home

eti32.exe

Ovoid4

Piotr Pawlowski

The executable eti32.exe has been detected as malware by 26 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘eti32.exe’.
Publisher:
Monogatari0  (signed by Piotr Pawlowski)

Product:
Ovoid4

Description:
Mcdaniel7

Version:
8.06.0004

MD5:
001a13c896eca4dfcf833c0fff6aae9a

SHA-1:
30420158e8c94e509a1de60a6fed1baf3072527f

Scanner detections:
26 / 68

Status:
Malware

Analysis date:
12/26/2024 2:18:36 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2097201
12

Agnitum Outpost
Trojan.PWS.Tibia
7.1.1

Avira AntiVirus
TR/Injector.1274312
7.11.205.236

avast!
Win32:Malware-gen
2014.9-170123

AVG
Generic_vb
2018.0.2490

Baidu Antivirus
Trojan.Win32.Injector
4.0.3.17123

Bitdefender
Trojan.GenericKD.2097201
1.0.20.115

Dr.Web
Trojan.KillFiles.22632
9.0.1.023

Emsisoft Anti-Malware
Trojan.GenericKD.2097201
8.17.01.23.12

ESET NOD32
Win32/Injector.BTGL (variant)
11.11095

Fortinet FortiGate
W32/BTDF!tr
1/23/2017

F-Secure
Trojan.GenericKD.2097201
11.2017-23-01_2

G Data
Trojan.GenericKD.2097201
17.1.25

IKARUS anti.virus
Trojan.Win32.Injector
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.193.14803

Kaspersky
Trojan-PSW.Win32.Tibia
14.0.0.-1055

Malwarebytes
Trojan.EDVBGen
v2017.01.23.12

McAfee
Trojan-FFNI!001A13C896EC
5600.6146

MicroWorld eScan
Trojan.GenericKD.2097201
18.0.0.69

nProtect
Trojan.GenericKD.2097201
15.01.29.01

Panda Antivirus
Trj/CI.A
17.01.23.12

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
Suspicious_GEN.F47V0120
7.2.23

Vba32 AntiVirus
TScope.Trojan.VB
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
37086

File size:
1.2 MB (1,274,312 bytes)

Product version:
8.06.0004

Original file name:
Vascular.exe

File type:
Executable application (Win32 EXE)

Language:
Katalonski

Common path:
C:\Documents and Settings\{user}\Local settings\temp\eti32.exe

Digital Signature
Signed by:
Piotr Pawlowski

Authority:
StartCom Ltd.

Valid from:
3/30/2013 1:23:52 AM

Valid to:
3/30/2015 3:35:18 PM

Subject:
E=p@perkele.cc, CN=Piotr Pawlowski, L=Plock, S=Mazowieckie, C=PL, Description=RW8FUkbQOZtJVf8f

Issuer:
CN=StartCom Class 2 Primary Intermediate Object CA, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL

Serial number:
0951

File PE Metadata
Compilation timestamp:
1/19/2015 3:47:07 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x1878

Entry point:
68, 10, 95, 52, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, F5, 8E, F5, FA, 52, 06, A8, 48, A7, 9B, 2F, CD, B7, 8A, 2D, D5, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 4A, 65, 73, 73, 69, 65, 76, 69, 6C, 6C, 65, 33, 00, 00, 00, 00, 00, 00, 00, 00, FF, CC, 31, 00, 06, E7, 30, F3, 24, 9A, 91, 4C, 45, AD, 6D, EB, 0F, 71, D4, 0C, 8E, D6, D6, 44, 6A, 47, DD, 0F, 4D, 81, 3D, 02, 20, D1, B8, D8, 84, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
1.2 MB (1,257,472 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
eti32.exe

Command:
C:\docume~1\puzon\ustawi~1\temp\eti32.exe


Remove eti32.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.