home

java-runtime-environment_17025_32bit.exe

Win

Microsoft

The executable java-runtime-environment_17025_32bit.exe has been detected as malware by 8 anti-virus scanners. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from f30.softwaretop.net.
Publisher:
Microsoft

Product:
Win

Version:
1.00

MD5:
3afda97f598bfa998bcb0f5700fb4aca

SHA-1:
dd2703471fc26951cb50c08ddf1d57870759cb8b

SHA-256:
f94d8bcd4ba6fb2bc5459a9c550d38eb7618b9fd07fa95b65ade9c0ea491d2c0

Scanner detections:
8 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/25/2024 1:16:54 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160503-1

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

Kaspersky
Virus.Win32.Sality
15.0.0.562

Microsoft Security Essentials
Threat.Undefined
1.225.837.0

Norman
Win32.Sality.3
28.05.2016 15:32:18

VIPRE Antivirus
Threat.4758034
29708

File size:
287.8 KB (294,718 bytes)

Product version:
1.00

Original file name:
Win.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
6/15/2011 2:01:16 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:QvEs2U+T6i5LirrllHy4HUcMQY6aOUOdaxDfmY02:KEsN+T5xYrllrU7QY6aOldaJfX02

Entry address:
0x3670

Entry point:
F7, DA, 8B, D3, 88, DF, 0F, C9, 69, DE, C8, 43, 50, 1F, BD, D2, 26, 00, 00, 87, D8, 81, C5, 50, 08, 00, 00, B8, B5, A4, 23, 48, F7, C5, 1E, 87, 4C, 25, 2C, FB, 68, BA, 09, 19, 00, 51, 8D, 35, EF, 3D, F2, 56, E8, 00, 00, 00, 00, 59, 0F, 6E, D1, 87, C2, C7, C6, 52, 9B, 03, A7, 0F, BE, D2, 81, FB, 03, 27, 00, 00, 77, 03, 0F, BF, CB, 14, 48, BE, 0E, 78, 0A, 00, 25, FC, E0, ED, B3, 81, F6, AA, 75, 0A, 00, 76, 10, F7, C0, C5, 84, 94, 1A, 0F, AF, CF, 45, 8D, 0D, B1, DF, D3, 02, 87, FE, 01, C8, 81, EF, 82, 04, 00...
 
[+]

Entropy:
6.8758

Code size:
172 KB (176,128 bytes)

The file java-runtime-environment_17025_32bit.exe has been seen being distributed by the following URL.

http://f30.softwaretop.net/2107tmp/cf/soft/2013/8/ba/.../java-runtime-environment_17025_32bit.exe

Remove java-runtime-environment_17025_32bit.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.