home

epm.exe

The application epm.exe has been detected as a potentially unwanted program by 38 anti-malware scanners. The file has been seen being downloaded from download.lenovo.com and multiple other hosts.
MD5:
f62bf2de3e666cf437ff2275eb4749f5

SHA-1:
41396921adb47f9b0eb138c771a7675800a75b04

SHA-256:
bd23aaf5837c3d322b35681a35161a458d579c671f124e93b2b9d76f53c7bbfe

Scanner detections:
38 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 2:58:29 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Worm.Generic.377772
436

Agnitum Outpost
Worm.Agent
7.1.1

AhnLab V3 Security
Win32/Unruy.534016
2015.08.07

Avira AntiVirus
W32/Tapin
8.3.1.6

Arcabit
Worm.Generic.D5C3AC
1.0.0.425

avast!
Win32:Agent-AODJ [Trj]
2014.9-151125

AVG
Worm/Delf
2016.0.2914

Baidu Antivirus
Adware.Win32.Agent
4.0.3.151125

Bitdefender
Worm.Generic.377772
1.0.20.1645

Bkav FE
W32.FakeExeYHPtv
1.3.0.7062

Clam AntiVirus
WIN.Virus.Gnamer
0.98/21511

Comodo Security
Worm.Win32.Delf.nj
22943

Dr.Web
Trojan.Inject1.28681
9.0.1.0329

Emsisoft Anti-Malware
Worm.Generic.377772
8.15.11.25.01

ESET NOD32
Win32/Delf.NRJ
9.12053

Fortinet FortiGate
W32/Renamer.BQT!tr
11/25/2015

F-Prot
W32/Renamer.A.gen
v6.4.7.1.166

F-Secure
Worm.Generic.377772
11.2015-25-11_4

G Data
Worm.Generic.377772
15.11.25

IKARUS anti.virus
Virus.Win32.Renamer
t3scan.1.9.5.0

K7 AntiVirus
Trojan
13.207.16809

Kaspersky
Virus.Win32.Renamer
14.0.0.1067

Malwarebytes
Trojan.Renamer.DF
v2015.11.25.01

McAfee
W32/Gnamer
5600.6570

Microsoft Security Essentials
Virus:Win32/Grenam.A
1.1.11903.0

MicroWorld eScan
Worm.Generic.377772
16.0.0.987

NANO AntiVirus
Trojan.Win32.Renamer.lnwkz
0.30.24.2996

nProtect
Trojan/W32.Agent.534016.BS
15.08.06.02

Panda Antivirus
Generic Suspicious
15.11.25.01

Quick Heal
W32.Grenam.A
11.15.14.00

Rising Antivirus
PE:Trojan.Win32.Generic.174D0B50!390925136
23.00.65.151123

Sophos
W32/Renamer-K
4.98

Total Defense
Win32/HLLO.Grenam.A
37.1.62.1

Trend Micro House Call
TROJ_AGENT_005249.TOMB
7.2.329

Trend Micro
TROJ_AGENT_005249.TOMB
10.465.25

Vba32 AntiVirus
Worm.Delf
3.12.26.4

VIPRE Antivirus
Virus.Win32.Grenam.a
42666

Zillya! Antivirus
Worm.Delf.Win32.869
2.0.0.2336

File size:
521.5 KB (534,016 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\epm.exe

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:prMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V4:vZyCA8CBmn+RrNj9ay5I4

Entry address:
0x72814

Entry point:
55, 8B, EC, 83, C4, F0, 53, B8, 14, 0E, 47, 00, E8, 43, 4A, F9, FF, 8B, 1D, 30, 53, 47, 00, 8B, 03, E8, 06, 60, FE, FF, 8B, 03, C6, 40, 5B, 00, 8B, 03, B2, 01, E8, 3B, 7D, FE, FF, 8B, 0D, 5C, 52, 47, 00, 8B, 03, 8B, 15, E0, 0A, 47, 00, E8, FC, 5F, FE, FF, 8B, 0D, 68, 53, 47, 00, 8B, 03, 8B, 15, 90, 05, 47, 00, E8, E9, 5F, FE, FF, 8B, 03, E8, 62, 60, FE, FF, 5B, E8, C0, 28, F9, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.5930

Developed / compiled with:
Microsoft Visual C++

Code size:
451 KB (461,824 bytes)

The file epm.exe has been seen being distributed by the following 11 URLs.

