home

book1440836.exe

Attach Extended

PROFI-SOFT

The executable book1440836.exe, “Attach Extended OllyDbg Plugin” has been detected as malware by 1 anti-virus scanner.
Publisher:
PROFI-SOFT  (signed and verified)

Product:
Attach Extended

Description:
Attach Extended OllyDbg Plugin

Version:
1, 0, 0, 1

MD5:
c9bf5196bf79f861ae5002f8cb7f7e62

SHA-1:
069044eee372fb8d5d525da0ddc603058f290ec9

SHA-256:
69e70002fd2b59af8928668ec18cd94bd1bc25293b25799601618966fc8f7e62

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/27/2024 6:28:34 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
17.3.2.12

File size:
996 KB (1,019,912 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright (C) 2009

Original file name:
AttachEx.dll

File type:
Executable application (Win32 EXE)

Language:
English

Common path:
C:\users\{user}\downloads\book1440836.exe

Digital Signature
Signed by:
PROFI-SOFT

Authority:
COMODO CA Limited

Valid from:
9/4/2015 3:00:00 AM

Valid to:
9/4/2016 2:59:59 AM

Subject:
CN="""PROFI-SOFT"", OOO", O="""PROFI-SOFT"", OOO", STREET="Prospekt Piskarevsky, 10", L=Saint-Petersburg, S=Saint-Petersburg, PostalCode=195221, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
008B0D4FAA82D8B1952898AE54373F0012

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x931F8

Entry point:
52, 51, 8D, 00, 8B, 0D, 18, CB, 49, 00, 0F, B6, 01, 2C, B0, 83, E8, 08, 75, 09, E9, FD, DF, FF, FF, FC, 90, FC, 90, 68, 70, 32, 49, 00, E9, AE, 15, 00, 00, 0F, 84, A8, 05, 00, 00, 87, 35, 07, 81, 49, 00, F5, 87, 15, 73, 80, 49, 00, 84, DF, 83, FB, FF, 0F, 8D, 7C, ED, FF, FF, 89, 4C, 24, E8, F7, C7, 5D, 27, 08, 53, 89, 3D, 85, 80, 49, 00, F9, 29, 05, 44, 80, 49, 00, E9, 5A, ED, FF, FF, C7, 05, 4C, B0, 49, 00, CC, 48, 49, 00, E9, EF, 13, 00, 00, 47, 54, E8, 99, DD, F6, FF, C3, FE, 0D, B0, AB, 49, 00, E9, 19...
 
[+]

Entropy:
6.4158

Code size:
608.5 KB (623,104 bytes)

Remove book1440836.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.