home

gerenciadorlocal.exe

Gerenciador Local

Positivo Informática SA

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Deskmedia3’.
Publisher:
Positivo Informática  (signed by Positivo Informática SA)

Product:
Gerenciador Local

Version:
1.0.0.69

MD5:
8f9f6af21ec8bb9836cff7fcb10107e9

SHA-1:
e313389af1794f3d64eb8a4fb9898d8754f39d67

SHA-256:
6fdee2f1af602eecf6e2a3dd7849fa07914a350fef01006dbdb7515f6a55dc5b

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/24/2024 3:47:36 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
probably DLOADER.Trojan
9.0.1.05190

File size:
1018.8 KB (1,043,256 bytes)

Product version:
1.0.0.69

Copyright:
Copyright (C) 2014

Original file name:
Gerencia.exe

File type:
Executable application (Win32 EXE)

Language:
Brazilian Portuguese

Digital Signature
Signed by:
Positivo Informática SA

Authority:
VeriSign, Inc.

Valid from:
12/10/2013 10:00:00 PM

Valid to:
2/9/2015 9:59:59 PM

Subject:
CN=Positivo Informática SA, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Positivo Informática SA, L=Curitiba, S=Paraná, C=BR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
39511A89481465ACF4E1A75AF7882E2A

File PE Metadata
Compilation timestamp:
10/8/2014 4:07:40 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:7t2QQ+TKx330rDp7xVKrX7/2l90wXi7UTHD701th:7t2QQBHIV7I7O/0wXiIr01th

Entry address:
0xCA160

Entry point:
E8, 44, 05, 00, 00, E9, B3, FD, FF, FF, 3B, 0D, 94, 10, 4F, 00, 75, 02, F3, C3, E9, CB, 05, 00, 00, CC, FF, 25, E4, 65, 4D, 00, 8B, FF, 55, 8B, EC, F6, 45, 08, 02, 57, 8B, F9, 74, 25, 56, 68, 7A, A8, 4C, 00, 8D, 77, FC, FF, 36, 6A, 0C, 57, E8, 47, 01, 00, 00, F6, 45, 08, 01, 74, 07, 56, E8, E3, FC, FF, FF, 59, 8B, C6, 5E, EB, 14, E8, C2, 06, 00, 00, F6, 45, 08, 01, 74, 07, 57, E8, CC, FC, FF, FF, 59, 8B, C7, 5F, 5D, C2, 04, 00, FF, 25, 18, 64, 4D, 00, 6A, 14, 68, 90, 41, 4E, 00, E8, 22, 04, 00, 00, FF, 35...
 
[+]

Code size:
852 KB (872,448 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Deskmedia3

Command:
"C:\positivo\deskmedia\gerenciadorlocal.exe"


Scan gerenciadorlocal.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.