» suptab_v5.8.8.865_noblank.exe
Overview
Analysis
File Details

suptab_v5.8.8.865_noblank.exe

Zhang Ling

The application suptab_v5.8.8.865_noblank.exe by Zhang Ling has been detected as adware by 25 anti-malware scanners. It is also typically executed from the user's temporary directory.

File name:

Publisher:

Suptab (signed by Zhang Ling)

Product:

Suptab

Version:

5.8.8.865

MD5:

e6b1e1bc352ba71298ae10d2958b9d50

SHA-1:

48bc4e601c082cb54ead94f8cfd7a8eb84241e65

SHA-256:

b3d4374c882c9d29eaef189105ace39922a94f61de0250791a72b50768938e83

Scanner detections:

25 / 68

Status:

Adware

Analysis date:

12/25/2024 12:56:27 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Agent.OFO

861

Agnitum Outpost

Trojan.Click

7.1.1

Avira AntiVirus

APPL/SubTab.spe

7.11.174.228

Baidu Antivirus

Adware.Win32.Agent

4.0.3.14926

Bitdefender

Adware.Agent.OFO

1.0.20.1345

Clam AntiVirus

Win.Adware.Agent-7965

0.98/19438

Dr.Web

infected with Trojan.Click3.8536

9.0.1.05190

Emsisoft Anti-Malware

Adware.Agent.OFO

14.09.26

ESET NOD32

Win32/ELEX.AV potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/Thinknice

9/26/2014

F-Secure

Adware.Agent.OFO

11.2014-26-09_6

G Data

Adware.Agent.OFO

14.9.24

K7 AntiVirus

Trojan

13.183.13504

Kaspersky

not-a-virus:AdWare.Win32.Agent

14.0.0.3191

Malwarebytes

PUP.Optional.IePluginService.A

v2014.09.26.05

McAfee

Artemis!E0B07C811902

5600.6995

MicroWorld eScan

Adware.Agent.OFO

15.0.0.807

NANO AntiVirus

Trojan.Win32.Click3.ddmrti

0.28.2.62286

nProtect

Adware.Agent.OFO

14.09.26.01

Panda Antivirus

Trj/Chgt.G

14.09.26.05

Qihoo 360 Security

HEUR/Malware.QVM30.Gen

1.0.0.1015

Reason Heuristics

PUP.ZhangLing.W

14.9.26.16

Sophos

Elex

4.98

Vba32 AntiVirus

AdWare.Agent

3.12.26.3

VIPRE Antivirus

Trojan.Win32.Generic

33450

File size:

2.5 MB (2,598,824 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\suptab_v5.8.8.865_noblank.exe

Digital Signature

Signed by:

Zhang Ling

Authority:

WoSign CA Limited

Valid from:

9/23/2014 10:39:35 PM

Valid to:

6/23/2015 10:39:35 PM

Subject:

CN=Zhang Ling, E=chloezhangling@gmail.com, L=北京市, S=北京市, C=CN

Issuer:

CN=WoSign Class 2 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:

4BD6CD01962107D32D308240DA61E020

File PE Metadata

Compilation timestamp:

3/21/2010 7:59:20 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

49152:KuwkNFkYfN1eXKwi7Unsp5cHRDYYZ1CTWvWpOUblUQuGwcyzy:HwkNaYN1pNcxHLkWyJWzGw5zy

Entry address:

0x114A

Entry point:

E9, F1, 55, 00, 00, E9, 0C, 95, 00, 00, E9, 47, B9, 00, 00, E9, 52, 99, 00, 00, E9, AD, 94, 00, 00, E9, C8, A9, 00, 00, E9, 43, 9A, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC... 
[+]

Packer / compiler:

Xtreme-Protector v1.05

Code size:

62 KB (63,488 bytes)

Remove suptab_v5.8.8.865_noblank.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.