home

gerador de zp.exe

The executable gerador de zp.exe has been detected as malware by 8 anti-virus scanners. The program is a setup application that uses the Self-extracting archive installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from fs02n4.sendspace.com and multiple other hosts.
MD5:
193b934f98dff835a3fbdf37c52e65ea

SHA-1:
3e3a5e15d6df0a3b1adae2b1e0b23ab44bad122b

SHA-256:
8af66dc8a429c161546d70a4c66e9361305c45d68959fe772315c969aa15e5d7

Scanner detections:
8 / 68

Status:
Malware

Analysis date:
11/25/2024 4:35:01 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2879180
5813571

Dr.Web
infected with Trojan.Starter.2890
9.0.1.05190

Emsisoft Anti-Malware
Trojan.GenericKD.2879180
10.0.0.5366

ESET NOD32
MSIL/Injector.IFO trojan
7.0.302.0

F-Secure
Trojan.GenericKD.2879180
5.15.21

Kaspersky
Trojan.MSIL.Disfa
15.0.0.562

Microsoft Security Essentials
Threat.Undefined
1.213.3386.0

Norman
Trojan.GenericKD.2879180
18.01.2016 17:20:53

File size:
633.4 KB (648,567 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Self-extracting archive

Common path:
C:\users\{user}\downloads\gerador de zp.exe

File PE Metadata
Compilation timestamp:
2/15/2015 6:00:31 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:70nyfXuIBDtfuOr13TUI5TBSOzh2fQSDKo/T8dvfyH1x2p9w7dhZ:ony/f9uOrhUIFUA2fQSDx4dyVx2gdhZ

Entry address:
0x1D7CB

Entry point:
E8, 85, 63, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 82, FC, FF, FF, C7, 06, 20, B2, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 20, B2, 42, 00, E9, 37, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 20, B2, 42, 00, E8, 24, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 52, CA, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Code size:
162 KB (165,888 bytes)

The file gerador de zp.exe has been seen being distributed by the following 5 URLs.

https://fs02n4.sendspace.com/dl/9746fbcddf8f25bf4136288c0e98d863/58612e6e768dc2a7/.../Gerador de ZP.exe

https://fs02n5.sendspace.com/dl/b4645ef901563b510b575b7269bf2ac1/58011c2a0b6d881c/.../Gerador de ZP.exe

https://fs02n5.sendspace.com/dl/63518f5a43fd54b3b1b76084b35c7ca5/571d0703559cb6e0/.../Gerador de ZP.exe

https://fs02n3.sendspace.com/dl/083530efecacc98de71a857e9ff8f7c3/5807ca4d7dccc730/.../Gerador de ZP.exe

https://fs02n4.sendspace.com/dl/d8d02219f678ab698a6083ef860f4ba4/5739f76e5214a044/.../Gerador de ZP.exe

Remove gerador de zp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.