home

'solidworks_2012_sp4.0_x32_x64_multi_with_complements'.exe

Unitech LLC

The application 'solidworks_2012_sp4.0_x32_x64_multi_with_complements'.exe by Unitech has been detected as a potentially unwanted program by 14 anti-malware scanners. The file has been seen being downloaded from amazingthingz.net and multiple other hosts.
Publisher:
Unitech LLC  (signed and verified)

MD5:
edd605715d639ddbe5775058bee49a87

SHA-1:
b19b2f4e3db34cf22df69e2bac44fb0524194e33

SHA-256:
5a305f5b83f97df699de0958d7d0c60138f7e629d4825a861fe1bcce51197d2a

Scanner detections:
14 / 68

Status:
Potentially unwanted

Analysis date:
12/28/2024 6:53:51 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Dropper.Gen
7.11.166.104

avast!
Win32:Malware-gen
2014.9-140924

AVG
Skodna.Bundle.3d5
2015.0.3417

Baidu Antivirus
Trojan.Win32.Agent
4.0.3.14924

Bitdefender
Trojan.GenericKD.1800295
1.0.20.1335

Dr.Web
Trojan.DownLoader11.26520
9.0.1.0267

Emsisoft Anti-Malware
Trojan.GenericKD.1800295
8.14.09.24.09

G Data
Trojan.GenericKD.1800295
14.9.24

Kaspersky
Trojan.Win32.Agent
14.0.0.3203

McAfee
Artemis!FEDEA1F9F2B9
5600.6998

Reason Heuristics
PUP.Unitech.v
14.7.11.2

Trend Micro House Call
Suspicious_GEN.F47V0705
7.2.192

VIPRE Antivirus
Ividi
31158

ViRobot
Trojan.Win32.A.Agent.1283072
2011.4.7.4223

File size:
1.2 MB (1,245,152 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\'solidworks_2012_sp4.0_x32_x64_multi_with_complements'.exe

Digital Signature
Signed by:
Unitech LLC

Authority:
COMODO CA Limited

Valid from:
6/13/2013 7:00:00 AM

Valid to:
6/13/2016 6:59:59 AM

Subject:
CN=Unitech LLC, O=Unitech LLC, STREET="Kashirskoe sh. 9, bld. 1", STREET="premises IV, room 1", L=Moscow, S=Moscow area, PostalCode=115230, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
008422F9D83C113BC0C58A45C1B790465B

File PE Metadata
Compilation timestamp:
7/1/2014 8:48:10 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
24576:wDuFmjcDuFm2Yown14mBFgcma4QorNzdE4ov:j4L42YoY14RA4QorHE4ov

Entry address:
0x12A0

Entry point:
83, EC, 1C, C7, 04, 24, 02, 00, 00, 00, FF, 15, 60, 61, 40, 00, E8, 4B, FD, FF, FF, 8D, 74, 26, 00, 8D, BC, 27, 00, 00, 00, 00, A1, 80, 61, 40, 00, FF, E0, 89, F6, 8D, BC, 27, 00, 00, 00, 00, A1, 6C, 61, 40, 00, FF, E0, 90, 90, 90, 90, 90, 90, 90, 90, 90, 8B, 0D, 0C, 20, 40, 00, 85, C9, 74, 38, 55, 89, E5, 83, EC, 18, C7, 04, 24, 00, 30, 40, 00, E8, FC, 09, 00, 00, 52, 85, C0, 74, 23, C7, 44, 24, 04, 0E, 30, 40, 00, 89, 04, 24, E8, EF, 09, 00, 00, 83, EC, 08, 85, C0, 74, 09, C7, 04, 24, 0C, 20, 40, 00, FF...
 
[+]

Entropy:
6.4957

Code size:
4 KB (4,096 bytes)

The file 'solidworks_2012_sp4.0_x32_x64_multi_with_complements'.exe has been seen being distributed by the following 27 URLs.

http://amazingthingz.net/.../get.php?channel=7349&rk=1258677

http://amazingthingz.net/.../get.php?channel=7349&rk=54664285

http://amazingthingz.net/.../get.php?channel=7349&rk=59579078

http://amazingthingz.net/.../get.php?channel=7349&rk=58174388

http://amazingthingz.net/.../get.php?channel=7349&rk=61453146

http://amazingthingz.net/.../get.php?channel=7349&rk=91952625

http://amazingthingz.net/.../get.php?channel=7349&rk=65678994

http://amazingthingz.net/.../get.php?channel=7349&rk=37951487

http://amazingthingz.net/.../get.php?channel=7349&rk=91676459

http://amazingthingz.net/.../get.php?channel=7349&rk=95564763

http://amazingthingz.net/.../get.php?channel=7349&rk=80853424

http://amazingthingz.net/.../get.php?channel=7349&rk=78167557

http://amazingthingz.net/.../get.php?channel=7349&rk=77280251

http://amazingthingz.net/.../get.php?channel=7349&rk=41372610

http://amazingthingz.net/.../get.php?channel=7349&rk=95197881

http://amazingthingz.net/.../get.php?channel=7349&rk=70984464

http://amazingthingz.net/.../get.php?channel=7349&rk=6206719

http://amazingthingz.net/.../get.php?channel=7349&rk=24406944

http://amazingthingz.net/.../get.php?channel=7349&rk=6316288

http://amazingthingz.net/.../get.php?channel=7349&rk=14838200

http://amazingthingz.net/.../get.php?channel=7349&rk=81398131

http://amazingthingz.net/.../get.php?channel=7349&rk=70832155

http://amazingthingz.net/.../get.php?channel=7349&rk=1997850

http://amazingthingz.net/.../get.php?channel=7349&rk=50307242

http://amazingthingz.net/.../get.php?channel=7349&rk=80361720

http://amazingthingz.net/.../get.php?channel=7349&rk=51575322

http://amazingthingz.net/.../get.php?channel=7349&rk=26096988

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.