home

wormix v50.exe

The executable wormix v50.exe has been detected as malware by 10 anti-virus scanners. While running, it connects to the Internet address dev.ucoz.net on port 80 using the HTTP protocol.
Version:
1.0.0.0

MD5:
90a8b8442159a88eff4abda9e66b413c

SHA-1:
401ec39ca308377cfc19200de51ecd43f14bd442

SHA-256:
e52d63bfca604bda3e5acbf336ca89e223cc86ae4f03d8607185f1aa41a44cbc

Scanner detections:
10 / 68

Status:
Malware

Analysis date:
4/26/2024 4:47:13 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Barys.52351
281

Bitdefender
Gen:Variant.Barys.52351
1.0.20.600

Bkav FE
HW32.Packed
1.3.0.7744

Emsisoft Anti-Malware
Gen:Variant.Barys.52351
8.16.04.29.07

F-Secure
Gen:Variant.Barys.52351
11.2016-29-04_6

G Data
Gen:Variant.Barys.52351
16.4.25

IKARUS anti.virus
Trojan.Win32.Spy
t3scan.2.0.9.0

MicroWorld eScan
Gen:Variant.Barys.52351
17.0.0.360

Qihoo 360 Security
HEUR/QVM16.0.0000.Malware.Gen
1.0.0.1120

Rising Antivirus
Malware.XPACK/RDM!5.1
23.00.65.16427

File size:
2.5 MB (2,618,368 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\wormix v50.exe

File PE Metadata
Compilation timestamp:
4/26/2016 6:00:00 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:dUdXYUeHUg+W2Vyzc42YnbTl4sE1JJoISeqVunmefJdj+E0b8ugBH:Ole0Vl27nbKsEppDmuf+h83

Entry address:
0x740855

Entry point:
9C, E8, 0D, 87, EC, FF, 60, C6, 04, 24, 32, E9, F6, 12, ED, FF, 91, CA, 21, C6, BB, 50, 9C, 34, FC, 77, DF, 8B, CB, CB, 51, 0E, 48, 2E, 28, 6A, EC, 96, 86, E1, 3B, 08, 14, 57, FF, 6F, E7, 73, A9, 9E, 18, 16, 13, 18, 75, DF, 46, EE, 1F, 20, 36, 3C, D6, 4B, BD, CD, 64, 06, DC, A4, 9B, 81, D6, E0, 38, 24, 2F, B6, DE, AE, A3, 39, A2, 61, DB, F7, E8, 21, 31, C6, A5, A9, B9, D6, 68, D1, 99, A2, 14, 6C, 2E, E0, A5, DA, C3, CB, 20, 0B, 24, AF, 18, C9, 99, 43, 63, 03, AC, AE, AC, 70, D7, 77, BB, 57, C2, 8C, BE, 90...
 
[+]

Code size:
3.3 MB (3,492,864 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to dev.ucoz.net  (195.216.243.114:80)

Remove wormix v50.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.