home

survey.exe

temmp

The executable survey.exe has been detected as malware by 12 anti-virus scanners. While running, it connects to the Internet address mdin-pp-wb1.webhostbox.net on port 80 using the HTTP protocol.
Product:
temmp

Version:
1.0.0.0

MD5:
45d496ad3ae342fdc3d23eebe2b89f96

SHA-1:
8c3ee5cecb3d1d826970fba8a67ea03339d3f016

SHA-256:
7b381e6a59ac4877d7594bc179490f6e262ade32bad4fc7fc7c5a7fa316848aa

Scanner detections:
12 / 68

Status:
Malware

Analysis date:
1/13/2025 1:29:18 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Worm.Generic.556788
297

Arcabit
Worm.Generic.D87EF4
1.0.0.669

AVG
MSIL8
2017.0.2775

Baidu Antivirus
Worm.MSIL.Agent
4.0.3.16413

Bitdefender
Worm.Generic.556788
1.0.20.520

Emsisoft Anti-Malware
Worm.Generic.556788
8.16.04.13.07

ESET NOD32
MSIL/Agent.IZ
10.13319

F-Secure
Worm.Generic.556788
11.2016-13-04_4

G Data
Worm.Generic.556788
16.4.25

MicroWorld eScan
Worm.Generic.556788
17.0.0.312

nProtect
Worm.Generic.556788
16.04.11.01

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.16411

File size:
9.5 KB (9,728 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2014

Original file name:
temmp.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\Pictures\survey.exe

File PE Metadata
Compilation timestamp:
11/3/2014 11:21:04 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
192:oRsDiRfEcTvjvVItdHFpoeF3OCjjM9jJ:aseRfEcTv7VMpFLjMt

Entry address:
0x3BBE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 10, 00, 00, 00, 20, 00, 00, 80, 18, 00, 00, 00, 38, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 50, 00, 00, 80, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
7 KB (7,168 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to mdin-pp-wb1.webhostbox.net  (103.21.58.194:80)

Remove survey.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.