home

hohosearch.exe

VANKY TECHNOLOGY LIMITED

The application hohosearch.exe by VANKY TECHNOLOGY LIMITED has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
VANKY TECHNOLOGY LIMITED  (signed and verified)

Version:
201605090953

MD5:
372033dbdb4328da839cf370088e763c

SHA-1:
5b4685ba39874055d2b690b6ef0b89921fcf63fb

SHA-256:
e512c7412b1352c65effe8e3dd653e63337ebde73a81ff6f6a44b3ad6ed6aeee

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/24/2024 4:02:35 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.YesSearches.VANKYTEC (M)
16.5.13.14

File size:
809.9 KB (829,376 bytes)

Product version:
201605090953

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\hohosearch.exe

Digital Signature
Signed by:
VANKY TECHNOLOGY LIMITED

Authority:
GlobalSign nv-sa

Valid from:
5/9/2016 11:30:50 AM

Valid to:
1/21/2017 12:11:53 PM

Subject:
CN=VANKY TECHNOLOGY LIMITED, O=VANKY TECHNOLOGY LIMITED, L=香港, S=香港, C=HK

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121154E102C9DDCCBBC71251F4FED6BA933

File PE Metadata
Compilation timestamp:
5/9/2016 7:49:03 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
24576:ctxj3lNSh8Kd9tjdNo2Ho+fWK8C1ZEyXE:cTlEt9vbZt8C1Gy0

Entry address:
0x48ADC

Entry point:
53, 7A, 48, FE, E2, 11, 7C, C6, 4F, B4, C9, 44, 7E, E5, 1B, 9B, 3F, 83, FE, 97, 9D, 47, C4, 6B, 55, 21, 67, E0, 3F, 74, B9, F1, 33, 9D, AC, 6B, 53, 32, E9, FD, 72, 66, E2, 8A, 66, CC, E3, D4, B9, 14, 37, 66, 9D, 8F, 78, 0B, 71, B3, F1, E1, 59, 13, 52, 97, 18, 4C, 0A, 26, 07, 53, 82, A9, C1, B4, 60, 3D, F5, CB, 06, F4, CD, 8C, E8, 32, 0B, 5D, C8, 81, 09, 64, 2F, 87, A7, C6, B6, 17, E3, 7B, E8, 65, 72, 1D, 69, 3F, 9E, BD, 1C, 55, E5, 07, 7A, 48, 3A, 88, 67, AB, 40, DB, BC, B4, C9, 0F, AE, 93, 5D, BB, 41, 52...
 
[+]

Entropy:
7.2237

Code size:
618 KB (632,832 bytes)

Remove hohosearch.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.