home

phonerescue-64-setup.exe

PhoneRescue

iMobie Inc.

The executable phonerescue-64-setup.exe, “PhoneRescue Setup ” has been detected as malware by 8 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from dl.imobie.com.
Publisher:
iMobie Inc.

Product:
PhoneRescue

Description:
PhoneRescue Setup

Version:
2.1.1

MD5:
433cc9efb83ef8299a1eff9a93dad72d

SHA-1:
8b775e3221fd1d2240ae8aace88342ff382e8027

SHA-256:
e17ed627b4ab4abdf8253940d4033fa615c0e072859c334b3ef841458e5245a4

Scanner detections:
8 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
11/14/2024 1:57:20 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160518-2

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.E.gen
4.6.5.141

F-Secure
Win32.Sality.3
5.15.96

Microsoft Security Essentials
Threat.Undefined
1.223.2652.0

Norman
Win32.Sality.3
28.05.2016 15:32:18

File size:
4.4 MB (4,645,872 bytes)

Product version:
2.1.1

Copyright:
iMobie Inc.

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\phonerescue-64-setup.exe

File PE Metadata
Compilation timestamp:
7/9/2014 7:58:13 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:KWsoIHJVA+lV38NvlVD48ggnh2m+ZmbT10Iu+rLjYh:KrI+laNv71h2mgmm2rLm

Entry address:
0x113BC

Entry point:
88, CD, 87, F1, BB, 4E, 99, 9B, 96, 0F, B7, C2, 20, CD, 88, D0, 40, 89, D2, 81, ED, 0A, 9B, 01, 00, 0F, BE, D6, 81, C5, 98, B4, 00, 00, 0F, B7, D3, 10, E6, 68, 0F, 49, 4C, 00, 21, F5, 6B, C9, 00, 14, 0B, 0F, B7, DF, F7, C7, DD, F4, 30, B1, C6, C7, E5, 80, F2, 30, 81, C1, B9, F0, FF, FF, 43, 18, CF, 69, FF, C7, 2B, F4, C5, 81, C1, 48, 0F, 00, 00, 0F, B6, FA, C6, C2, C4, 84, D8, 81, F9, 21, 01, 00, 00, 0F, 8C, C6, FF, FF, FF, 0F, AF, E9, 68, 35, 26, 9B, 00, 50, B7, B5, E8, 23, 00, 00, 00, B0, 48, 69, C8, CF...
 
[+]

Code size:
63.5 KB (65,024 bytes)

The file phonerescue-64-setup.exe has been seen being distributed by the following URL.

http://dl.imobie.com/phonerescue-64-setup.exe

Remove phonerescue-64-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.