home

8d1cd93d3bb7ad09850ae49b520918a9.exe

Software Jockey

This is published and distributed via an Adknowledge's advertising supported (adware) software installer. The application 8d1cd93d3bb7ad09850ae49b520918a9.exe by Software Jockey has been detected as adware by 13 anti-malware scanners.
Publisher:
Software Jockey  (signed and verified)

MD5:
8d1cd93d3bb7ad09850ae49b520918a9

SHA-1:
3b003056d18c50488d56a4362974c5664a6e769c

SHA-256:
946b6c502e72ff8e6c9dd3d4bb596d56bb7d2b302e7ee78a2369830ed4893d7a

Scanner detections:
13 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Analysis date:
12/24/2024 12:13:13 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Graftor.164387
725

AVG
Generic
2016.0.3203

Baidu Antivirus
Adware.Win32.RocketTab
4.0.3.1529

Bitdefender
Gen:Variant.Adware.Graftor.164387
1.0.20.200

Emsisoft Anti-Malware
Gen:Variant.Adware.Graftor.164387
8.15.02.09.09

ESET NOD32
MSIL/Adware.iBryte (variant)
9.10756

F-Secure
Gen:Variant.Adware.Graftor.164387
11.2015-09-02_2

G Data
Gen:Variant.Adware.Graftor.164387
15.2.24

K7 AntiVirus
Adware
13.185.14085

Kaspersky
not-a-virus:AdWare.MSIL.RocketTab
14.0.0.2510

MicroWorld eScan
Gen:Variant.Adware.Graftor.164387
16.0.0.120

Reason Heuristics
PUP.Adknowledge
15.2.9.21

VIPRE Antivirus
AdKnowledge
34966

File size:
5.6 MB (5,828,840 bytes)

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Software Jockey

Authority:
COMODO CA Limited

Valid from:
3/24/2014 8:00:00 AM

Valid to:
3/25/2015 7:59:59 AM

Subject:
CN=Software Jockey, O=Software Jockey, STREET="4600 Madison Ave, 10th FL", L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3481FC293A085AD3BA94D30DC9CC2E95

File PE Metadata
Compilation timestamp:
11/21/2014 3:57:15 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:UA8T4mET6s7OBBwYgOCDSfA9Picdu72vFxD9NxN:UA8T4mET6s7OBBwYg5MAkckYPD9bN

Entry address:
0x1E8F

Entry point:
E8, 3B, 27, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 7D, 08, 00, 74, 2D, FF, 75, 08, 6A, 00, FF, 35, 4C, BB, 98, 00, FF, 15, 3C, 80, 40, 00, 85, C0, 75, 18, 56, E8, ED, 27, 00, 00, 8B, F0, FF, 15, 38, 80, 40, 00, 50, E8, 9D, 27, 00, 00, 59, 89, 06, 5E, 5D, C3, 6A, 0C, 68, B0, A4, 40, 00, E8, 01, 25, 00, 00, 6A, 0E, E8, ED, 2A, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, A0, AF, 98, 00, BA, 9C, AF, 98, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A...
 
[+]

Entropy:
4.6023

Code size:
25.5 KB (26,112 bytes)

Remove 8d1cd93d3bb7ad09850ae49b520918a9.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.