home

calc.exe

Sistema operacional Microsoft Windows

Microsoft Corporation

This is a setup program which is used to install the application. It is installed as part of Windows 8. The file has been seen being downloaded from webmail.myway.com.
Publisher:
Microsoft Corporation

Product:
Sistema operacional Microsoft® Windows®

Description:
Calculadora do Windows

 
Part of the Windows 8 Operating System

Version:
6.2.9200.16384 (win8_rtm.120725-1247)

MD5:
c830e4ec9e08967bee13e84b1ce9437e

SHA-1:
49c7d593f22293ebc6763c8bfde95ae4cd255361

SHA-256:
b85111b131dc030316ad2f93349232267d7c57191c40b7ab9bf8f1fbba022786

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/30/2024 3:35:15 PM UTC  (today)

File size:
914.5 KB (936,448 bytes)

Product version:
6.2.9200.16384

Copyright:
© Microsoft Corporation. Todos os direitos reservados.

Original file name:
CALC.EXE.MUI

File type:
Executable application (Win32 EXE)

Language:
Brazilian Portuguese

Common path:
C:\windows\syswow64\calc.exe

File PE Metadata
Compilation timestamp:
7/25/2012 10:06:34 PM

OS version:
6.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.10

CTPH (ssdeep):
12288:OIEXpjtVnl7HsxJcK4+0/whGQlOt3hWVsMTdjGD/F6lsHeGL7GOK:OI+RtVnZMwV9uGQltVLTdjoYaod

Entry address:
0x35F9A

Entry point:
E8, 71, FA, FF, FF, 6A, 58, 68, A0, 60, 43, 00, E8, FC, B2, FF, FF, 33, DB, 89, 5D, E0, 89, 5D, FC, 8D, 45, 98, 50, FF, 15, 20, 21, 48, 00, C7, 45, FC, FE, FF, FF, FF, C7, 45, FC, 01, 00, 00, 00, 64, A1, 18, 00, 00, 00, 8B, 78, 04, 8B, F3, 53, 57, 68, 6C, DB, 47, 00, FF, 15, 1C, 21, 48, 00, 85, C0, 0F, 85, 9D, 79, 00, 00, 33, FF, 47, 39, 3D, 8C, D1, 47, 00, 0F, 84, AC, 79, 00, 00, 39, 1D, 8C, D1, 47, 00, 0F, 85, CC, 00, 00, 00, 89, 3D, 8C, D1, 47, 00, 68, 10, 45, 40, 00, 68, 04, 45, 40, 00, E8, 56, FF, FF...
 
[+]

Code size:
492.5 KB (504,320 bytes)

The file calc.exe has been seen being distributed by the following URL.

http://webmail.myway.com/.../emailGetAttachment.cgi?act=11&unm=snowangelz.myway&sid=20150910041409659804201&msgid=8acbbbea_7d9f_47d9_8601_5ec6d81f7546&fid=cdfc0e80_8771_4348_8f47_f5eec4f6c8af&attemid=&attid=3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.