQnRIM2s&export=download

https://corel.app.box.com/index.php?rm=box_download_shared_file&shared_name=lbft4f9fzf7vbxv3xmiwj4pti7518lzn&file_id=f_30856712391

https://drive.google.com/uc?id=0BxG7oeyx-8l7anRNcXIxb0MtYTQ&export=download

https://doc-00-9o-docs.googleusercontent.com/docs/securesc/q4qe98iv5cmudeskcr9julnpg70g7k0s/81vgk2cp2k3mnr7o9ssj0q2leaft276g/1389074400000/.../13211211310851787461/0BxG7oeyx-8l7anRNcXIxb0MtYTQ?h=16653014193614665626&e=download

https://docs.google.com/nonceSigner?nonce=m2t85r36psnq8&continue=https://doc-00-9o-docs.googleusercontent.com/docs/securesc/q4qe98iv5cmudeskcr9julnpg70g7k0s/81vgk2cp2k3mnr7o9ssj0q2leaft276g/1389074400000/.../13211211310851787461/0BxG7oeyx-8l7anRNcXIxb0MtYTQ?e=download&h=16653014193614665626&hash=64hjp6vcc2ofd0a1nh1fkurppgeg2foi

Scan WinAuditu.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.