home

office-2013-crack.exe

The application office-2013-crack.exe has been detected as a potentially unwanted program by 25 anti-malware scanners. This is a setup program which is used to install the application. This is a malicious Bitcoin miner. Bitcoin-mining malware is designed to force computers to generate Bitcoins for cybercriminals' use and consumes computing power. The file has been seen being downloaded from www.ulozto.cz.
MD5:
e56ae16cc15405debf41862bf6efdda2

SHA-1:
b607ed2acc077c7945fa806fca6d09849ba3dfe9

SHA-256:
6d6a9d97fe75fdf8a1341419e9f6fa6e2aa2e0a1bdbe781caedab7e0d9127253

Scanner detections:
25 / 68

Status:
Potentially unwanted

Explanation:
The program will mine for BitCoins using the computer's GPU in the background and may be installed and run without the user's knowledge.

Analysis date:
12/26/2024 8:46:17 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.BitCoinMiner.BM
894

Agnitum Outpost
RiskTool.BitCoinMiner
7.1.1

Avira AntiVirus
SPR/Miner.fsv
7.11.168.254

avast!
Win32:Dropper-gen [Drp]
140813-1

AVG
Trojan horse CoinMiner.AOK
2014.0.4007

Bitdefender
Application.BitCoinMiner.BM
1.0.20.1185

Comodo Security
ApplicUnsaf.Win64.RiskTool.BitCoinMiner.A
19306

Dr.Web
Threat.Undefined
9.0.1.05190

Emsisoft Anti-Malware
Application.BitCoinMiner.BM
9.0.0.4324

ESET NOD32
Win64/BitCoinMiner.U potentially unsafe application
7.0.302.0

F-Secure
Trojan.BAT.Miner.C
11.2014-25-08_2

G Data
Application.BitCoinMiner.BM
14.8.24

K7 AntiVirus
Riskware
13.183.13139

Kaspersky
not-a-virus:RiskTool.Win64.BitCoinMiner
15.0.0.463

Malwarebytes
Riskware.BitcoinMiner
v2014.08.25.02

McAfee
RDN/Generic PUP.x!bmb
5600.7028

MicroWorld eScan
Application.BitCoinMiner.BM
15.0.0.711

NANO AntiVirus
Riskware.Win64.BitCoinMiner.cqywam
0.28.2.61721

nProtect
Trojan.BAT.Miner.C
14.08.24.01

Panda Antivirus
HackTool/BitCoinMiner.A
14.08.25.02

Qihoo 360 Security
virus.vbs.runner.q
1.0.0.1015

Quick Heal
RiskTool.BitCoinMiner.r9
8.14.14.00

Rising Antivirus
PE:Trojan.Win32.Generic.1581FB9C!360840092
23.00.65.14823

Sophos
CpuMiner
4.98

VIPRE Antivirus
Threat.4150696
32210

File size:
4.7 MB (4,911,057 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\office-2013-crack.exe

File PE Metadata
Compilation timestamp:
2/17/2012 3:55:26 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:gVHoxgEdfpVcsBKTXuF/WWKUVkY3YMjN+sZU3xSWm2rPQdIH3mYcgdU:U3KfzcfTXuNKUVkYoaN+sgxtbXXmYxO

Entry address:
0x9F40

Entry point:
E8, 1E, FF, FF, FF, 33, C0, 50, 50, 50, 50, E8, 5D, 2C, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, DB, 96, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 1C, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 1C, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, D8, 9A, FF, FF, C3, 55, 8B, EC, 83, EC, 1C, 56, 33, F6, 56, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 18, F2, 40, 00, 85, C0, 74, 21, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 1C, F2, 40, 00, 8D, 45, E4...
 
[+]

Code size:
52.5 KB (53,760 bytes)

The file office-2013-crack.exe has been seen being distributed by the following URL.

http://www.ulozto.cz/.../office-2013-crack-exe?do=directDownload

Remove office-2013-crack.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.