home

installver.exe

RecentX

Conceptworld Corporation

The executable installver.exe, “RecentX Setup ” has been detected as malware by 14 anti-virus scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from volafile.io.
Publisher:
Conceptworld Corporation   (signed by Conceptworld Corporation)

Product:
RecentX

Description:
RecentX Setup

Version:
0.00

MD5:
6d5b92d729134957b4ca13b7e1825ef1

SHA-1:
c656310bde62295e609dac739b12f6497ab8bd7c

SHA-256:
8b926500336aa6f94bc3c1d9349d9085d66613223d8e2e7d2de339de71086caa

Scanner detections:
14 / 68

Status:
Malware

Analysis date:
11/23/2024 10:26:41 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Dropper.VB.vjef
8.3.3.4

avast!
Win32:Malware-gen
2014.9-161111

ESET NOD32
Win32/Injector.CXQU (variant)
10.13621

Fortinet FortiGate
W32/Injector.CZOJ!tr
11/11/2016

G Data
Win32.Trojan.Agent.25HVVO
16.11.25

IKARUS anti.virus
Trojan.Win32.Injector
t3scan.2.0.9.0

K7 AntiVirus
Trojan
13.227.19869

Kaspersky
Trojan.Win32.VBKryjetor
14.0.0.-691

Malwarebytes
Spyware.PasswordStealer.XGen
v2016.11.11.02

McAfee
Artemis!6D5B92D72913
5600.6219

Panda Antivirus
Trj/GdSda.A
16.11.11.02

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1120

Rising Antivirus
Trojan.Injector!8.C4-CLjG70F1n3H (Cloud)
23.00.65.161109

Sophos
Mal/Generic-S
4.98

File size:
1.7 MB (1,786,928 bytes)

Product version:
0.00

Original file name:
RecentXSetup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\installver.exe

Digital Signature
Signed by:
Conceptworld Corporation

Authority:
COMODO CA Limited

Valid from:
3/17/2014 1:00:00 AM

Valid to:
3/17/2017 12:59:59 AM

Subject:
CN=Conceptworld Corporation, O=Conceptworld Corporation, STREET=F6 Siddharth Palace, STREET="9 & 10 Vepery Church Road,", STREET=Vepery, L=Chennai, S=Tamil Nadu, PostalCode=600007, C=IN

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00FA9A20940DA7B46243F58FF28E58A615

File PE Metadata
Compilation timestamp:
6/2/2016 2:10:05 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:DOTKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKpl5WOGlKbF+fp4fJ/0NGtpP6vsEM:Dx5WOG8QfufJMCYEEcS6Xx3E7LQ5

Entry address:
0x11E0

Entry point:
68, 4C, D3, 5A, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 7A, FA, 76, 44, 34, 9F, 75, 42, 83, 52, B5, 36, BC, 04, 04, BD, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 45, B5, BA, B5, 55, B5, 76, 62, 34, 70, 72, 6F, 6A, 65, 63, 74, 56, 62, 00, B5, B5, B5, 00, 00, 00, 00, FF, CC, 31, 00, 03, BD, DE, D2, 11, A8, 12, 94, 45, 9D, 73, 30, FE, 6D, 8A, 22, 70, 3B, 3C, 5C, 98, 7C, A6, 02, 4A, 8F, 92, B9, D7, 1E, 70, D3, D4, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
1.7 MB (1,765,376 bytes)

The file installver.exe has been seen being distributed by the following URL.

https://volafile.io/get/.../installver.exe

Remove installver.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.