home

iexploer.exe

Microsoft Windows Operating System

NetZone Info-Tech Co., Ltd., Shanghai

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The application iexploer.exe, “Internet Explorer” by NetZone Info-Tech Co.,, Shanghai has been detected as a potentially unwanted program by 14 anti-malware scanners.
Publisher:
Microsoft Corporation  (signed by NetZone Info-Tech Co., Ltd., Shanghai)

Product:
Microsoft(R) Windows(R) Operating System

Description:
Internet Explorer

Version:
8.0.7600.16869

MD5:
2d886c798470e09251803c6755e422b4

SHA-1:
4e806ed5fa1937eb5784f19d64eacc34b170b730

SHA-256:
3af315e9cd411d300a1f4553581d1497f191c0f31eaac4668aa0219e90c023e5

Scanner detections:
14 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 11:32:35 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Trojan.Heur.jH1@t1XIJMfbh
744

Avira AntiVirus
TR/Spy.1198600
7.11.202.118

AVG
Luhe.Packed
2016.0.3222

Bitdefender
Gen:Trojan.Heur.jH1@t1XIJMfbh
1.0.20.110

Comodo Security
UnclassifiedMalware
20755

Emsisoft Anti-Malware
Gen:Trojan.Heur.jH1@t1XIJMfbh
8.15.01.22.03

F-Prot
W32/SysVenFak.A.gen
v6.4.7.1.166

F-Secure
Gen:Trojan.Heur.jH1@t1XIJMfbh
11.2015-22-01_5

G Data
Gen:Trojan.Heur.jH1@t1XIJMfbh
15.1.24

IKARUS anti.virus
Trojan.Win32.Spy
t3scan.1.8.6.0

McAfee
GenericR-CHL!2D886C798470
5600.6878

MicroWorld eScan
Gen:Trojan.Heur.jH1@t1XIJMfbh
16.0.0.66

Reason Heuristics
PUP.Optional.NetZoneInfoTechCoShanghai
15.1.22.3

VIPRE Antivirus
Trojan.Win32.Generic
36762

File size:
1.1 MB (1,198,600 bytes)

Product version:
1.0.0.0

Copyright:
(C) Microsoft Corporation. All rights reserved.

Original file name:
IEXPLORE.EXE

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, PRC)

Common path:
C:\Windows\System32\iexploer.exe

Digital Signature
Signed by:
NetZone Info-Tech Co., Ltd., Shanghai

Authority:
VeriSign, Inc.

Valid from:
6/11/2012 8:00:00 AM

Valid to:
9/11/2013 7:59:59 AM

Subject:
CN="NetZone Info-Tech Co., Ltd., Shanghai", OU=Provided by TrustAsia, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="NetZone Info-Tech Co., Ltd., Shanghai", L=Shanghai, S=Shanghai, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
10C54DB740DC7E3246F8ED6643930CB7

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:6rikt8ROu/5ZDpARUg0hjOLdrpXHYtaXf:6y/Xpg0hQdrpr

Entry address:
0xC72C0

Entry point:
55, 8B, EC, 83, C4, DC, 33, C0, 89, 45, DC, 89, 45, E0, 89, 45, E8, 89, 45, E4, B8, 88, 6F, 4C, 00, E8, EA, F2, F3, FF, 33, C0, 55, 68, 38, 75, 4C, 00, 64, FF, 30, 64, 89, 20, A1, 50, A1, 4C, 00, 8B, 00, E8, 24, A3, FB, FF, 8B, 0D, 88, A2, 4C, 00, A1, 50, A1, 4C, 00, 8B, 00, 8B, 15, 08, 96, 4A, 00, E8, 24, A3, FB, FF, E8, A7, B7, F3, FF, A3, 50, BD, 4C, 00, A1, 50, BD, 4C, 00, 85, C0, 7E, 48, 89, 45, EC, C7, 05, 4C, BD, 4C, 00, 01, 00, 00, 00, 8D, 55, E4, A1, 4C, BD, 4C, 00, E8, DF, B7, F3, FF, 8B, 45, E4...
 
[+]

Entropy:
6.6933

Developed / compiled with:
Microsoft Visual C++

Code size:
793.5 KB (812,544 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP SSL):
Connects to hn.vtc.vn  (117.103.197.90:443)

TCP (HTTP):
Connects to ec2-54-251-188-175.ap-southeast-1.compute.amazonaws.com  (54.251.188.175:80)

TCP (HTTP):
Connects to ec2-54-235-149-64.compute-1.amazonaws.com  (54.235.149.64:80)

TCP (HTTP):
Connects to ec2-54-225-67-191.compute-1.amazonaws.com  (54.225.67.191:80)

TCP (HTTP SSL):
Connects to xx-fbcdn-shv-01-hkg3.fbcdn.net  (31.13.95.12:443)

TCP (HTTP):
Connects to s-prd-umpxl-adcom-scd-blue-b.evip.aol.com  (149.174.66.131:80)

TCP (HTTP):
Connects to ec2-54-255-228-44.ap-southeast-1.compute.amazonaws.com  (54.255.228.44:80)

TCP (HTTP):
Connects to ec2-54-251-42-76.ap-southeast-1.compute.amazonaws.com  (54.251.42.76:80)

TCP (HTTP):
Connects to ec2-52-76-85-245.ap-southeast-1.compute.amazonaws.com  (52.76.85.245:80)

TCP (HTTP):
Connects to ec2-52-76-222-89.ap-southeast-1.compute.amazonaws.com  (52.76.222.89:80)

TCP (HTTP):
Connects to ec2-52-76-191-53.ap-southeast-1.compute.amazonaws.com  (52.76.191.53:80)

TCP (HTTP):
Connects to ec2-52-45-181-218.compute-1.amazonaws.com  (52.45.181.218:80)

TCP (HTTP):
Connects to ec2-52-35-236-118.us-west-2.compute.amazonaws.com  (52.35.236.118:80)

TCP (HTTP):
Connects to ec2-176-34-26-45.ap-northeast-1.compute.amazonaws.com  (176.34.26.45:80)

TCP (HTTP):
Connects to a23-51-37-163.deploy.static.akamaitechnologies.com  (23.51.37.163:80)

TCP (HTTP SSL):
Connects to a23-201-157-148.deploy.static.akamaitechnologies.com  (23.201.157.148:443)

TCP (HTTP):
Connects to a104-66-19-75.deploy.static.akamaitechnologies.com  (104.66.19.75:80)

TCP (HTTP SSL):
Connects to static.vnpt.vn  (113.171.198.34:443)

TCP (HTTP SSL):
Connects to edge-star-mini-shv-01-hkg3.facebook.com  (31.13.95.36:443)

TCP (HTTP):
Connects to ec2-54-225-199-91.compute-1.amazonaws.com  (54.225.199.91:80)

Remove iexploer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.