» Office Trial Extender.exe
Overview
Analysis
File Details
Programs (1)
Network (1)

Office Trial Extender.exe

Office Trial Extender

Jonas Zimmermann

The application Office Trial Extender.exe by Jonas Zimmermann has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program Office Trial Extender by pXc-coding.com. While running, it connects to the Internet address smokey.speakuhb0x.org on port 80 using the HTTP protocol.

File name:

Publisher:

pXc-coding.com (signed by Jonas Zimmermann)

Product:

Office Trial Extender

Version:

1.0.0.7

MD5:

b43cd294987a34a3b78e78aee8418fbe

SHA-1:

f7fe30dc5ecc71a933faf5498539bf8b6d95f98a

SHA-256:

81a2120b2a8e8a385624af2cae877a76bb5c7de1704accdbac5bd6fe1fb52041

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

11/5/2024 8:25:43 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.JonasZimmermann.V

14.7.27.14

File size:

98.6 KB (100,952 bytes)

Product version:

1.0.0.7

Original file name:

Office Trial Extender.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\office trial extender\office trial extender.exe

Digital Signature

Signed by:

Jonas Zimmermann

Authority:

COMODO CA Limited

Valid from:

3/14/2013 1:00:00 AM

Valid to:

3/15/2014 12:59:59 AM

Subject:

CN=Jonas Zimmermann, O=Jonas Zimmermann, STREET=Bellmannskamp 16, L=Lüneburg, S=Niedersachsen, PostalCode=21339, C=DE

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

0097B0E4EDFB699A04297A473C70575E9F

File PE Metadata

Compilation timestamp:

3/19/2013 8:20:19 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

1536:3gMw3VTzgdtVCZ9taR4EzA9AZHkGfugMw3VTzgdtVCZ9taFhEftS6:OVXgdtoZXvwA9uEyLVXgdtoZXxfc6

Entry address:

0x1069E

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

6.0160

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

58 KB (59,392 bytes)

The file Office Trial Extender.exe has been discovered within the following program.

Office Trial Extender by pXc-coding.com

Publisher's description - “Microsoft Office 2010 and 2013 need to be activated after 30 days. They can be rearmed 5 times, every rearm gives you additionally 30 days to activate / evaluate the product.”

pxc-coding.com/portfolio/office-trial-extender

About 18% of users remove it

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to smokey.speakuhb0x.org (205.185.118.178:80)

Remove Office Trial Extender.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.