home

utilenterdigital.exe

Geowide

The application utilenterdigital.exe by Geowide has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Util EnterDigital”.
Publisher:
Geowide  (signed and verified)

Version:
1.0.6284.4259

MD5:
4a1306838c3d8363169c966d85627f99

SHA-1:
653fb94fa082b5f7957d3c3a4dd6aa7bd897fe59

SHA-256:
475c335b8b5e844b9931d6086f31622af136c691da6f5a092272df342c9d0880

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 9:30:08 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Yontoo (M)
17.3.16.11

File size:
643.4 KB (658,848 bytes)

Product version:
1.0.6284.4259

Original file name:
EnterDigital2017031610.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\enterdigital\bin\utilenterdigital.exe

Digital Signature
Signed by:
Geowide

Authority:
Symantec Corporation

Valid from:
10/21/2016 7:00:00 AM

Valid to:
10/22/2017 6:59:59 AM

Subject:
CN=Geowide, O=Geowide, L=San Diego, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
05EDA5D2409A581DDAF90CD466140FF1

File PE Metadata
Compilation timestamp:
3/16/2017 5:22:08 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
11.0

.NET CLR dependent:
Yes

Entry address:
0xA0A42

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1760

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
635 KB (650,240 bytes)

Service
Display name:
Util EnterDigital

Type:
Win32OwnProcess


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to a184-26-54-10.deploy.static.akamaitechnologies.com  (184.26.54.10:80)

TCP (HTTP):
Connects to a104-122-80-205.deploy.static.akamaitechnologies.com  (104.122.80.205:80)

TCP (HTTP):
Connects to a23-58-21-146.deploy.static.akamaitechnologies.com  (23.58.21.146:80)

TCP (HTTP):
Connects to a184-26-54-35.deploy.static.akamaitechnologies.com  (184.26.54.35:80)

TCP (HTTP):
Connects to a104-75-84-32.deploy.static.akamaitechnologies.com  (104.75.84.32:80)

TCP (HTTP):
Connects to a104-75-84-11.deploy.static.akamaitechnologies.com  (104.75.84.11:80)

Remove utilenterdigital.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.