home

prsdemo.exe

OfficeRecovery LLP

Publisher:
OfficeRecovery LLP  (signed and verified)

MD5:
de825ce86330201d1aa4c50edad5b71c

SHA-1:
5bb2448cf5c5f1c0609f93e95e7d543b41872c6d

SHA-256:
f96bd044c3d9f150c91a31baaf52541d7aba737dc19e4760cd6170f1847a3e49

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/28/2024 10:43:20 AM UTC  (today)

File size:
2 MB (2,077,696 bytes)

File type:
Executable application (Win16 EXE)

Common path:
C:\users\{user}\downloads\prsdemo.exe

Digital Signature
Signed by:
OfficeRecovery LLP

Authority:
GoDaddy.com, Inc.

Valid from:
2/27/2014 7:06:40 PM

Valid to:
2/27/2015 7:06:40 PM

Subject:
CN=OfficeRecovery LLP, O=OfficeRecovery LLP, L=Edinburgh, C=GB

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2B94F59EF33D15

File PE Metadata
OS version:
0.65534

OS bitness:
Win16

Linker version:
254.255

CTPH (ssdeep):
49152:5gnozxxt+LjaKjKrc3QS9UVHtfTQGHSvTi:2nQxxQNJ3iH5S

Entry address:
0x200000

Entry point:
D0, CF, 11, E0, A1, B1, 1A, E1, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 3E, 00, 03, 00, FE, FF, 09, 00, 06, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 20, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 10, 00, 00, 02, 00, 00, 00, 02, 00, 00, 00, FE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 7F, 00, 00, 00, 00, 01, 00, 00, 7F, 01, 00, 00, 00, 02, 00, 00, 7F, 02, 00, 00, 00, 03, 00, 00, 7F, 03, 00, 00, 00, 04, 00, 00, 7F, 04, 00, 00, 00, 05, 00, 00, 7F, 05, 00, 00, 00, 06, 00, 00...
 
[+]

Entropy:
7.4887

Code size:
384 KB (393,225 bytes)

Scan prsdemo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.