home

stab_v4.0.exe

Thinknice Co., Limited

The application stab_v4.0.exe by Thinknice Co., Limited has been detected as adware by 25 anti-malware scanners. It is also typically executed from the user's temporary directory.
Publisher:
XTab  (signed by Thinknice Co., Limited)

Product:
XTab

Version:
4.0.2.1678

MD5:
c8a02394ccb21ab040ccac7dc6f4e72c

SHA-1:
c6cc10b9b56247ede69c52d654bb48dfd0871909

SHA-256:
2ba12d1c882b3599621f91af5c8fd695ed453f252a812e630cee473795ea520e

Scanner detections:
25 / 68

Status:
Adware

Analysis date:
11/6/2024 3:38:35 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.OFO
6331481

Agnitum Outpost
Trojan.Click
7.1.1

Avira AntiVirus
ADWARE/Adware.Gen
7.11.200.82

avast!
Win32:SupTab-D [Adw]
2014.9-150109

Baidu Antivirus
Adware.Win32.SupTab
4.0.3.1519

Bitdefender
Adware.Agent.OFO
1.0.20.45

Clam AntiVirus
Win.Adware.SupTab
0.98/19898

Dr.Web
infected with Trojan.Click3.8536
9.0.1.05190

Emsisoft Anti-Malware
Adware.Agent.OFO
9.0.0.4799

ESET NOD32
Win32/Thinknice.B potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Thinknice
1/9/2015

F-Secure
Adware.Agent.OFO
11.2015-09-01_6

G Data
Adware.Agent.OFO
15.1.24

K7 AntiVirus
Trojan
13.190.14593

Malwarebytes
PUP.Optional.XTab.A
v2015.01.09.08

McAfee
Artemis!C8A02394CCB2
5600.6891

MicroWorld eScan
Adware.Agent.OFO
16.0.0.27

NANO AntiVirus
Trojan.Win32.Click3.ddmrti
0.30.0.64448

Norman
Adware.Agent.OFO
02.01.2015 13:58:24

nProtect
Adware.Agent.OFO
15.01.09.01

Qihoo 360 Security
HEUR/QVM20.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Thinknice
15.3.11.17

Sophos
PUA 'ThinkNice' (of type Adware)
5.09

Vba32 AntiVirus
AdWare.Agent
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
36502

File size:
2.5 MB (2,635,904 bytes)

Copyright:
copyroght (c) 2011-2014 XTab system

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\stab_v4.0.exe

Digital Signature
Signed by:
Thinknice Co., Limited

Authority:
GlobalSign nv-sa

Valid from:
10/20/2014 8:26:52 AM

Valid to:
10/21/2015 8:26:52 AM

Subject:
CN="Thinknice Co., Limited", O="Thinknice Co., Limited", L=香港, S=香港, C=HK

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217B1525408E122E96F2FC3CB018A64466

File PE Metadata
Compilation timestamp:
3/22/2010 1:59:20 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:Rkk1k71s2rZixVT7K5dA1RR+iCcGT7ETWvWpOUblUQuakwcQ+:Rh2VtiS5AscGT7GWyJWzakwx+

Entry address:
0x114A

Entry point:
E9, F1, 55, 00, 00, E9, 0C, 95, 00, 00, E9, 47, B9, 00, 00, E9, 52, 99, 00, 00, E9, AD, 94, 00, 00, E9, C8, A9, 00, 00, E9, 43, 9A, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC...
 
[+]

Packer / compiler:
Xtreme-Protector v1.05

Code size:
62 KB (63,488 bytes)

Remove stab_v4.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.