home

max_tfile_ru_torrent.exe

WinRAR

IKO-PROF

The application max_tfile_ru_torrent.exe, “32 bit rarext.dll loader” by IKO-PROF has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
Alexander Roshal  (signed by IKO-PROF)

Product:
WinRAR

Description:
32 bit rarext.dll loader

Version:
3.92.0

MD5:
fd9ccf045a26435689f914f54319fcaa

SHA-1:
63ed310340f8d77a7c1c3047cb4d08b2dae04318

SHA-256:
b54cbd9ce8ffa97e9d5db66e64a046802847c4e888896fa3d3ab496e707f920f

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 4:58:45 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Somoto (M)
17.2.22.17

File size:
969 KB (992,256 bytes)

Copyright:
Copyright © Alexander Roshal 1993-2010

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\max_tfile_ru_torrent.exe

Digital Signature
Signed by:
IKO-PROF

Authority:
COMODO CA Limited

Valid from:
8/26/2015 2:00:00 AM

Valid to:
8/26/2016 1:59:59 AM

Subject:
CN="""IKO-PROF"", OOO", O="""IKO-PROF"", OOO", STREET="2-y Luch, 16 Ofis, 45", L=Saint-Petersburg, S=Saint-Petersburg, PostalCode=192019, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BC2915F4441B9D8AC34D01058C89EAE7

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x64AA0

Entry point:
C7, 05, 34, D0, 46, 00, 4A, 53, 43, 52, C7, 05, 38, D0, 46, 00, 49, 50, 54, 2E, C7, 05, 3C, D0, 46, 00, 44, 4C, 4C, 20, 6A, 01, 6A, 00, 68, 34, D0, 46, 00, E8, 14, 0C, 00, 00, 85, C0, 75, 05, E9, 5F, 00, 00, 00, 68, 28, 4B, 46, 00, E9, 08, 05, 00, 00, 8B, 4C, 25, 00, 8B, 44, 25, 04, 81, C5, 08, 00, 00, 00, F8, 81, FF, DB, 06, ED, 5A, 36, 89, 01, 8B, 06, 81, C6, 04, 00, 00, 00, 66, 85, F8, 33, C3, F5, D1, C8, F7, D8, F9, F7, D0, 8D, 80, C5, 7C, 31, 0D, 3D, 8A, 28, B0, 72, 33, D8, 03, F8, 57, C3, FF, E7, 5F...
 
[+]

Code size:
867 KB (887,808 bytes)

Remove max_tfile_ru_torrent.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.