» CalPC Client.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

CalPC Client.exe

CalPC Client

SpectraCal, LLC

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘CalPC Client’. This file is installed with the program CalPC Client.

File name:

CalPC Client.exe

Publisher:

SpectraCal, LLC (signed and verified)

Product:

CalPC Client

Version:

2.2.1.18

MD5:

c34851e7686ce02a61d6b08f42dbd224

SHA-1:

bd1383c57554ed766e9ba86fee195d66fe0f8de3

SHA-256:

f4feee6a33ed1ecb7f9b9489e8374112b3aeb2f9d40efd354f98debbd25f7006

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

11/25/2024 4:59:36 PM UTC (today)

Scan engine

Detection

Engine version

AegisLab AV Signature

Troj.Ransom.W32.Foreign.mbMs

2.1.4+

File size:

2.9 MB (3,092,336 bytes)

Product version:

2.2.1.18

Trademarks:

SpectraCal CalMAN CORE

Original file name:

CalPC Client.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\spectracal\calpc client\calpc client.exe

Digital Signature

Signed by:

SpectraCal, LLC

Authority:

VeriSign, Inc.

Valid from:

1/5/2012 1:00:00 AM

Valid to:

2/2/2013 12:59:59 AM

Subject:

CN="SpectraCal, LLC", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="SpectraCal, LLC", L=Mukilteo, S=Washington, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

7BA4DD016AC306D006A0BE9398CF4050

File PE Metadata

Compilation timestamp:

9/7/2012 12:30:29 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

49152:pbwfJSbDzMDowYN7TaLqfM8RN+Y67ExhZ0JjFECd:kMDzqowYBTaOd+

Entry address:

0x2EEEDE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.2888

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

2.9 MB (3,067,904 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

CalPC Client

Command:

"C:\Program Files\spectracal\calpc client\calpc client.exe"

The file CalPC Client.exe has been discovered within the following program.

CalPC Client by SpectraCal LLC

About 1% of users remove it

Scan CalPC Client.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.