home

cameracardrecovery-windows.exe

Remo Software Downloader

Remo Software

The application cameracardrecovery-windows.exe by Remo Software has been detected as a potentially unwanted program by 7 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from www.lenovo-datarecovery.com and multiple other hosts.
Publisher:
Remo Software  (signed and verified)

Product:
Remo Software Downloader

Version:
1.0.0

MD5:
5269b4e8f0cad9d4a0f2eec55b65a62f

SHA-1:
aff1d0a71f44c62e73509098e797687b702abd93

SHA-256:
7159c88cc5952b698e7c8792f9dee5d97d021f5bf63102a8e9dd9f07736ff243

Scanner detections:
7 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 7:46:49 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Trojan/Win32.FakeAV
14.05.07

Fortinet FortiGate
Adware/PCMega.J
5/7/2014

Malwarebytes
PUP.Optional.Mega
v2014.05.07.11

NANO AntiVirus
Riskware.Win32.Agent.cinaww
0.28.0.59608

Quick Heal
AdWare.AdLoad.r3 (Not a Virus)
5.14.14.00

Vba32 AntiVirus
AdWare.AdLoad
3.12.26.0

ViRobot
Trojan.Win32.S.FakeAV.433848
2011.4.7.4223

File size:
423.7 KB (433,848 bytes)

Product version:
1.0.0

Copyright:
© Remo Software

Original file name:
rs-recover-win.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\cameracardrecovery-windows.exe

Digital Signature
Signed by:
Remo Software

Authority:
The USERTRUST Network

Valid from:
1/17/2011 1:00:00 AM

Valid to:
1/17/2014 12:59:59 AM

Subject:
CN=Remo Software, O=Remo Software, STREET=18/10 3rd Floor Saleh Center, STREET=Cunningham Road, L=Bangalore, S=Karnataka, PostalCode=560052, C=IN

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
00A31521595BE443AD7CC930DAB868D516

File PE Metadata
Compilation timestamp:
5/6/2009 7:38:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:IVUozeYlxFfQUTdOFyh6yT36i8EhutazNioSc:o7JnJQ2XTqilut2NF

Entry address:
0x120100

Entry point:
60, BE, 00, 40, 4D, 00, 8D, BE, 00, D0, F2, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 10, EC, 11, 00, 57, 83, C3, 04, 53, 68, F7, C0, 04, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Code size:
308 KB (315,392 bytes)

The file cameracardrecovery-windows.exe has been seen being distributed by the following 38 URLs.

http://www.lenovo-datarecovery.com/.../lenovo-datarecovery-windows.exe

http://www.memory-card-recovery.net/.../memory-card-recovery-windows.exe

http://www.photorecoveryafter.com/.../photorecoveryafter-windows.exe

http://www.windows8datarecovery.net/.../windows8datarecovery.exe

http://www.recovermyphoto.net/.../recovermyphoto-win.exe

http://www.partitionrecoveryprogram.com/.../partitionrecoveryprogram-windows.exe

http://www.samsungrecovery.net/.../samsungrecovery-windows.exe

http://www.mypartitionrecovery.com/.../partition-recovery-windows.exe

http://www.mp3musicrecovery.com/.../mp3musicrecovery-windows.exe

http://www.usbmemorycardrecovery.com/.../usbmemorycardrecovery-windows.exe

http://www.recoverdeletedvideo.com/.../recoverdeletedvideo-windows.exe

http://www.recoverdeletedfolders.com/.../recoverdeletedfolders-windows.exe

http://www.outlookrecovery-tool.com/.../outlookrecovery-tool-win.exe

http://www.recover-partition.net/.../recover-partition-windows.exe

http://www.recover-usb-files.com/.../recover-usb-files-windows.exe

http://www.samsungphotorecovery.net/.../samsungphotorecovery-win.exe

http://www.diskpartitionrecovery.com/.../diskpartitionrecovery-windows.exe

http://www.rocketdownload.com/download.php?p_id=535468

http://www.recoverwd.com/.../recoverwd-win.exe

http://www.recoverdeletedpicture.com/.../recoverdeletedpicture-windows.exe

http://www.usbharddriverecovery.net/.../usbharddriverecovery-windows.exe

http://www.datarecovery-software.net/.../datarecovery-software-windows.exe

http://www.howtorecoverdeleted.net/.../howtorecoverdeleted-win.exe

http://www.missing-datarecovery.com/.../missing-datarecovery-win.exe

http://www.undeleterecyclebin.com/.../undeleterecyclebin.exe

http://www.sdhccardrecovery.com/.../sdhccardrecovery-windows.exe

http://www.recover-sd-card.com/.../recover-sd-card-windows.exe

http://www.sdxccardrecovery.com/.../sdxccardrecovery-windows.exe

http://www.usbrecoverytool.com/.../usbrecoverytool-windows.exe

http://www.deletedfilesrecoverysoftware.com/.../deletedfilesrecoverysoftware-windows.exe

Latest 30 of 38 download URLs

Remove cameracardrecovery-windows.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.