home

ttcopy2.exe

2007 Microsoft Office system

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The executable ttcopy2.exe, “Microsoft Office Word” has been detected as malware by 36 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from s1.directxex.com.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
2007 Microsoft Office system

Description:
Microsoft Office Word

Version:
12.0.4518.1014

MD5:
aeb176827866a11eb33c341153ced438

SHA-1:
409dda819b33a2a9f39c17dfa936a1f3ffae109a

SHA-256:
56430047cd0c1f7faf25ee081e6483575a9a967397c9a17ba849171ed5578af7

Scanner detections:
36 / 68

Status:
Malware

Analysis date:
11/30/2024 3:38:17 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Worm.Generic.510894
786

AegisLab AV Signature
Troj.W32.Gen
2.1.4+

Agnitum Outpost
Trojan.Inject
7.1.1

AhnLab V3 Security
Dropper/Win32.Dorgam
2014.11.06

Avira AntiVirus
TR/Crypt.CFI.Gen
7.11.183.62

avast!
Win32:Malware-gen
2014.9-141210

AVG
MSIL3
2015.0.3264

Baidu Antivirus
Trojan.Win32.Inject
4.0.3.141210

Bitdefender
Worm.Generic.510894
1.0.20.1720

Bkav FE
HW32.Packed
1.3.0.4959

Comodo Security
UnclassifiedMalware
19997

Dr.Web
Trojan.PWS.Stealer.13020
9.0.1.0344

Emsisoft Anti-Malware
Worm.Generic.510894
8.14.12.10.02

ESET NOD32
MSIL/Autorun.Spy.Agent.AU
8.10675

Fortinet FortiGate
W32/Inject.NSTJ!tr
12/10/2014

F-Prot
W32/Trojan2.OIIV
v6.4.7.1.166

F-Secure
Worm.Generic.510894
11.2014-10-12_4

G Data
Worm.Generic.510894
14.12.24

IKARUS anti.virus
Trojan.Win32.Inject
t3scan.1.8.3.0

K7 AntiVirus
Trojan
13.185.13888

Kaspersky
Trojan.Win32.Inject
14.0.0.2817

Malwarebytes
Trojan.FakeMS
v2014.12.10.02

McAfee
RDN/Generic PWS.y!zy
5600.6920

Microsoft Security Essentials
Trojan:Win32/Dynamer!ac
1.11104

MicroWorld eScan
Worm.Generic.510894
15.0.0.1032

NANO AntiVirus
Trojan.Win32.Inject.dbxits
0.28.6.62995

Norman
Suspicious_Gen4.GOVUX
11.20141210

nProtect
Worm.Generic.510894
14.11.05.01

Qihoo 360 Security
Win32/Trojan.4b9
1.0.0.1015

Quick Heal
Trojan.Inject.r3
12.14.14.00

Sophos
Mal/MSILInj-V
4.98

Trend Micro House Call
TROJ_CRYPT.VTY
7.2.344

Trend Micro
TROJ_CRYPT.VTY
10.465.10

Vba32 AntiVirus
Trojan.Inject
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
34536

Zillya! Antivirus
Trojan.Inject.Win32.77420
2.0.0.1976

File size:
1004.5 KB (1,028,608 bytes)

Product version:
12.0.4518.1014

Copyright:
© 2006 Microsoft Corporation. All rights reserved.

Original file name:
WinWord.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\ttcopy2.exe

File PE Metadata
Compilation timestamp:
6/16/2014 12:46:06 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:WvAAgFzcvZrffV54El0a6wmWJVIsqEBxNhEodo:WvL9ZzzX0nwmeIsqEBlZ+

Entry address:
0xAB9EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 03, 00, 00, 00, 30, 00, 00, 80, 0E, 00, 00, 00, C8, 03, 00, 80, 10, 00, 00, 00, 50, 04, 00, 80, 18, 00, 00, 00, 68, 04, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 71, 00, 32, 00, 00, 00, 80, 04, 00, 80, 33, 00, 00, 00, 98, 04, 00, 80, 34, 00, 00, 00, B0, 04, 00, 80, 35, 00, 00, 00, C8, 04, 00, 80, 36, 00, 00, 00, E0, 04, 00, 80, 37, 00, 00, 00, F8, 04...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
678.5 KB (694,784 bytes)

The file ttcopy2.exe has been seen being distributed by the following URL.

http://s1.directxex.com/.../ZHUuy0uu2bysMU7yndGgD9KkUN4E_zjw1TARQAZngQ_slJw9yEJbsh0L9pSFQuzFY75xqKLeiCB1NsH9GP9vnyYBVTS2efQO7KZK

Remove ttcopy2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.