home

download01042011.exe

Aplicativo do Windows

© 2011 Microsoft Corporation Brasil

The executable download01042011.exe, “Apresetação Power Point” has been detected as malware by 25 anti-virus scanners. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from doc-14-14-docs.googleusercontent.com.
Publisher:
© 2011 Microsoft Corporation Brasil

Product:
Aplicativo do Windows

Description:
Apresetação Power Point

Version:
247.235.321.408

MD5:
6e8545eeaf6ce035748d7330c660f340

SHA-1:
39364be561363015fe99577a4d73d9b110968c5f

SHA-256:
a981d467c5cdd1fd952149ab04194899e900830a3b1a9187ad6577d5da860f6b

Scanner detections:
25 / 68

Status:
Malware

Analysis date:
11/18/2024 5:18:55 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Downloader/Win32.Banload
2012.08.20

Avira AntiVirus
TR/Spy.Banker.Gen
7.11.40.82

avast!
Win32:Malware-gen
2014.9-160802

AVG
Downloader.Banload
2017.0.2663

Bitdefender
Gen:Trojan.Heur.zG0@tvz3A0kG
1.0.20.1075

Clam AntiVirus
BC.Heuristic.Trojan.SusPacked.TMS
0.98/18155

Comodo Security
TrojWare.Win32.TrojanDownloader.Delf.gen
13286

Dr.Web
Trojan.DownLoader4.19661
9.0.1.0215

Emsisoft Anti-Malware
Trojan-Downloader.Win32.Banload!IK
8.16.08.02.10

ESET NOD32
Win32/TrojanDownloader.Banload.OJQ (variant)
10.7399

Fortinet FortiGate
W32/Banker.GSJ!tr.pws
8/2/2016

F-Prot
W32/Trojan-Gypikon-based.DE
v6.4.6.5.141

F-Secure
Gen:Trojan.Heur.zG0@tvz3A0kG
11.2016-02-08_3

G Data
Gen:Trojan.Heur.zG0@tvz3A0kG
16.8.22

IKARUS anti.virus
Trojan-Downloader.Win32.Banload
t3scan.1.1.122.0

K7 AntiVirus
Trojan
13.147.7516

Kaspersky
Trojan-Downloader.Win32.Banload
14.0.0.-190

McAfee
PWS-Banker!gsj
5600.6319

Norman
W32/Obfuscated.A!genr
11.20160802

Panda Antivirus
Generic Trojan
16.08.02.10

Rising Antivirus
Trojan.Win32.Generic.128ACCD8
23.00.65.16731

Total Defense
Win32/Websearch.R
37.0.10037

Trend Micro House Call
TROJ_GEN.R21C3DC
7.2.215

Vba32 AntiVirus
TrojanDownloader.Banload.bfbn
3.12.18.2

VIPRE Antivirus
Trojan.Win32.Generic.pak!cobra
12706

File size:
407.5 KB (417,280 bytes)

Product version:
247.235.321.408

File type:
Executable application (Win32 EXE)

Language:
Brazilian Portuguese

Common path:
C:\users\{user}\downloads\download01042011.exe

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:7D4rTd29kL7n4EpJty7huTeDSIE1Vz+BKR/2rf5cBTouJG8/LMlfTJ:XkTd29kLLdy7ieGIQz+JxcB0uDC

Entry address:
0x5205C

Entry point:
55, 8B, EC, 83, C4, F0, 53, B8, 7C, 1E, 45, 00, E8, 53, 40, FB, FF, 8B, 1D, 30, 40, 45, 00, 8B, 03, E8, 7E, E1, FF, FF, 8B, 03, BA, C4, 20, 45, 00, E8, 72, DD, FF, FF, 8B, 03, 83, C0, 50, BA, E4, 20, 45, 00, E8, C3, 21, FB, FF, 8B, 0D, 10, 41, 45, 00, 8B, 03, 8B, 15, 6C, 18, 45, 00, E8, 68, E1, FF, FF, 8B, 03, C6, 40, 5B, 00, 8B, 03, E8, DB, E1, FF, FF, 5B, E8, 51, 20, FB, FF, 00, FF, FF, FF, FF, 14, 00, 00, 00, 48, 44, 43, 6C, 6F, 6E, 65, 20, 46, 72, 65, 65, 20, 45, 64, 69, 74, 69, 6F, 6E, 00, 00, 00, 00...
 
[+]

Entropy:
6.5593

Developed / compiled with:
Microsoft Visual C++

Code size:
324.5 KB (332,288 bytes)

The file download01042011.exe has been seen being distributed by the following URL.

https://doc-14-14-docs.googleusercontent.com/docs/secure/us6095k53mofuirdpkhavu2pcbkr0m8e/o22bsokf6giumgp3tnl657cpbr1j6q0a/1301702400000/13209360891947548154/.../0ByLXRrotSzHMNDBhZTk5MzUtNDMzNy00NjQzLTkxZDctOWNjOGJjMDhjOTFl?authkey=CNP798sM&e=download&nonce=p8gpasfnui3pg&user=02405412009815388702&hash=carmcn9p1lela179f5k3r0e8dp1hbv4n

Remove download01042011.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.