home

6turunanfungsitrigonometri.pdf.exe

The application 6turunanfungsitrigonometri.pdf.exe has been detected as a potentially unwanted program by 4 anti-malware scanners. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. The file has been seen being downloaded from a.arthistory.work.
MD5:
ad0bd7d057a228bb92547553ddf36201

SHA-1:
6bc90f7d8f0dc259634b455a7241bddd6242093f

SHA-256:
4ce449b2308bf638bc7eae3a0fcbea1b42165e3cb47e3ebc454ec0b815f5fa03

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
11/16/2024 4:55:02 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:FakeDownload-G [PUP]
160414-2

Dr.Web
Trojan.Crossrider1.40163
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Razy.5360
11.5.0.6191

VIPRE Antivirus
Threat.5180739
29708

File size:
76.5 KB (78,360 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\6turunanfungsitrigonometri.pdf.exe

File PE Metadata
Compilation timestamp:
9/20/2012 12:12:21 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
1536:IEZPAhcwhbYe2OVa89MYB0wIPI2yQyEteKFKNJQSSCA7VWoOEk:Is9wTO7xJHDdCA7V+

Entry address:
0x64CE

Entry point:
E8, 0D, 12, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, C0, 60, 42, 00, E8, 1C, 17, 00, 00, E8, DA, 13, 00, 00, 0F, B7, F0, 6A, 02, E8, A0, 11, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, D3, 06, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.2325

Code size:
45.5 KB (46,592 bytes)

The file 6turunanfungsitrigonometri.pdf.exe has been seen being distributed by the following URL.

http://a.arthistory.work/?q=wNtbKomcO/GPkHLnikQhHxYeZ5snq 3XVziDW8FU PecD Vfy5cKjBJJkhU77VZA7UvbJRQgGR0Y0/QJh9tUwOgq5R6RKXTl1XwivGXfeGdNEd7x4qlcOWiKQGhBjJSFlch/df0Qoi23vnxU3wfYw4sv7AGPb0B30Hnrv9I/qH qhg6rz6IBt6Ent0WW8Agqlz1RbPnVE7jTcmWmnc8PJUnbtCrzbeQrz0wJ0nmp 4rpjdecOWa3f/aHD6YaVGrfnM9D0i/.../yBiIEOPo84aEb52nECmUlqwLt122MU5EgisoGWPVGOC78WG3 hAeE3I1&uuid=QfsrJs4H8P1kdl95uhUBDQHDBnBJNkDxowPzaNihqSveW7uQDBgO2ZKCqD0vNCvyYck0CPp3jSoP0TmfGzUaKOnoBPlzBkWMUhzvu7PsJRi04Gn4tDbwOAIHfMNicLV85WYj96p4lsyVrkCuZjQv47EUA5nqoy2JFLta89nL5FlkJY57o8fjC05SL8igZv2cCDvmrrX4XOycPid2qYArtBPSfSEzAmooFiNjfDFdbNugchbNIINllr61BqCR5ecq8d1mXclFTwEpsrXws53dGqON9CNFcjG1pmzs9WNLGhkfOmjsi7pTgF0wT0T91jutfhnEbSDAHyXQb9Ao7wFHc7CMeI2XBN6rkUY1qwQ5K3oPZXP092nHdbsJosh0xJf92VrbojyNFI0vLP0kq3EWoEeqN56D4qrlT8mAJbFL2pqkQcGlz1yULjstTYUqQgiGwfdmZrUwLmcEViRvc2joj1e063G2MQKb3upoMJxztGHrkZ0X30PPjaw8ApN29KHM05SpKsZgtplB2MtXptrR7yT09A84DVOJ4Y6qBgakQcCm4U9rqnJjY8vGkdRfvkJNHhFvXgsv2RQ9Gw7igyM8bGcE6IF1waI4lWiSk7951nJWLSkS5DtA6orc

Remove 6turunanfungsitrigonometri.pdf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.