home

wm_keygen.exe

The application wm_keygen.exe has been detected as a potentially unwanted program by 16 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from s10013.chomikuj.pl.
MD5:
c896e9261bff56c2c97bbe04707114dd

SHA-1:
48b6c32a85a0b19ea31774af952c75b4dc0d590b

SHA-256:
206b8fa35295749435266fba5b12c55e887b41b041bedba17c7de92ec59150b3

Scanner detections:
16 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 7:17:21 PM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
Troj.PSW32.W.QQPass
2.1.4+

Agnitum Outpost
TrojanSpy.Rion
7.1.1

Avira AntiVirus
TR/Spy.Rion.H
7.11.171.232

AVG
PSW.Generic8
2016.0.2938

Bkav FE
W32.Clodbdb.Trojan
1.3.0.4959

Fortinet FortiGate
W32/KeyGen.A
11/1/2015

IKARUS anti.virus
not-a-virus.Keygen.Wordmax
t3scan.1.7.8.0

McAfee
Artemis!C896E9261BFF
5600.6594

Microsoft Security Essentials
HackTool:Win32/Keygen
1.10904

Norman
Suspicious_Gen2.UBAJK
11.20151101

nProtect
Trojan-Spy/W32.Rion.190976
14.09.12.01

Rising Antivirus
PE:Trojan.Win32.Generic.12A80F18!313003800
23.00.65.151030

Sophos
Mal/KeyGen-A
4.98

Trend Micro House Call
TROJ_GEN.R0CBC0REL14
7.2.305

Trend Micro
TROJ_GEN.R0CBC0REL14
10.465.01

VIPRE Antivirus
Trojan.Win32.Generic
33076

File size:
186.5 KB (190,976 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\chomikbox\tlumacz(j.niemiecki) (stani111)\wortmeister- slownik polsko- niemiecki\wortmeister dla www.se-tuning.pl\wm_keygen.exe

File PE Metadata
Compilation timestamp:
7/22/2006 5:47:31 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
3072:fG9dpHMMdW3vXy0vEKreiDEZZwtAYPw0zbwrFzJg0uI+ecSN:fG9dlEyLoeiDGwtDPw0z0RFg0uIh

Entry address:
0x807C0

Entry point:
60, BE, 00, 30, 45, 00, 8D, BE, 00, E0, FA, FF, C7, 87, 64, 78, 06, 00, 5C, CC, 08, 36, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:
184 KB (188,416 bytes)

The file wm_keygen.exe has been seen being distributed by the following URL.

http://s10013.chomikuj.pl/File.aspx?e=cuwp1Z_FAURI5C8_fP6ALbCWYo9olpscFoeODba1X2YfmSv7fBKWP5cmKrmPsvNxCj7jqxgxsy2tF9hMqUVAyhfxDesZIhZw721l6A-hIAwUl_X4gPI8c8Llkr1nhocNNE3jJkQZEvCr6a5HSAgwIw&pv=2

Remove wm_keygen.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.