home

pci_ven_5333_dev_8d04_subsys_d0001458_rev_00_4_26e5833c_0_0008.exe

oTweak Software LLC

The application pci_ven_5333_dev_8d04_subsys_d0001458_rev_00_4_26e5833c_0_0008.exe by oTweak Software has been detected as a potentially unwanted program by 7 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer.
Publisher:
oTweak Software LLC  (signed and verified)

MD5:
ab8baca9694879893c9de932616f7bfd

SHA-1:
dc8408c40fe5b87467d05b789d1705ebea6d5637

SHA-256:
0c3ee0d8e8316f2b4ea55235f1796c9cb164f3f8569c4ccaaf212e4ac28b82de

Scanner detections:
7 / 68

Status:
Potentially unwanted

Analysis date:
11/16/2024 12:50:23 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.Siggen6.33552
9.0.1.0124

herdProtect (fuzzy)
variant of driverupdaterpro.exe
2015.8.2.10

McAfee
Artemis!66B16EABF7EB
5600.6686

NANO AntiVirus
Riskware.Nsis.Unwanted.dpybkw
0.30.24.1357

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
1.0.0.1015

Trend Micro House Call
Suspicious_GEN.F47V0422
7.2.124

File size:
3.6 MB (3,729,704 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\pci_ven_5333_dev_8d04_subsys_d0001458_rev_00_4_26e5833c_0_0008.exe

Digital Signature
Signed by:
oTweak Software LLC

Authority:
thawte, Inc.

Valid from:
3/5/2015 6:00:00 AM

Valid to:
3/5/2017 5:59:59 AM

Subject:
CN=oTweak Software LLC, O=oTweak Software LLC, L=Rostov-Na-Donu, S=Rostovskaya obl., C=RU

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1BA315B89D1AF7C2CB153F29392B2B78

File PE Metadata
Compilation timestamp:
12/6/2009 4:50:52 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:jwEMAvdm8vYOmxLg4tiR2nUL2MFrC8bGDSd+UnVJ/6e86XDpRpcIrpdF+eHxSzko:sgvdL+xLHqL2MTVJiLYptHii+lNAdVLS

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.