home

{blocked}.exe

fLmUXNSv

MSIL

The executable {blocked}.exe has been detected as malware by 24 anti-virus scanners.
Publisher:
MSIL  (signed and verified)

Product:
fLmUXNSv

Version:
1.1.1.0

MD5:
29dbdc51aaecbb61d81bc4795cc6e05e

SHA-1:
a4a886ff1cbd0fd88fdacb4db6a7ab6ebbf84c15

SHA-256:
0a8111d709dc0eada9c838f8fdf5a11adbbdee6233739752231c553874b8b724

Scanner detections:
24 / 68

Status:
Malware

Analysis date:
12/29/2024 3:39:15 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2308180
184

avast!
Win32:Broban-AR [Trj]
2014.9-160803

Baidu Antivirus
Trojan.MSIL.Inject
4.0.3.1683

Bitdefender
Trojan.GenericKD.2308180
1.0.20.1080

Comodo Security
UnclassifiedMalware
22026

Dr.Web
Trojan.PWS.Steam.1739
9.0.1.0216

Emsisoft Anti-Malware
Trojan.GenericKD.2308180
8.16.08.03.01

ESET NOD32
MSIL/Kryptik.BTI (variant)
10.11587

Fortinet FortiGate
MSIL/Kryptik.BTI!tr
8/3/2016

F-Secure
Trojan.GenericKD.2308180
11.2016-03-08_4

G Data
Trojan.GenericKD.2308180
16.8.25

IKARUS anti.virus
Trojan.MSIL.Inject
t3scan.1.8.9.0

K7 AntiVirus
Trojan
13.203.15826

Kaspersky
Trojan.MSIL.Inject
14.0.0.-193

McAfee
Artemis!29DBDC51AAEC
5600.6318

MicroWorld eScan
Trojan.GenericKD.2308180
17.0.0.648

NANO AntiVirus
Trojan.Win32.Inject.dqxtxg
0.30.24.1357

nProtect
Trojan.GenericKD.2308180
15.05.06.01

Panda Antivirus
Trj/CI.A
16.08.03.01

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TROJ_GEN.R047C0EDQ15
7.2.216

Trend Micro
TROJ_GEN.R047C0EDQ15
10.465.03

VIPRE Antivirus
Trojan.Win32.Generic
40012

File size:
708 KB (724,992 bytes)

Product version:
1.1.1.0

Copyright:
Copyright fLmUXNSv © 2015

Original file name:
fLmUXNSv.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\screenshot_1351.scr.exe

Digital Signature
Signed by:
MSIL

Authority:
getaCert - www.getacert.com

Valid from:
4/18/2015 12:18:55 AM

Valid to:
6/17/2015 12:18:55 AM

Subject:
E=N@A.com, CN=MSIL En111, OU=Encpt, O=MSIL, L=Cali, S=California, C=US

Issuer:
O=getaCert - www.getacert.com, L=Seattle, S=Washington, C=US

Serial number:
0ECE

File PE Metadata
Compilation timestamp:
4/19/2015 12:46:30 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:/U7VcVOSAo+dKfPmzl5/njhCndmucjylaG6pcWycMUJ6lx3843Z1FCiVweSrvsuC:/U7+cHov3mzDqdNcGv6cWycMUJ6lxMxO

Entry address:
0xA0EEE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.3991

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
636 KB (651,264 bytes)

Remove {blocked}.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.