home

0qvdfl1btsq==1.exe

Yu Bao

The executable 0qvdfl1btsq==1.exe has been detected as malware by 1 anti-virus scanner.
Publisher:
Yu Bao  (signed and verified)

Version:
20151222154748

MD5:
0d8cd5616bd5ceb6d887e33659cce2f3

SHA-1:
9042c3f1d41a0063f79d02f458a485c3218afccb

SHA-256:
bb5f04f61d1dfcf4eeb46f65a419427521ee68adfdbe355dc254c3245e901360

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
12/24/2024 12:45:10 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
16.9.3.17

File size:
2.5 MB (2,599,096 bytes)

Product version:
20151222154748

Copyright:
Copyright 2015 Rafotech. All rights reserved

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\0qvdfl1btsq==1.exe

Digital Signature
Signed by:
Yu Bao

Authority:
thawte, Inc.

Valid from:
10/21/2015 3:00:00 AM

Valid to:
10/21/2016 2:59:59 AM

Subject:
CN=Yu Bao, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
17C6AE891D357C16ADC447794EA40FC5

File PE Metadata
Compilation timestamp:
12/22/2015 10:48:10 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
24576:OttY7S6xo/qjhiqCAxbNjBPErkAmqZQBNJcp43frMbx2WD:I2RMqgqCyrHJcp43f4bx2W

Entry address:
0xB069D

Entry point:
60, 81, FA, 5F, 34, 00, 00, 75, 05, 0F, BE, F0, 86, D2, 68, 38, 6E, 79, 00, 84, E3, 3B, CF, F6, C7, 84, 87, C2, 2B, FD, 12, D2, 1A, F6, 0F, AF, C1, FE, CC, F6, C2, 48, 81, E6, AD, DC, 84, CC, F3, 50, C6, C7, BF, 87, C7, 85, D8, 5A, 8A, FC, 3D, 21, 19, 32, C4, 40, 33, CA, 8D, 05, FB, F9, 80, 92, B5, C5, F2, 14, BE, 51, 53, 3C, FF, 88, F0, 8A, DA, 2D, 61, 1B, 20, DD, F3, BA, 09, 00, 00, 00, 85, FA, 69, D2, 7D, 01, 00, 00, 81, FB, CB, 8E, 00, 00, 78, 08, FF, C6, 0F, AF, F3, F6, C5, 2C, 89, C6, 69, E9, D2, 55...
 
[+]

Entropy:
4.4894

Code size:
1 MB (1,077,760 bytes)

Remove 0qvdfl1btsq==1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.