home

b2.exe

Setup

Open Source

The executable b2.exe has been detected as malware by 11 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from b2-31d2.kxcdn.com.
Publisher:
Open Source

Product:
Setup

Version:
1.2

MD5:
89867c748f2cb0af3b8084a43f0393a4

SHA-1:
a60f0eb5775b272da4755463278542ef11c5bd7e

SHA-256:
e2f4e18e65f2885a0e9e900c12b276b02501ca5dd1309120e1ef3b86ab970466

Scanner detections:
11 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/26/2024 12:26:04 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160310-2

AVG
Win32/Sality
2015.0.4533

Dr.Web
Win32.Sector.30
9.0.1.05190

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.15.21

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.Artemis!9F29294BD754
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.215.2092.0

Norman
Win32.Sality.3
29.02.2016 05:46:54

VIPRE Antivirus
Threat.4721115
47848

File size:
5 MB (5,197,218 bytes)

Product version:
1.2

Copyright:
2015 - Open Source

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\b2.exe

File PE Metadata
Compilation timestamp:
8/5/2015 3:47:32 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:OQR21PY2rDY/KtPsxBcngEe4O0StS2JS5TVT3UG9j+dk0my57RLB7wUfKD+I/o0L:OQRmY2rDY/KtUxBd4Df5AG9j+157NzKN

Entry address:
0x3217

Entry point:
77, 02, FF, CE, 33, D0, 8D, 2D, D9, CC, 94, A9, 87, F3, 87, EA, 89, F9, 80, DE, A5, 4D, 85, F7, 89, C0, 81, FE, 4D, 36, 00, 00, B7, C3, 68, E7, 53, 3F, 00, 53, FE, CE, 6A, 00, 5F, FE, CA, 8D, 0D, 68, 7E, 67, F8, 0F, AF, C8, 41, 2C, 06, FE, C5, 77, 0C, 8D, 2D, 3F, 28, 7D, 4A, 69, D8, 72, 38, 38, 61, 81, C7, 3B, FC, FF, FF, 1C, C0, 0F, B7, D8, 81, C7, C6, 03, 00, 00, 0F, AF, D1, F6, C2, D5, 88, E6, EB, 02, 88, CC, FF, CB, 81, FF, D2, 09, 00, 00, 0F, 8C, B7, FF, FF, FF, B0, CF, 4A, 73, 0B, F6, C1, 3F, 8A, E8...
 
[+]

Code size:
23.5 KB (24,064 bytes)

The file b2.exe has been seen being distributed by the following URL.

http://b2-31d2.kxcdn.com/B2.exe

Remove b2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.