home

saveas.exe

SystemNode

Maxiget Limited

This is part of a bundled installer which provides applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application saveas.exe by Maxiget Limited has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
SwapSystem  (signed by Maxiget Limited)

Product:
SystemNode

Description:
SystemComponent

Version:
4, 0, 32, 0

MD5:
6129dfab37516e7cd72ff72f72c0cb7a

SHA-1:
e6125b918934cb33fc2c22f0148389f5ce7ce148

SHA-256:
e6d0142344aff15eaf7273b653dfe4275c4da87ecb47ec498db23c56d4dbe0e9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
This is a modified installer version of the software and bundles additional offers including adware.

Analysis date:
11/23/2024 6:04:25 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.New IT Limited (M)
17.2.17.2

File size:
87.1 KB (89,216 bytes)

Product version:
4, 0, 32, 0

Copyright:
2014

Trademarks:
SmallTrade Inc.

Original file name:
0008.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\saveas.exe

Digital Signature
Signed by:
Maxiget Limited

Authority:
Thawte, Inc.

Valid from:
6/19/2014 3:00:00 AM

Valid to:
6/19/2016 2:59:59 AM

Subject:
CN=Maxiget Limited, O=Maxiget Limited, L=Limassol, S=Limassol, C=CY

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
504CD5EE499BCA858F3A5A7CD99F5C5D

File PE Metadata
Compilation timestamp:
11/25/2014 7:22:35 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

Entry address:
0x3261

Entry point:
E8, F6, 15, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 8B, 00, 81, 38, 63, 73, 6D, E0, 75, 2A, 83, 78, 10, 03, 75, 24, 8B, 40, 14, 3D, 20, 05, 93, 19, 74, 15, 3D, 21, 05, 93, 19, 74, 0E, 3D, 22, 05, 93, 19, 74, 07, 3D, 00, 40, 99, 01, 75, 05, E8, 4B, 16, 00, 00, 33, C0, 5D, C2, 04, 00, 68, 6B, 32, 40, 00, FF, 15, 54, A1, 40, 00, 33, C0, C3, 8B, FF, 55, 8B, EC, 57, BF, E8, 03, 00, 00, 57, FF, 15, F0, A0, 40, 00, FF, 75, 08, FF, 15, C0, A0, 40, 00, 81, C7, E8, 03, 00, 00, 81, FF, 60, EA, 00...
 
[+]

Entropy:
5.4397

Code size:
33 KB (33,792 bytes)

Remove saveas.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.