https://download.lenovo.com/ibmdl/pub/pc/pccbbs/.../8ga116ww.exe

http://www.cityclearflash.com/srZbIkpkG0QkkNSJTfC8kJBltKzj_jlM5IpCvsftJMrcG4h36NJrJOvR4 2kp0wIXak9cYz37LrA_cZw6yMosLAkgahpDtAYHwNCK7GvQyqquYGRja9ZwZDeyNQlTNyPPIsJ0_NZvPsjAzwPCITKmakWijsXHrul3nfp1IC0nc9VAMFkrC9I7Q2utKq3gph4npSJ1QCd-G00AAGRwXmuL88kIhmTCBhy4JBQGOqDdVrZ96u97XwL9wmFdt3ousswR_O1m2PyNdd1Gh_Ok3X0lTJIq6p r f26 kBjEC5jkXJJkgA=

https://download.sublimetext.com/Sublime Text Build 3126 Setup.exe

https://github.com/cheat-engine/cheat-engine/releases/download/.../CheatEngine651.exe

http://www.windows-movie-maker.org/.../windows-movie-maker-free.exe

http://y.gametop.com/.../Alien-Shooter.exe

http://www.giftchuckleflash.com/N_N6gGTdJ f9e_eZ4nWbv5uIkymiWq8rakSyxOqBrpXIACq6BoAiIs7BrC 38oBIAzAKveiTE4yoicXq5whMFo4ecB_Hx09r7mQWLuw8uHjjiAExasr_cwZbSTCDOLQVSY_OdL6V8_jM5pzpOdOXbjFbajVwjB0x85Jzq0u6hTirQrH6Ovi3AnTjooqvQ_S89jsy_t6O-G08AAGRgnq0tAkhUtA_YgAOXiAJNZeU72z6V_X3vSYAvOKzrVs9GE4fQs86xPsHm20jXLXR_xNWpl_4X_pmt_fWtc2PugEZAcJImaJimCQ==

http://www.capitalheartlaboratory.com/WVl6OTRQWGhxVGxKNVJIVmFTRFkzZG5jM1NUUnRTSGQ1WVVGQ2FGSk9PVXBzUmtKQlMyZDFXVlo0Y1UxM1ZIY2xNMFFtWXoxWVIyZE5NeVV5Um0xMWFIUnVaMW80TVVkdlZqVmpjbEpsVEVwVWJua3dkR3hNU0doU1oxVkVOMjEzUkd0MlFsZ2xNa0pSZFVwWmJIRnhSVmR3Y21kRlNYbERNamRuTTBGb2JsRnROblEyUmpnemNIQlpialY0T1ROcVZHaDJWU1V5UW5STVpEUndNM0ZUYzBoUkpUSkNTVFJHV1RCQmJWZE1XSFZOUmlVeVJrRnBNbGtsTWtKcGNFWndUbFJPVVNVeVFsQlBRV2hLV1ZwbEpUSkdhWGN6YkRkMVR6Um5KVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFU1bGNtOHJOMGx1YzNSaGJHeGxjaTVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VibVZ5Ynk1amIyMGxNa1prYjNkdWJHOWhaQzV3YUhBbE0wWnBaQ1V6Ukc0eU1ERTBMWEJoWkE9PQ==

http://windroy.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAOBgYZGRHn/iapCpXDMJRGuFloSQh0NgG7jtxcjYPptspDD8ohx6VfKT2 z4yTm4b3JhZ8IRKUX5ORwL60ObSPMJ4DW9SfKb9EMehDyZfZGf8HF 3LY3ke65P7Ffn7cKMKBeHhVYB84Tou GiL16V0YQkBDAxSR3lSvLcO5ZJAMRInb51L12ZKA0OpnCmgM5Q1qkhvbAj9W5qfDCkELd42wO2dIelXs3XuAtwz FjP vxWMbS DEA4kD47tKS1Jw6LFRd rM Ko5MwiGoTjsGSgu/s9zzd9TyHhrWLbylqWk HevTRP75eidxEOWDG SLkC2kHMLvfqixC li6TwAwt2vHDBb8ovZ9t6CH9acQi4aI rSVp8T/cRMWr6RpWY5y538NGmXk7N/vL8MeXs8wCUg6XN YDPdSvgAVRc3OfEgZV UfocFg9bDlao lFcOdoJ7aZHVggHuk9APStzT/g02kb4Yb1/HcpWdY9CIoF48BByaVD9FNHHDfGxX27ghBgY36CNYc 5rYxhpSfI/f718Fd0tVx/.../ZUqV3MtVGfCymCBs D0wgbaYIWifwNjn57KTqBA1tsMK5q596f63oRDx1UF72xBxhFXe17BuQCaBKTh0GOtKg=

http://www.thursaaw.com/.../installer.exe

http://www.clearnewsign.com/.../installer.exe

Remove epm.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.