» WEB.DE_MailCheck_Broker.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

WEB.DE_MailCheck_Broker.exe

WEB.DE MailCheck für Internet Explorer

1&1 Mail & Media GmbH

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘MailCheck IE Broker’. This is installed with WEB.DE MailCheck für Internet Explorer.

File name:

Publisher:

1und1 Mail und Media GmbH (signed by 1&1 Mail & Media GmbH)

Product:

WEB.DE MailCheck für Internet Explorer

Description:

WEB.DE MailCheck Dienst

Version:

2.4.1.0

MD5:

2d3599038b831a494bc4075b1a5ab57c

SHA-1:

770b7b05af11615a8ef77ceec5f3a4fc4ce5b2b2

SHA-256:

9b292512a8ceece8d2d110ebb6183098d549914e8d80f3bd260866e6cd170df4

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/8/2024 11:56:30 AM UTC (today)

File size:

1.7 MB (1,769,536 bytes)

Product version:

2.4.1.0

Original file name:

WEB.DE_MailCheck_Broker.exe

File type:

Executable application (Win32 EXE)

Language:

German (Germany)

Common path:

C:\Program Files\web.de mailcheck\ie\web.de_mailcheck_broker.exe

Digital Signature

Signed by:

1&1 Mail & Media GmbH

Authority:

Thawte, Inc.

Valid from:

10/16/2013 2:00:00 AM

Valid to:

10/25/2016 1:59:59 AM

Subject:

CN=1&1 Mail & Media GmbH, OU=WEB.DE, O=1&1 Mail & Media GmbH, L=Montabaur, S=Rheinland-Pfalz, C=DE

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

75666A569980B5C13E2BBA81CC81FF7B

File PE Metadata

Compilation timestamp:

12/10/2013 9:59:34 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:l8BnaWUts/xPOEG/7aZKutTzQEGbZ0Oy7dlN5zvL6iyBE8A5hnXHIrEwLKrukGgC:uBnadaPOX0KulzGZIlP6iCx0hY4VC

Entry address:

0xEC974

Entry point:

E8, AC, 93, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 8B, D0, 66, 8B, 08, 83, C0, 02, 66, 85, C9, 75, F5, 66, 8B, 4D, 0C, 83, E8, 02, 3B, C2, 74, 05, 66, 39, 08, 75, F4, 66, 39, 08, 74, 02, 33, C0, 5D, C3, 8B, FF, 55, 8B, EC, 83, 7D, 10, 00, 75, 04, 33, C0, 5D, C3, 8B, 55, 0C, 8B, 4D, 08, FF, 4D, 10, 74, 15, 0F, B7, 01, 66, 85, C0, 74, 0D, 66, 3B, 02, 75, 08, 83, C1, 02, 83, C2, 02, EB, E6, 0F, B7, 01, 0F, B7, 0A, 2B, C1, 5D, C3, 8B, FF, 55, 8B, EC, 56, 8B, 75, 08, 57, 85, F6, 74, 07, 8B... 
[+]

Code size:

1.2 MB (1,247,232 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

MailCheck IE Broker

Command:

"C:\Program Files\web.de mailcheck\ie\web.de_mailcheck_broker.exe"

The file WEB.DE_MailCheck_Broker.exe has been discovered within the following program.

WEB.DE MailCheck für Internet Explorer by 1&1 Mail & Media Inc.

Publisher's description - “No matter where you are on the Internet on the go - the practical Mailcheck you informed directly in Internet Explorer 9 on new incoming emails. With just one click, you are back in your mailbox and have immediate access to your inbox and features all of your mailbox.”

go.web.de/tb/ie_productpage

19% remove it

Scan WEB.DE_MailCheck_Broker.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.