home

epp400 x86.exe

The executable epp400 x86.exe has been detected as malware by 7 anti-virus scanners. This is a setup program which is used to install the application. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from www.editplus.com.
MD5:
b8404a5f3b337b2ac95eaebe96d6a455

SHA-1:
297fbcdd1e2283bea0a47f31eb4d369dae56e8a9

SHA-256:
588394b2933c5398dfe76391fdb072c4a3013232f38a60eee98154f238edf625

Scanner detections:
7 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/27/2024 3:36:36 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160518-2

AVG
Win32/Sality
2015.0.4591

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

Microsoft Security Essentials
Threat.Undefined
1.225.160.0

Norman
Win32.Sality.3
19.05.2016 01:04:49

File size:
2.1 MB (2,191,136 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
2/17/2012 9:55:21 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:nGTCsSMPUlhxmJLqvWlq9faEYgfzSbVKAfr4fZW5lBca:nyCXRzxmJ+vWlq9yEY1bkqrAgTP

Entry address:
0xB583

Entry point:
87, FB, 18, D2, B8, C1, 6E, 18, 17, 57, 68, B0, 2C, 38, 00, 1A, C4, 86, DB, F2, B7, DB, BF, 37, 00, 6F, DA, F2, 81, D0, 29, 46, 73, 0F, 72, 08, BB, 18, 75, AC, DE, 4B, 84, C4, 81, F2, AE, A9, 00, 00, 29, DB, 46, 84, FD, BE, 07, 84, 1A, 33, 8D, 35, 67, 07, 1E, 0E, FF, CF, C7, C2, F2, 8A, 1E, CC, 8D, 15, 17, 23, 5C, A5, 0F, AF, DD, 86, F2, F7, C2, 91, 6C, 61, EA, 86, E0, 0F, AF, EA, E8, 00, 00, 00, 00, 5D, 12, D8, 69, D5, B2, 74, A7, FB, 70, 05, BB, 2E, 55, 35, F5, 0D, 36, CE, 01, FB, 85, DA, 70, 08, 0F, BE...
 
[+]

Entropy:
7.9820  (probably packed)

Code size:
71.5 KB (73,216 bytes)

The file epp400 x86.exe has been seen being distributed by the following URL.

https://www.editplus.com/ftp.php?n=epp400.exe

Remove epp400 x86.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.