home

keygen.exe

MD5:
6e9bef2220f2c467044c2d49a82acc06

SHA-1:
6f770d78c407a16f3e493e86e4a4e8a465c9157a

SHA-256:
aeb8c949eca54d04dfeecac5478101f3d5f2cee49afe28d75603f8324bcbfa36

Scanner detections:
12 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/5/2024 2:40:29 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clod9a7.Trojan
1.3.0.4959

Comodo Security
UnclassifiedMalware
18046

IKARUS anti.virus
not-a-virus.Keygen.Bandicam
t3scan.2.2.29

McAfee
RDN/Generic.grp!fl
5600.7170

NANO AntiVirus
Trojan.Win32.Rogue.cvxrpp
0.28.0.58873

Norman
Suspicious_Gen4.DOJMN
11.20140404

Quick Heal
Win32.PWS.Zbot.4
4.14.12.00

Rising Antivirus
PE:Trojan.Win32.Generic.147E8EE8!343838440
23.00.65.14402

SUPERAntiSpyware
Trojan.Agent/Gen-Zbot
10686

Trend Micro House Call
TROJ_SPNR.03FD13
7.2.94

Trend Micro
TROJ_SPNR.03FD13
10.465.04

VIPRE Antivirus
Trojan.Win32.Generic
28016

File size:
48.5 KB (49,664 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\keygen.exe

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.12

CTPH (ssdeep):
768:RfOZAFYyCxgLa1LknsEjhwAQMYISSMtWnQ7Us7:RmZAFYILapqRmDMOSo7UE

Entry address:
0x21A1

Entry point:
E8, 12, 03, 00, 00, 6A, 00, E8, C9, 02, 00, 00, A3, 10, 63, 40, 00, 68, 48, 50, 40, 00, 6A, 00, 6A, 00, E8, 9E, 02, 00, 00, E8, AB, 02, 00, 00, 3D, B7, 00, 00, 00, 74, 16, 6A, 00, 68, E3, 1F, 40, 00, 6A, 00, 6A, 64, FF, 35, 10, 63, 40, 00, E8, E2, 02, 00, 00, 50, E8, 7C, 02, 00, 00, 55, 8B, EC, 83, C4, F4, 68, 5C, 52, 40, 00, FF, 75, 0C, 6A, 00, E8, 97, 02, 00, 00, 89, 45, FC, 50, 6A, 00, E8, 92, 02, 00, 00, 50, E8, 92, 02, 00, 00, 89, 45, F4, FF, 75, FC, 6A, 00, E8, 91, 02, 00, 00, 89, 45, F8, 83, 7D, F8...
 
[+]

Entropy:
6.4082

Code size:
5.5 KB (5,632 bytes)

The file keygen.exe has been seen being distributed by the following 39 URLs.

http://d1.share.az/files/4/.../keymaker.exe

http://d1.share.az/files/2/.../keymaker.exe

http://d1.share.az/files/2/.../keymaker.exe

http://d1.share.az/files/7/.../keymaker.exe

https://s04.solidfilesusercontent.com/YjIyNTBjOWMwYjZhNjM5MDA4ZTJmNDA2Yzg0OTE1MmNmZDk4YzQxYjoxYlhrVzA6U0hIRUY3MWZ1Um52TUxMX2VzR1lMa043NnpF/.../keymaker_Bandicam_[_DreamL7_].exe

http://dosya.co/.../Keymaker.exe.html

https://cloclo9.cldmail.ru/26Vh4rej42GAfLWkg36V/G/.../keymaker.exe

http://d1.share.az/files/1/.../keymaker.exe

https://s03.solidfilesusercontent.com/OWVmYTBiOTgxNTdlMzg5YTMxYjU3OTAxYzBmZjk5MzhlMWQ1OWI5ZDoxYXRwdHo6Tmc5WjFqZWxqRjB0dEJiV0JQLVRCQTlwSEgw/.../keymaker_Bandicam_[_DreamL7_].exe

https://cloclo28.cldmail.ru/tWMygBoiFXMX4N42GwG/G/.../keymaker.exe

https://cloclo3.cldmail.ru/RmKvdCchewzKXCGssmx/G/.../keymaker.exe

https://cloclo19.cldmail.ru/2e5MZSPTQJJcwUsHeJA2/G/.../keymaker.exe

https://mega.nz/temporary/.../Vk9Czb5D

http://venus.workupload.com/.../VAQKR2tA

http://d1.share.az/files/6/.../keymaker.exe

https://cloclo38.cldmail.ru/cBZU5xeWy39saCkm24b/G/.../keymaker.exe

http://www13.zippyshare.com/d/qv1ZS4sO/.../keymaker.exe

http://d1.share.az/files/8/.../keymaker.exe

https://cloclo18.cldmail.ru/2xhqw39gaXwosQaTidYR/G/.../keymaker.exe

http://dc476.4shared.com/download/.../Keygen.exe

http://www.yourfilelink.com/.../direct.php

https://cloclo27.cldmail.ru/21n9ASBZHPLuMmFaLFWy/G/.../keymaker.exe

http://d1.share.az/files/6/.../keymaker.exe

https://cloclo15.cldmail.ru/CWDRDcbG69AWNdd53VX/G/.../keymaker.exe

https://doc-08-7s-docs.googleusercontent.com/docs/securesc/f5sk5c509s21qduplnno4lgv15nlb016/inlvqf902g5sti0tbapdncip0u0eu463/1458554400000/17950267198693085222/.../0B74nlik6I2NSWXM3V0E3T2hoemM?e=download

https://cloclo11.cldmail.ru/Yu32qRqhxT16xxaHCBK/G/.../keymaker.exe

http://d1.share.az/files/9/.../keymaker.exe

http://dc664.4shared.com/download/.../Keygen.exe

https://cloclo22.cldmail.ru/YL9ksQJNSgQNDxtcTqM/G/.../keymaker.exe

https://cloclo11.cldmail.ru/UKRBrhyvC4sx7ew1ew6/G/.../keymaker.exe

Latest 30 of 39 download URLs

Scan keygen.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.