home

konboot_usb.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from zbigz.com and multiple other hosts.
MD5:
eb9e6531d9eacdbe5474da9d6b73d99e

SHA-1:
c9bc8f97aa3c17eda05c49ce8305f69c2cfa6e98

SHA-256:
d9c9f383586f2fd33c7e95e95477765f41cf8c1c9317963faafb9c2804c715bf

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
11/30/2024 9:12:28 AM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
HKTL_KONBOOT
7.2.50

Trend Micro
HKTL_KONBOOT
10.465.19

File size:
54.5 KB (55,808 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\kon-bootusb\konboot_usb.exe

File PE Metadata
Compilation timestamp:
3/2/2012 2:47:36 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
9.0

CTPH (ssdeep):
768:0atpxYFNo6wyhy0eFx3Qq3xNPDZH5J0Z6rmRVdz5Tg:/btyUxFx3Q8PDZZJjmRj50

Entry address:
0x14FA

Entry point:
E8, 31, 29, 00, 00, E9, A4, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 38, E0, 40, 00, 89, 0D, 34, E0, 40, 00, 89, 15, 30, E0, 40, 00, 89, 1D, 2C, E0, 40, 00, 89, 35, 28, E0, 40, 00, 89, 3D, 24, E0, 40, 00, 66, 8C, 15, 50, E0, 40, 00, 66, 8C, 0D, 44, E0, 40, 00, 66, 8C, 1D, 20, E0, 40, 00, 66, 8C, 05, 1C, E0, 40, 00, 66, 8C, 25, 18, E0, 40, 00, 66, 8C, 2D, 14, E0, 40, 00, 9C, 8F, 05, 48, E0, 40, 00, 8B, 45, 00, A3, 3C, E0, 40, 00, 8B, 45, 04, A3, 40, E0, 40, 00, 8D, 45, 08, A3, 4C, E0, 40...
 
[+]

Code size:
35.5 KB (36,352 bytes)

The file konboot_usb.exe has been seen being distributed by the following 6 URLs.

http://zbigz.com/file/.../13

https://doc-10-0c-docs.googleusercontent.com/docs/securesc/io8m7g5tr6vqo2iljdki6jv12ellfm3p/6gk4vqes9vmailfdsshn5aec316t618f/1465380000000/10479336586672501430/.../0B3WBwc2mVO5iQTRWZXgtZkdzdnc?e=download

https://doc-0k-ao-docs.googleusercontent.com/docs/securesc/erqb3tan5o1bp9dksl7id8qunt8dd4oa/ovi7ivn3gsmuemkb88sk3hgb65okldcs/1464278400000/10479336586672501430/.../0B3WBwc2mVO5iQTRWZXgtZkdzdnc?e=download

https://doc-14-3c-docs.googleusercontent.com/docs/securesc/fl3c8dfm3p4la3irma13dul19fi3r6ue/spdgr1127p75qno160e14au30o16ifsq/1463832000000/10479336586672501430/.../0B3WBwc2mVO5iQTRWZXgtZkdzdnc?e=download

https://doc-10-ak-docs.googleusercontent.com/docs/securesc/n1r29h9hqqqsdpf55uqelq8mjs3jodsg/u6pdeb0br83ckhqeimu1sohripaumu3c/1461988800000/10479336586672501430/.../0B3WBwc2mVO5iQTRWZXgtZkdzdnc?e=download&nonce=a243jtlg69ggm&user=13906450157015764162&hash=l99fibb9i08iptvhulbre90gicudqj0r

https://drive.google.com/uc?id=0B3WBwc2mVO5iQTRWZXgtZkdzdnc&export=download

Scan konboot_usb.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.