» iImportLib.dll
Overview
Analysis
File Details
Programs (1)

iImportLib.dll

Picexa Viewer

Taiwan Shui Mu Chih Ching Technology Limited

The file iImportLib.dll by Taiwan Shui Mu Chih Ching Technology Limited has been detected as adware by 5 anti-malware scanners. This file is typically installed with the program Picexa by Taiwan Shui Mu Chih Ching Technology Limited.. It is also typically executed from the user's temporary directory.

File name:

iImportLib.dll

Publisher:

Taiwan Shui Mu Chih Ching Technology Limited (signed and verified)

Product:

Picexa Viewer

Description:

iImportLib

Version:

2.1.3.278

MD5:

0b0f2f15b4115bfe5a74e93ea8c02856

SHA-1:

851cc213d8c81a9a07531451f354fa400b3e888d

SHA-256:

9c6dccd65daecfb57866b5977a46bf0a618d2fadd6bbf89729915a6c7d827e62

Scanner detections:

5 / 68

Status:

Adware

Analysis date:

11/4/2024 4:53:50 PM UTC (today)

Scan engine

Detection

Engine version

AVG

Generic

2016.0.3158

Bkav FE

W32.HfsAdware

1.3.0.6379

Dr.Web

Adware.Mutabaha.229

9.0.1.085

herdProtect (fuzzy)

variant of iimportlib.dll (Adware)

2015.7.1.8

Reason Heuristics

PUP.Thinknice

15.3.26.12

File size:

1.3 MB (1,327,288 bytes)

Product version:

2.1.3.278

Original file name:

iImportLib.dll

Common path:

C:\users\{user}\appdata\local\temp\_@68cc.tmp

Digital Signature

Signed by:

Taiwan Shui Mu Chih Ching Technology Limited

Authority:

GlobalSign nv-sa

Valid from:

3/4/2015 11:26:37 AM

Valid to:

3/4/2016 11:26:37 AM

Subject:

CN=Taiwan Shui Mu Chih Ching Technology Limited, O=Taiwan Shui Mu Chih Ching Technology Limited, L=Taipei City, S=Taiwan, C=TW

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121003857AB2AD439A7293EF2F1A8B3DCB6

File PE Metadata

Compilation timestamp:

3/24/2015 9:16:41 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:hCdMdnQnl/uf+2Gdt2TRITPx5pgEIuytJlO8zGtvY5m9lT+xL1ZRCrvkJIiPb:4dEn+FuEdcTRIT55pgnH0HvCm9lTWL1/

Entry address:

0xD0D54

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 7F, 03, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 10, 68, A8, 65, 10, 10, E8, 3D, 01, 00, 00, 33, C0, 40, 8B, F0, 89, 75, E4, 33, DB, 89, 5D, FC, 8B, 7D, 0C, 89, 3D, 20, 20, 13, 10, 89, 45, FC, 85, FF, 75, 0C, 39, 3D, 44, 57, 13, 10, 0F, 84, D4, 00, 00, 00, 3B, F8, 74, 05, 83, FF, 02, 75, 38, A1, D0, 04, 0E, 10, 85, C0, 74, 0E, FF, 75, 10, 57, FF, 75, 08, FF, D0, 8B, F0, 89, 75, E4, 85, F6, 0F, 84, B1, 00, 00, 00... 
[+]

Entropy:

6.3170

Developed / compiled with:

Microsoft Visual C++

Code size:

886.5 KB (907,776 bytes)

The file iImportLib.dll has been discovered within the following program.

Picexa by Taiwan Shui Mu Chih Ching Technology Limited.

About 2% of users remove it

Remove iImportLib.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.