home

szndesktop.exe

Seznam.cz, a.s.

The application szndesktop.exe by Seznam.cz, a.s has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address reg.software.seznam.cz on port 80 using the HTTP protocol.
Publisher:
Seznam.cz, a.s.  (signed and verified)

MD5:
0a54b0bcd8bc203684c803fc3fb5c5a2

SHA-1:
8b5a2379c0f0712785cfd157a324a157bc6895c3

SHA-256:
874d89b2abc802eb1d970afd75995ef3e160eaa35b6c5156cf921aa5d541f81a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 4:52:29 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Seznam (M)
16.10.19.12

File size:
446.7 KB (457,384 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\seznam.cz\bin\szndesktop.exe

Digital Signature
Signed by:
Seznam.cz, a.s.

Authority:
Thawte, Inc.

Valid from:
3/23/2015 1:00:00 AM

Valid to:
4/10/2016 1:59:59 AM

Subject:
CN="Seznam.cz, a.s.", O="Seznam.cz, a.s.", L=Praha 5, S=Praha 5, C=CZ

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
6B776AEB0D640B924C5F9B61B92AE92A

File PE Metadata
Compilation timestamp:
5/26/2015 1:38:55 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
11.0

CTPH (ssdeep):
6144:Mvca+J/9agDtV6MX77RFjFQwkl9rTDlWehtQo8/9nKQa5Zpc09+I+3++P50UkfI8:ZXjF/kfT07A5ZpcT3bR0UCpppq4cposi

Entry address:
0x4362D

Entry point:
E8, 3F, 04, 00, 00, E9, 91, FE, FF, FF, 55, 8B, EC, FF, 15, 14, C0, 44, 00, 6A, 01, A3, 24, 7A, 46, 00, E8, 32, 05, 00, 00, FF, 75, 08, E8, 30, 05, 00, 00, 83, 3D, 24, 7A, 46, 00, 00, 59, 59, 75, 08, 6A, 01, E8, 18, 05, 00, 00, 59, 68, 09, 04, 00, C0, E8, 19, 05, 00, 00, 59, 5D, C3, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 6A, 17, E8, 2A, 05, 00, 00, 85, C0, 74, 05, 6A, 02, 59, CD, 29, A3, 08, 78, 46, 00, 89, 0D, 04, 78, 46, 00, 89, 15, 00, 78, 46, 00, 89, 1D, FC, 77, 46, 00, 89, 35, F8, 77, 46, 00, 89, 3D, F4...
 
[+]

Code size:
300 KB (307,200 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.seznam.cz  (77.75.77.39:80)

TCP (HTTP):
Connects to download.seznam.cz  (77.75.77.38:80)

TCP (HTTP):
Connects to reg.software.seznam.cz  (77.75.79.131:80)

TCP (HTTP SSL):
Connects to www.novinky.cz  (77.75.78.7:443)

TCP (HTTP):
Connects to a23-42-21-163.deploy.static.akamaitechnologies.com  (23.42.21.163:80)

Remove szndesktop.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.