home

antivirus.exe

Avira Operations GmbH & Co. KG

This is a setup program which is used to install the application. The file has been seen being downloaded from file.dl1.svit.vn and multiple other hosts.
Publisher:
Avira Operations GmbH & Co. KG  (signed and verified)

MD5:
8d2da245297b0565a6fb2d7b6bac89b5

SHA-1:
665551a0ba3baabe64d02fbd0049e8d168a056f3

SHA-256:
43b7c3dd9dfe027a30616faa8922c618ad8cc2f56d7d0e8b6a8bee94636371b2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/2/2024 5:16:52 PM UTC  (today)

File size:
135.2 MB (141,801,528 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\ProgramData\avira\my avira\temp\antivirus.exe

Digital Signature
Signed by:
Avira Operations GmbH & Co. KG

Authority:
VeriSign, Inc.

Valid from:
1/17/2014 2:00:00 AM

Valid to:
1/17/2017 1:59:59 AM

Subject:
CN=Avira Operations GmbH & Co. KG, OU=Global Assembly, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Avira Operations GmbH & Co. KG, L=Tettnang, S=Baden-Württemberg, C=DE

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3AEA7D79BC1D84D2E1AB0FFC8BC35658

File PE Metadata
Compilation timestamp:
11/30/2005 11:08:44 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
3145728:FHtbliEj2IYsvnMEqFSNQSCCWzj6VOX5G15qIi1RDQo:Fni+2IYonKFSSP6VG5GLzi1FQo

Entry address:
0x1000

Entry point:
E8, B7, 27, 00, 00, 50, E8, CB, 22, 01, 00, 00, 00, 00, 00, 90, 55, 8B, EC, 53, 56, 57, 8B, 7D, 10, 8B, 5D, 0C, 8B, 75, 08, 8B, D3, FF, 75, 14, 68, E5, 40, 41, 00, 6A, 00, 6A, 00, 8B, C6, 8B, CF, E8, 42, 43, 00, 00, 81, EB, 10, 01, 00, 00, 74, 05, 4B, 74, 14, EB, 57, FF, 75, 14, 6A, 66, 56, E8, 1C, 25, 01, 00, B8, 01, 00, 00, 00, EB, 47, 66, 81, E7, FF, FF, 66, FF, CF, 74, 07, 66, FF, CF, 74, 23, EB, 30, 68, 80, 00, 00, 00, 68, D4, 50, 41, 00, 6A, 65, 56, E8, 62, 24, 01, 00, 6A, 01, 56, E8, 3C, 24, 01, 00...
 
[+]

Code size:
76 KB (77,824 bytes)

The file antivirus.exe has been seen being distributed by the following 7 URLs.

http://file.dl1.svit.vn/download/89401123/b4473d4765074ea831ee1185b6aba84e/2014/.../SinhVienIT.Net--Avira Free Antivirus 14.0.5.444.exe

http://api2.tenlua.vn/filemanager/builddownload/.../?hash=5479e02cbf092b041e32652775a06f9b2722fc8df348ff4ce8299f32cd48144d622079f8e76d2fb11522f6f60d2e0c53443212dfbaf54e65765cc34ef480df9fc59efe87c94890f9fd253404f9108261c70a8722a5511e6c840a32ce1b7c46c5f836a23e13037b82ea9fc668032cc176e745ac1a47066049516a70d0e8afaf7bb6921e392d38a6ce3271c534cf9d72bdfc5d0594ff04dbdc909c09f6cab7c58d99dc&url=0b3da36fa30172185e33346174fd75853636b390ad53eb4da0&down=0b3da36fa30172185e33346174fd75853636b390ad53fc55a0&jump_type=download&file=sinhvienit.net-avira-free-antivirus-14.0.5.444.exe

http://www.filehippo.com/download/file/.../

https://s14.tenlua.vn/.../1328e669bf5e3f5541616f2534f5688c2b25fad5a94ef255e935cb3f9f574c4a343865e0e02c6eeb4976fdf10c6d5f02056b4890e1e35e253609cb4ff4c28dd79cdbb8cdd353c7e1fd253706fe0a9b64de0d813cf51f1c6e840228d21d7c41bcb869fe79425624fe8c89a027592bc533be70aa000f486f7c123b3b84ccafb767a1d51a22717cf88d722d846085c028eefd094ec3ef4bc3c0809f01acc1fdced7d99bb485e2a5f444bdb96c2c1b54e237e8faa967d2713b247ca0d063cd83d10fadabc5f300bee29f7708bcf4e1743c88c7c3e2752d38d3d08c3e919a72ef435b1b011fe6d482438b6902ce36e398d59d1e7e1db6942fa8f05f483eec617050f267dcc7edcf32db51b63800f6d0daa94c00930fa120f2d021a95d67fd6be6a963cd6077d9d1b7b30d98f6097bfeb2064b59852cfb134dc2d3a1d991205f1b6dcf91f5f15722aead6b41b1e71d47846e9895d9236e703a6332447f18217695d8521d61c511afbbd05533e4969fbd9786e89acbdaff696bece75999e1649b9e74e7af3f8daae04735a9f51efa396ecebcc12fa9ec0b0ebf496efea1c466aace3ec930b4730b44534e69b81d3001392263784e8adc46d48bf7103e0229e4fb9fb76132c41ec4a9b7f8d2ffa5c40f05fe99e06c1f01163c5ad7f6fab593f56c5a66bd647147815

http://www.scanwith.com/download_soft.php?d=2144&s=459

http://install.avira-update.com/package/wks_avira13/win32/en/.../avira_free_antivirus_en.exe

http://www.filepuma.com/file2/1403960281c6095/avira_free_antivirus_14.0.5.444/.../

Scan antivirus.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.