home

esdtrl-photoplusx5-de-aq-downloader.exe

OCSClient

shareware.de SWV GmbH

The application esdtrl-photoplusx5-de-aq-downloader.exe by shareware.de SWV GmbH has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from downloads.freeware.de.
Publisher:
www.download-sponsor.de  (signed by shareware.de SWV GmbH)

Product:
OCSClient

Version:
1.00

MD5:
84d9c575365b479c2ec5461c83cfd0c3

SHA-1:
80857687875310043d1faeaa1dbc6aafc8859c36

SHA-256:
e2dcd42b4233955c5bff3a8674409352f4821651049f1972e19399358a0d54e6

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/26/2024 3:40:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Win32.Generic.sharewaredeSWVGmbH.Meta
15.6.14.22

File size:
543.6 KB (556,608 bytes)

Product version:
1.00

Copyright:
Copyright @ www.download-sponsor.de

Original file name:
ocsclient.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\esdtrl-photoplusx5-de-aq-downloader.exe

Digital Signature
Signed by:
shareware.de SWV GmbH

Authority:
TC TrustCenter GmbH

Valid from:
10/5/2012 10:26:29 AM

Valid to:
10/6/2014 10:26:29 AM

Subject:
CN=shareware.de SWV GmbH, OU=TC Publisher ID for Authenticode, OU=IT, O=shareware.de SWV GmbH, L=Giessen, S=Hessen, C=DE

Issuer:
CN=TC TrustCenter Class 2 L1 CA XII, OU=TC TrustCenter Class 2 L1 CA, O=TC TrustCenter GmbH, C=DE

Serial number:
58A70001000268350828A736A62C

File PE Metadata
Compilation timestamp:
1/3/2013 5:55:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:f196fXlJkEK/tKqCKYXSrDI6DY4EwmGAr4YlzY4ZJEk/wrGEYXl5gvysgfBnnl2q:fXFEhwy5gvysgpnncq

Entry address:
0x1560

Entry point:
68, 40, 49, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 1B, 59, 0B, C6, 31, BB, CB, 42, 92, FB, 54, B3, 45, 04, EB, 4B, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 2D, 43, 30, 30, 30, 2D, 4F, 43, 53, 43, 6C, 69, 65, 6E, 74, 00, 34, 36, 7D, 23, 32, 2E, 00, 00, 00, 00, FF, CC, 31, 00, 00, AB, CB, DD, 7D, 07, EB, 26, 43, A6, 5A, 6F, 6D, A2, 7A, F2, 0F, D3, C5, 05, 2D, F5, 54, 26, 40, 8A, 93, F3, 03, CD, 39, 41, 4A, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
40 KB (40,960 bytes)

The file esdtrl-photoplusx5-de-aq-downloader.exe has been seen being distributed by the following URL.

http://downloads.freeware.de/?lastchange=1353503326&pid=freewarede&cid=h374383&camps=39636261343934653235363436373462356365313332343661653263333361642C3237613865383266653632373039306134383433313338666538383764636235&campsel=39636261343934653235363436373462356365313332343661653263333361642D6D61696E3A312C39636261343934653235363436373462356365313332343661653263333361642D7365617263683A312C39636261343934653235363436373462356365313332343661653263333361642D686F6D653A312C32376138653832666536323730393061343834333133386665383837646362352D6D61696E3A312C&euid=87b87143413aebf83fe00efc&source=

Remove esdtrl-photoplusx5-de-aq-downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.