home

roguekiller.exe

RogueKiller

Adlice Software

This is a setup program which is used to install the application. The file has been seen being downloaded from www.adlice.com and multiple other hosts.
Publisher:
Adlice Software

Product:
RogueKiller

Description:
Anti-malware tool

Version:
8.8.7

MD5:
444d1016cf8768d83b05dcfb9974d001

SHA-1:
472640259e03f73f7557db18644044340a5e9be3

SHA-256:
8697417a9199a3530b5e8c9f7fe35e565103ad6ba6767c731aeead61134f9c42

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/26/2024 4:51:54 AM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
TROJ_GEN.F47V0212
7.2.44

File size:
3.6 MB (3,813,376 bytes)

Product version:
8.8.7

Copyright:
Copyright Adlice Software (C) 2013

Original file name:
RogueKiller

File type:
Executable application (Win32 EXE)

Language:
French (France)

Common path:
C:\users\{user}\downloads\roguekiller.exe

File PE Metadata
Compilation timestamp:
2/11/2014 3:02:00 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:NF4cetlgXprGjdCRdCRU2pxlvw6YOXhMvZBTXrwSysnFL+yt:vprGjcRkR1peORMzCsn

Entry address:
0x14F290

Entry point:
E8, F3, 76, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 79, FD, FF, FF, 8B, FF, 55, 8B, EC, 83, 7D, 08, 00, 74, 2D, FF, 75, 08, 6A, 00, FF, 35, C4, 05, 5E, 00, FF, 15, 54, 31, 58, 00, 85, C0, 75, 18, 56, E8, 66, 36, 00, 00, 8B, F0, FF, 15, AC, 32, 58, 00, 50, E8, 16, 36, 00, 00, 59, 89, 06, 5E, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, C4, 05, 5E, 00, 00, 75, 18, E8, 67, 6A, 00, 00, 6A, 1E, E8, B1, 68, 00, 00, 68, FF, 00, 00, 00, E8, E2, 63, 00, 00, 59, 59...
 
[+]

Code size:
1.5 MB (1,580,544 bytes)

The file roguekiller.exe has been seen being distributed by the following 2 URLs.

http://www.adlice.com/softs/.../RogueKiller.exe

http://www.sur-la-toile.com/.../RogueKiller.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ns61131.ovh.net  (188.165.13.81:80)

Scan roguekiller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.