home

photo_image_collection_album_001.jpg.exe

The executable photo_image_collection_album_001.jpg.exe has been detected as malware by 22 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from www.disaronno.com.
MD5:
249cfca24bd929ef69de8f72a54832cd

SHA-1:
d801620fddf574a534a02adcba2dd356cab9649e

SHA-256:
dd66996086ac0940d112c0a3cca6cb10ae04ea2451c42e010d74c3bd5badb2a1

Scanner detections:
22 / 68

Status:
Malware

Analysis date:
11/23/2024 7:57:06 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1669073
986

AhnLab V3 Security
Trojan/Win32.Fareit
14.05.24

Avira AntiVirus
TR/Crypt.ZPACK.77470
7.11.148.48

AVG
Inject2
2015.0.3464

Bitdefender
Trojan.GenericKD.1669073
1.0.20.720

Dr.Web
Trojan.PWS.Panda.5841
9.0.1.0144

Emsisoft Anti-Malware
Trojan.GenericKD.1669073
8.14.05.24.11

ESET NOD32
Win32/Napolar
8.9771

Fortinet FortiGate
W32/Agent.TQ!tr
5/24/2014

F-Secure
Trojan.GenericKD.1669073
11.2014-24-05_7

G Data
Trojan.GenericKD.1669073
14.5.24

Kaspersky
Backdoor.Win32.Napolar
14.0.0.3815

Malwarebytes
Trojan.Downloader.Upatre
v2014.05.24.11

McAfee
Artemis!249CFCA24BD9
5600.7120

Microsoft Security Essentials
Trojan:Win32/Napolar.A
1.10502

MicroWorld eScan
Trojan.GenericKD.1669073
15.0.0.432

Norman
Agent.BCFRL
11.20140524

Panda Antivirus
Trj/CI.A
14.05.24.11

Qihoo 360 Security
HEUR/Malware.QVM19.Gen
1.0.0.1015

Sophos
Troj/Agent-AGTY
4.98

Trend Micro House Call
TROJ_GEN.F47V0506
7.2.144

VIPRE Antivirus
Trojan.Win32.Generic
28978

File size:
180 KB (184,320 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\photo_image_collection_album_001.jpg.exe

File PE Metadata
Compilation timestamp:
5/1/2014 3:34:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:hWSusstzV9dJtNtj9s3h+sgbM5QOXS2FBxTZpiggz4ASt84mJQOMAlodSrnZ:IntZ99nJ8h+QVS2Fl4T4/84WQOMzS1

Entry address:
0x3671

Entry point:
55, 8B, EC, 89, 1D, F0, 60, 40, 00, BB, F2, 60, 40, 00, EB, 45, 90, 8D, 05, 00, 61, 40, 00, D1, E8, F6, DB, 89, 0D, 10, 61, 40, 00, 1B, DB, 83, E3, F2, 81, C3, 10, 01, 00, 00, 66, 89, 1D, 20, 61, 40, 00, 90, D3, 1D, 30, 61, 40, 00, 41, 00, F7, 90, 41, 00, 0D, 40, 61, 40, 00, 90, 41, 00, 3D, 50, 61, 40, 00, 90, B9, 60, 61, 40, 00, 00, FF, B8, 23, 60, 40, 00, 41, 00, D3, 90, 41, 00, D3, B9, FE, FF, FF, FF, B9, 60, 61, 40, 00, 56, 8B, D8, 57, 36, 8B, 78, 08, 90, 90, 40, 40, 6B, C0, 28, 3D, C8, 00, 00, 00, 7E...
 
[+]

Entropy:
7.6425

Developed / compiled with:
Microsoft Visual C++

Code size:
12 KB (12,288 bytes)

The file photo_image_collection_album_001.jpg.exe has been seen being distributed by the following URL.

http://www.disaronno.com/?bqea02s0e=992f26b2a7307b84141f4c4

Remove photo_image_collection_album_001.jpg.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.