home

removewga.exe

The application removewga.exe has been detected as a potentially unwanted program by 12 anti-malware scanners. The file has been seen being downloaded from lb.cdn.m6web.fr and multiple other hosts.
MD5:
3b6a1f6ad4b8141b1aed8644d789706f

SHA-1:
8da3bf220f6853d9b742706dce4ef39212e39243

SHA-256:
9677bc600745900c6f4c20a75792486a4abbf3b7238902927f52b23b58e1d829

Scanner detections:
12 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 1:36:01 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:HackTool-CB [PUP]
2014.9-131223

AVG
Tool
2014.0.3616

Bkav FE
W32.MalwarespyM.Trojan
1.3.0.4613

Comodo Security
ApplicUnsaf.Win32.WGAKill.~
17488

Dr.Web
Tool.RemoveWGA
9.0.1.0357

IKARUS anti.virus
not-a-virus.Risktool.RemoveWGA
t3scan.2.2.29

Malwarebytes
PUP.RemoveWGA
v2013.12.23.10

NANO AntiVirus
Riskware.Win32.RemoveWGA.cimpjb
0.28.0.57029

Sophos
RemoveWGA
4.96

SUPERAntiSpyware
Trojan.Agent/Gen-PatchPak
10889

Total Defense
Win32/Prigamb.A
37.0.10657

XVirus List
Win.Detected
2.3.31

File size:
13.5 KB (13,824 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\Local settings\temp\removewga.exe

File PE Metadata
Compilation timestamp:
7/25/2006 11:52:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.50

CTPH (ssdeep):
192:OOLvpA5iyFAyCM1UdjRpV3aNa236dKNHkoy0/qaNDm20GKm/kAKAn6:tLBGiyy24jj3233bNDCZq6

Entry address:
0xDA30

Entry point:
60, BE, 15, B0, 40, 00, 8D, BE, EB, 5F, FF, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75...
 
[+]

Entropy:
7.4745

Packer / compiler:
UPX 2.90LZMA]

Code size:
12 KB (12,288 bytes)

The file removewga.exe has been seen being distributed by the following 50 URLs.

http://lb.cdn.m6web.fr/d/c/a/46a6b1e0c41ab14b50566c01759e6c65/5826c9c7/soft/.../removewga_removewga_1.2_anglais_21437.exe

https://softpedia-secure-download.com/dl/2a761b4e23e6c0581f21e784a94407af/58981be6/100042782/software/.../removewga.exe

http://download.softpedia.com/dl/c9a6e9a4e7ef3a6a38ad85dbc4d64606/583aecd1/100042782/software/.../removewga.exe

http://lb.cdn.m6web.fr/d/c/a/ce33269040cd264b4f6c073abaecccff/580d3156/soft/.../removewga_removewga_1.2_anglais_21437.exe

http://lb.cdn.m6web.fr/d/c/a/c6a7f715f266bcd963cecfff065d1522/587a08fd/soft/.../removewga_removewga_1.2_anglais_21437.exe

http://www.majorgeeks.com/index.php?ct=files&action=download&PHPSESSID=juerk72mb8cv6hn8nb24c6vpt6

http://download1us.softpedia.com/dl/1fd69bad4f34bd974e0ca39df8bcf295/5242b397/100042782/software/.../removewga.exe

http://lb.cdn.m6web.fr/d/c/a/da0deffea7f24c4a591243459df736a3/57c55d5a/soft/.../removewga_removewga_1.2_anglais_21437.exe

http://download.softpedia.com/dl/b716a245bf501c2d3b1f29918374bfd8/56eca5e2/100042782/software/.../removewga.exe

http://download.softpedia.com/dl/6f144dd7ac521c95a75c7ed1f40b39db/583c7e8b/100042782/software/.../removewga.exe

http://www.aspec.mx/wxpa.exe

http://lb.cdn.m6web.fr/d/c/a/3d78a8d1506ef51d58dedfa856969b24/586533cf/soft/.../removewga_removewga_1.2_anglais_21437.exe

http://www.majorgeeks.com/index.php?ct=files&action=download&PHPSESSID=kpjg5e3mi85a8pa7eo6gh3ldi6

http://lb.cdn.m6web.fr/d/c/a/74d27620df31bbd4fa36a0a8c345b871/56df2065/soft/.../removewga_removewga_1.2_anglais_21437.exe

https://softpedia-secure-download.com/dl/de18d5c2932fe4494dfcd050b4d5e9f3/585f837c/100042782/software/.../removewga.exe

http://ec.ccm2.net/it.ccm.net/download/.../removewga-1.2.exe

http://lb.cdn.m6web.fr/d/c/a/5a9a14b33c2eca3b1799cd51eb5ebed4/5824786e/soft/.../removewga_removewga_1.2_anglais_21437.exe

http://download.softpedia.com/dl/080ca4f39987dafac44edd9e738f731e/5655c9f1/100042782/software/.../removewga.exe

http://www75.zippyshare.com/d/46506123/.../RemoveWGA.exe

http://download.softpedia.com/dl/c077972ae93a0c37e9d0e16bb15cbf60/5762784b/100042782/software/.../removewga.exe

http://dc337.4shared.com/download/.../RemoveWGA.exe

http://serwisruda.pl/removewga.exe

http://www.mediafire.com/download/.../f420a6c5.exe

http://download.softpedia.com/dl/ed4e945fa051bfc2a082446fda9555af/58324526/100042782/software/.../removewga.exe

http://download.softpedia.com/dl/c8bb132ee002c2688f5b31066e716873/579d2c4c/100042782/software/.../removewga.exe

http://download.softpedia.com/dl/9429a5545ae657f62de4f23f42e42cb7/56cae275/100042782/software/.../removewga.exe

http://download.softpedia.com/dl/8aa179e6ca0600764c8b5dc48809155b/5804c851/100042782/software/.../removewga.exe

http://download.softpedia.com/dl/0b2b6de0f5bb9babcd48a9f6bc42968a/58151628/100042782/software/.../removewga.exe

http://jetelecharge.free.fr/.../remove_wga.exe

http://www.majorgeeks.com/index.php?ct=files&action=download&PHPSESSID=cgiic8rufid6rnchi7gi1tr2o6

Latest 30 of 124 download URLs

Remove removewga.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.