home

wanyxbd_10618.exe

The application wanyxbd_10618.exe has been detected as a potentially unwanted program by 27 anti-malware scanners. The file has been seen being downloaded from zhushou.52lishi.com and multiple other hosts.
MD5:
e48e2537f16d935769542a16bb19b4cb

SHA-1:
7471317c30711625d4cb81c25faa4e211bf37bd4

SHA-256:
8169c8160480d747db54079238176e6ff65122e78943d8b1d3d81e8f70dba9a4

Scanner detections:
27 / 68

Status:
Potentially unwanted

Analysis date:
11/28/2024 2:00:16 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1832258
882

AhnLab V3 Security
Adware/Win32.Kuaiba
2014.09.06

Avira AntiVirus
TR/Rogue.1114112.5
7.11.171.10

avast!
Win32:Adware-gen [Adw]
2014.9-140906

AVG
Generic5
2015.0.3360

Baidu Antivirus
Adware.Win32.Agent
4.0.3.1496

Bitdefender
Trojan.GenericKD.1832258
1.0.20.1245

Comodo Security
ApplicUnwnt
19432

Dr.Web
Trojan.DownLoader11.28041
9.0.1.0249

Emsisoft Anti-Malware
Trojan.GenericKD.1832258
8.14.09.06.09

ESET NOD32
Win32/AdWare.Kuaiba (variant)
8.10374

Fortinet FortiGate
Riskware/Kuaiba
9/6/2014

F-Secure
Trojan.GenericKD.1832258
11.2014-06-09_7

G Data
Trojan.GenericKD.1832258
14.9.24

IKARUS anti.virus
PUA.Kuaiba
t3scan.1.7.5.0

K7 AntiVirus
Adware
13.183.13286

Kaspersky
not-a-virus:AdWare.Win32.Agent
14.0.0.3293

McAfee
Artemis!E48E2537F16D
5600.7016

MicroWorld eScan
Trojan.GenericKD.1832258
15.0.0.747

NANO AntiVirus
Trojan.Win32.DownLoader11.dekzwh
0.28.2.61942

Norman
DLoader.ATMFR
11.20140906

nProtect
Trojan.GenericKD.1832258
14.09.05.01

Sophos
Generic PUA HE
4.98

Trend Micro House Call
TROJ_GEN.R00JC0EI414
7.2.249

Trend Micro
TROJ_GEN.R00JC0EI414
10.465.06

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
32846

File size:
1.1 MB (1,114,112 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\wanyxbd_10618.exe

File PE Metadata
Compilation timestamp:
8/20/2014 3:34:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:bmG+qEcNDw8oxXY+9xa7clDCk6q5AbLL+m//niI7gem:bH5RwQ+vC3LL+mX572

Entry address:
0x99545

Entry point:
E8, 7B, C6, 00, 00, E9, 17, FE, FF, FF, 8B, 44, 24, 04, 33, C9, 3B, 04, CD, 38, 51, 4E, 00, 74, 12, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0C, 6A, 0D, 58, C3, 8B, 04, CD, 3C, 51, 4E, 00, C3, 05, 44, FF, FF, FF, 6A, 0E, 59, 3B, C8, 1B, C0, 23, C1, 83, C0, 08, C3, E8, FC, 74, 00, 00, 85, C0, 75, 06, B8, A0, 52, 4E, 00, C3, 83, C0, 08, C3, E8, E9, 74, 00, 00, 85, C0, 75, 06, B8, A4, 52, 4E, 00, C3, 83, C0, 0C, C3, 56, E8, E7, FF, FF, FF, 8B, 4C, 24, 08, 51, 89, 08, E8, 8D, FF, FF, FF, 59, 8B, F0...
 
[+]

Entropy:
6.7625

Code size:
764 KB (782,336 bytes)

The file wanyxbd_10618.exe has been seen being distributed by the following 4 URLs.

http://zhushou.52lishi.com/wanyxbd_1495.exe

http://zhushou.52lishi.com/wanyxbd_26749.exe

http://zhushou.52lishi.com/wanyxbd_10364.exe

http://zhushou.52lishi.com/wanyxbd_10618.exe

Remove wanyxbd_10618.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.