home

ت.exe

Baidu Inc

The executable ت.exe, “Baidu pc faster 4,0,0,59886 Installation ” has been detected as malware by 30 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from download1521.mediafire.com.
Publisher:
Baidu Inc

Description:
Baidu pc faster 4,0,0,59886 Installation

Version:
4,0,0,59886

MD5:
1459318ea4ba33e7d62a9e270b723935

SHA-1:
fa7e6c0ab3ad7602e158a1d302bae6e7b377e2ca

SHA-256:
d41ae7d5f836aeb31fc3b62cb700e9d31999e3240d41d06b3b34983725ab16f2

Scanner detections:
30 / 68

Status:
Malware

Analysis date:
12/26/2024 5:44:42 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Agent.BCMH
187

Agnitum Outpost
Trojan.DR.Agent
7.1.1

Avira AntiVirus
TR/Dldr.Bladabindi.D.11
7.11.212.246

avast!
MSIL:Dropper-ABV [Drp]
2014.9-160801

AVG
MSIL2
2017.0.2665

Baidu Antivirus
Trojan.Win32.Dropper
4.0.3.1681

Bitdefender
Trojan.Agent.BCMH
1.0.20.1070

Comodo Security
UnclassifiedMalware
21248

Dr.Web
Trojan.DownLoader11.4044
9.0.1.0214

Emsisoft Anti-Malware
Trojan.Agent.BCMH
8.16.08.01.12

ESET NOD32
MSIL/Injector.DEX (variant)
10.11249

Fortinet FortiGate
W32/Agent.DEX!tr
8/1/2016

F-Secure
Trojan.Agent.BCMH
11.2016-01-08_2

G Data
Trojan.Agent.BCMH
16.8.25

IKARUS anti.virus
Trojan.Inject
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.1915120

Kaspersky
Trojan-Dropper.Win32.Agent
14.0.0.-180

McAfee
Artemis!1459318EA4BA
5600.6321

Microsoft Security Essentials
TrojanDownloader:MSIL/Bladabindi.D
1.1.11400.0

MicroWorld eScan
Trojan.Agent.BCMH
17.0.0.642

NANO AntiVirus
Trojan.Win32.DownLoader11.dcmmax
0.30.0.296

Norman
Agent.BEFHC
11.20160801

nProtect
Trojan.Agent.BCMH
15.02.27.01

Panda Antivirus
Trj/CI.A
16.08.01.12

Qihoo 360 Security
Win32/Trojan.6fa
1.0.0.1015

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_GEN.R0CBC0DGR14
7.2.214

Trend Micro
TROJ_GEN.R0CBC0DGR14
10.465.01

Vba32 AntiVirus
TrojanDropper.Agent
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
38010

File size:
1.1 MB (1,117,849 bytes)

Copyright:
Baidu Inc

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\ت.exe

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:LAT8QE+kf4zJQRVfRrXfY8Fug2/qaHImXLTaHGOrANZn2d54d8pCYih+06Lt:LAI+07SLomXaH7kNwf6q1q+p

Entry address:
0x25468

Entry point:
55, 8B, EC, 83, C4, F0, B8, 88, 53, 42, 00, E8, 24, F2, FD, FF, B8, C8, 54, 42, 00, E8, 2A, 1C, FE, FF, 8B, 15, 40, 88, 42, 00, 89, 02, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, 48, 88, 42, 00, E8, E4, D3, FF, FF, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, DC, 87, 42, 00, E8, 7A, 64, FF, FF, A1, 40, 88, 42, 00, E8, AC, 4E, FE, FF, E8, DF, E0, FD, FF, 00, 00, 00, FF, FF, FF, FF, 01, 00, 00, 00, 2A, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.8537

Developed / compiled with:
Microsoft Visual C++

Code size:
145.5 KB (148,992 bytes)

The file ت.exe has been seen being distributed by the following URL.

http://download1521.mediafire.com/u3qdcmzuw7fg/.../?.exe

Remove ت.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.