home

activator.exe

The application activator.exe has been detected as a potentially unwanted program by 27 anti-malware scanners. This is a setup program which is used to install the application. While running, it connects to the Internet address disc-soft.com on port 443.
MD5:
a63e83bc2a68828811f4276ce54f4276

SHA-1:
60f3b729afff0bd2e449d7bc67e6047e722480e2

SHA-256:
869c0f64d1d8c646994c2ccdedf655c76b2e3c3b8cac03e3cca48c2d3e5e9d3a

Scanner detections:
27 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 11:18:49 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2117536
725

Agnitum Outpost
Riskware.Themida
7.1.1

Avira AntiVirus
TR/Crypt.TPM.Gen
7.11.208.204

avast!
Win32:Malware-gen
2014.9-150209

AVG
Win32/Heur
2016.0.3203

Baidu Antivirus
Hacktool.Win32.Packed.Themida
4.0.3.1529

Bitdefender
Trojan.GenericKD.2117536
1.0.20.200

Bkav FE
HW32.Packed
1.3.0.6379

Comodo Security
UnclassifiedMalware
21011

Emsisoft Anti-Malware
Trojan.GenericKD.2117536
8.15.02.09.03

ESET NOD32
Win32/Packed.Themida suspicious (variant)
9.11143

Fortinet FortiGate
PossibleThreat
2/9/2015

F-Secure
Trojan.GenericKD.2117536
11.2015-09-02_2

G Data
Trojan.GenericKD.2117536
15.2.25

K7 AntiVirus
Trojan
13.193.14899

McAfee
Artemis!A63E83BC2A68
5600.6859

MicroWorld eScan
Trojan.GenericKD.2117536
16.0.0.120

NANO AntiVirus
Trojan.Win32.TPM.dleowm
0.30.0.65070

Norman
Heuristic_Suspicious.gen!r
11.20150209

nProtect
Trojan.GenericKD.2117536
15.02.06.01

Panda Antivirus
Trj/Chgt.N
15.06.19.02

Qihoo 360 Security
HEUR/QVM19.1.Malware.Gen
1.0.0.1015

Rising Antivirus
PE:Packer.Win32.Mian007.a!1074235325
23.00.65.15207

Sophos
Generic PUA GA
4.98

Trend Micro House Call
TROJ_GEN.R002C0EAG15
7.2.40

Trend Micro
TROJ_GEN.R002C0EAG15
10.465.09

VIPRE Antivirus
Trojan.Win32.Generic
37374

File size:
5.9 MB (6,159,872 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\jdownloader\myegy daemon tools pro 6 1 0 0483 elk!ng\myegy.daemon tools pro 6.1.0.0483.elk!ng\activator_dtp\activator.exe

File PE Metadata
Compilation timestamp:
3/27/2014 6:12:32 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:NW9+emzvEoIlpzXcjFFdoOqNBsPSql03iO9YtqGB+i4V+rit8Qj7F/t3iqs0l:UMebdlpzX4FFdo5v4SqQSqGDs+riCQnh

Entry address:
0xCAE000

Entry point:
83, EC, 04, 89, 0C, 24, 89, E1, 81, C1, 04, 00, 00, 00, 83, E9, 04, 87, 0C, 24, 8B, 24, 24, 52, 89, E2, 81, C2, 04, 00, 00, 00, 81, EA, 04, 00, 00, 00, 87, 14, 24, 8B, 24, 24, 89, 04, 24, 68, 74, 1D, 00, 00, 89, 1C, 24, E8, 01, 00, 00, 00, CC, 8B, 04, 24, 51, 89, E1, 81, C1, 04, 00, 00, 00, 81, C1, 04, 00, 00, 00, 87, 0C, 24, 8B, 24, 24, 83, EC, 04, 89, 04, 24, 8B, 1C, 24, 81, C4, 04, 00, 00, 00, 92, 87, CA, 41, 87, CA, 31, D0, 31, C2, 31, D0, 83, EC, 04, 89, 34, 24, 68, 00, F0, 13, 00, 5E, 29, F0, 5E, 2D...
 
[+]

Entropy:
7.9875  (probably packed)

Code size:
6.4 MB (6,743,040 bytes)

The file activator.exe has been seen being distributed by the following URL.

about:internet

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP SSL):
Connects to disc-soft.com  (217.147.90.28:443)

Remove activator.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.