home

whatsapp.exe

Ronen Kvurt

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application whatsapp.exe by Ronen Kvurt has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from profficer.org.
Publisher:
Ronen Kvurt  (signed and verified)

MD5:
5903c3f7039b3a601e000af8e6f52219

SHA-1:
0cb5734cf550423c5d807b01e41b5d8ba264876f

SHA-256:
5abc2172e15a24ac78f7bcdc53fc677b93795fd12e190fa0cb0f671b1a9b83db

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
1/13/2025 6:46:56 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick.RonenKvu (M)
16.6.9.21

File size:
1.1 MB (1,130,344 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\whatsapp.exe

Digital Signature
Signed by:
Ronen Kvurt

Authority:
Unizeto Technologies S.A.

Valid from:
5/14/2014 3:13:06 PM

Valid to:
5/14/2015 3:13:06 PM

Subject:
E=ronenkvurt@yahoo.com, CN=Ronen Kvurt, O=Ronen Kvurt, C=IL

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
2FCC7E9A4043746064F138856B04DABB

File PE Metadata
Compilation timestamp:
10/9/2013 10:56:01 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:Tv9lgyjxp93LRjvwo2U6Sstk8rZINzqrzecz26C/:YyN37Rj2U6SQk6INzGJzNC

Entry address:
0xB7969

Entry point:
E8, 01, 14, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 90, DE, 4F, 00, E8, 11, 19, 00, 00, E8, CE, 15, 00, 00, 0F, B7, F0, 6A, 02, E8, 94, 13, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 40, 03, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.4105

Code size:
755 KB (773,120 bytes)

The file whatsapp.exe has been seen being distributed by the following URL.

http://profficer.org/hp/?q=cbEmlZ0AhhRV2pnikgerzXt9SqGDWbJofvV0SU n JYDf8jDYBcWqdQH4WIVV Xkua8E9ow3caYHXi6PzXLXH0g5j1JNqyUI5RI5cxrwJkuHGKkg0Js49T2ScgJlnnE0f44P0o76F0n8 4FdpeIweZMpqVGtMb746IQ3d52mqfjc1Lq1/yhPmzd8AaB fWJjhQ6Xd2/KhhUvf3R Fu7fRLIdpAQ9GcHHiIf2KSF4UkNvXQLAri2gGJB04z5cYxPQ7zc t07nvfHrLzi1EMc4ozpGSuVx4fnQ/4VJmLtcAJQR6UVd6FKbqSgj9vIAkn9BpkPCbxM O5CbZYuTCC9nmRg/JautSTorlrm1kI7Vo2i2qV6XisZeoNTwMp XJlsC6hHNjuKVnT736Up2Vgb6SDF7F1wQszh6fPNaeISyW7DelWFigWcminsbWT9PT1XPSvcTw6XldaawSZOy2wg36EmRTiuckvjEuteB3FUvjarf31aDbXAvUDUXIJDIhYvgtPLWOtY8OBi9Y6RKgcZ0GKsh45ZsBTS32eIwEDuflxZ8xIt8aRtCig1Rk3pXKMou9VsOehTWF2kmQa3O77r J8MFOyjCRm2PJa4jFjNy8en9Bl5ct/irTJxw1GtuVZxxhE41sS01N0ojJLd6gOiZgKVvGfew5w SjLNU1xRhYcwmhjv8u/QzxWV TNbKMKhNskNm4AOWXHWiU/.../WDgmBDLxJ9gfaJXkGErLdeC7E2YtpjpOmpNB 02AznaNA6OaU3QRmehv LTFPqlw9A2KUhbfW2Ql3LMyTIXsm0OqnjahvSJrm8RdOpLozcN1Jsq7ia0gsvg2C&external_id=14241826

Remove whatsapp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.