home

tmp0000000256d9364a646da0d2

Starter

MY POP SHOP LTD

The file tmp0000000256d9364a646da0d2 by MY POP SHOP has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
MY POP SHOP LTD  (signed and verified)

Product:
Starter

Version:
1.0.1.1

MD5:
7ff11a7357bdf8f392b7a2f387bbe801

SHA-1:
9f5766efbea34d05de7d35fb10d9d61cd34a37a9

SHA-256:
83a18ebf591c9865c3a04b08eee931ad344e63eced86b607abfb6df1f0518ff9

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/27/2024 12:18:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Resoft (M)
16.10.4.9

File size:
512 KB (524,288 bytes)

Product version:
1.0.1.1

Copyright:
Copyright © 2014

Original file name:
PennyBeeW.exe

Language:
Language Neutral

Common path:
C:\windows\temp\tmp0000000256d9364a646da0d2

Digital Signature
Signed by:
MY POP SHOP LTD

Authority:
COMODO CA Limited

Valid from:
7/7/2014 7:00:00 AM

Valid to:
7/8/2015 6:59:59 AM

Subject:
CN=MY POP SHOP LTD, O=MY POP SHOP LTD, STREET=14 Shenkar Arie, L=HERZLIYA, S=NA, PostalCode=46725, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
4A7D93FD75281A37A4ADCDCD636D3ADB

File PE Metadata
Compilation timestamp:
7/30/2014 6:30:45 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
768:oORx6U+zA7xCGoxW6Gs6nvzVCuahqnz1bfvXcDNc1r4e+Tr:JQkdyxW6h6bUhqnz1bfvO8kvT

Entry address:
0xA2F6

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
1.2844

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
33 KB (33,792 bytes)

Remove tmp0000000256d9364a646da0d2 - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.