» tammgr113.sys
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

tammgr113.sys

tammgR.sys

Appzoozoo (JAMBO DIGITAL LTD)

The file tammgr113.sys, “Registry Filter System Driver” by Appzoozoo (JAMBO DIGITAL) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a Windows 64-bit kernel mode device driver named “tammgR113 service”. This file is typically installed with the program netspeedapp.

File name:

tammgr113.sys

Publisher:

AG Solutions (signed by Appzoozoo (JAMBO DIGITAL LTD))

Product:

tammgR.sys

Description:

Registry Filter System Driver

Version:

1.1.0.28

MD5:

41bd52a17180f7d204237459f2ab1dd1

SHA-1:

f8d6b50665aaba0179554c432717762ec9e8d012

SHA-256:

bf8b05df87a72a45b055cdd43725629c733db6ea43b3d0a3b9aa9e5715afb3a5

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

11/17/2024 1:30:59 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.JamboDigital (M)

16.11.22.21

File size:

26.2 KB (26,792 bytes)

Product version:

1.1.0.28

Original file name:

tammgR.sys

File type:

Driver (Win64 SYS)

Language:

English (United States)

Common path:

C:\Windows\System32\drivers\tammgr113.sys

Digital Signature

Signed by:

Appzoozoo (JAMBO DIGITAL LTD)

Authority:

COMODO CA Limited

Valid from:

1/25/2015 4:00:00 PM

Valid to:

1/26/2016 3:59:59 PM

Subject:

CN=Appzoozoo (JAMBO DIGITAL LTD), OU=appzoozoo, O=Appzoozoo (JAMBO DIGITAL LTD), STREET=2nd Koifman St, L=tel aviv, S=tel aviv, PostalCode=6801294, C=IL

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

008C8F54E47D6796D6B5F517ADD623E9C5

File PE Metadata

Compilation timestamp:

4/10/2015 12:09:53 PM

OS version:

6.3

OS bitness:

Win64

Subsystem:

Native (none required)

Linker version:

12.0

CTPH (ssdeep):

384:YR0HMf3sZ71C8+OyUDhXTthKCqDFHAobWoD5p/amk+ii38WNLI9jMC+/:6CM0J4fO3DhthKCUxWo7SB+ii39U9oN

Entry address:

0x80C8

Entry point:

48, 89, 5C, 24, 08, 57, 48, 83, EC, 20, 48, 8B, DA, 48, 8B, F9, E8, 17, 00, 00, 00, 48, 8B, D3, 48, 8B, CF, 48, 8B, 5C, 24, 30, 48, 83, C4, 20, 5F, E9, 0E, FF, FF, FF, CC, CC, 48, 8B, 05, 2D, DF, FF, FF, 45, 33, C9, 49, B8, 32, A2, DF, 2D, 99, 2B, 00, 00, 48, 85, C0, 74, 05, 49, 3B, C0, 75, 38, 0F, 31, 48, C1, E2, 20, 48, 8D, 0D, 09, DF, FF, FF, 48, 0B, C2, 48, 33, C1, 48, 89, 05, FC, DE, FF, FF, 66, 44, 89, 0D, FA, DE, FF, FF, 48, 8B, 05, ED, DE, FF, FF, 48, 85, C0, 75, 0A, 49, 8B, C0, 48, 89, 05, DE, DE... 
[+]

Entropy:

6.5171

Code size:

14 KB (14,336 bytes)

Driver

Display name:

tammgR113 service

Service name:

tammgR113

Type:

Kernel device driver (KernelDriver)

The file tammgr113.sys has been discovered within the following program.

netspeedapp by netspeedapp

About 7% of users remove it

Remove tammgr113.sys - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.