» Windows-KB890830-x64-V5.19.exe
Overview
Analysis
File Details
Downloads (9)

Windows-KB890830-x64-V5.19.exe

Microsoft Windows Malicious Software Removal Tool

Microsoft Corporation

This is a setup and installation application. The file has been seen being downloaded from www.afterdawn.com and multiple other hosts a known adware distribution point operated by AfterDawn.

File name:

Windows-KB890830-x64-V5.19.exe

Publisher:

Microsoft Corporation (signed and verified)

Product:

Microsoft Windows Malicious Software Removal Tool

Description:

Microsoft Windows Malicious Software Removal Tool (KB890830) - Setup Self-Extracting Cabinet

Version:

5.19.10902.0

MD5:

aa95d278ec9a7d49375fc0f0b4783e51

SHA-1:

fc70e583d71f0e7fab2d7946d3ac2ccb5dabce9e

SHA-256:

0e066612519bf4f3ad6341a6c295652262d5b40db9e1f64d1b380c84c34aa649

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)
Whitelisted (by digital signature)

Analysis date:

11/27/2024 1:05:45 PM UTC (today)

File size:

35.2 MB (36,904,648 bytes)

Product version:

5.19.10902.0

Original file name:

Windows-KB890830-x64-V5.19.exe

File type:

Executable application (Win64 EXE)

Language:

English (United States)

Digital Signature

Signed by:

Microsoft Corporation

Authority:

Microsoft Corporation

Valid from:

4/22/2014 6:39:00 PM

Valid to:

7/22/2015 6:39:00 PM

Subject:

CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:

CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:

33000000CA6CD5321235C4E1550001000000CA

File PE Metadata

Compilation timestamp:

10/6/2009 6:58:55 AM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

786432:QZ5AwBi28kZ6plqCIIlhZnuK+8m2gAoGiRpB9HnhfYKXS8wzd2Tn7EKc:UnI28kZMqC3lnuz6oGiR3Dp9T74

Entry address:

0x98C0

Entry point:

48, 83, EC, 58, 48, 89, 5C, 24, 70, 48, 89, 7C, 24, 78, 66, 81, 3D, 29, 67, FF, FF, 4D, 5A, 74, 08, 33, DB, 89, 5C, 24, 60, EB, 7C, 48, 63, 05, 54, 67, FF, FF, 48, 8D, 0D, 11, 67, FF, FF, 48, 03, C1, 81, 38, 50, 45, 00, 00, 74, 08, 33, DB, 89, 5C, 24, 60, EB, 5B, 0F, B7, 48, 18, 81, F9, 0B, 01, 00, 00, 74, 32, 81, F9, 0B, 02, 00, 00, 74, 08, 33, DB, 89, 5C, 24, 60, EB, 3F, 83, B8, 84, 00, 00, 00, 0E, 77, 08, 33, DB, 89, 5C, 24, 60, EB, 2E, 33, DB, 39, 98, F8, 00, 00, 00, 0F, 95, C3, 89, 5C, 24, 60, EB, 1D... 
[+]

Entropy:

7.9981 (probably packed)

Code size:

56 KB (57,344 bytes)

The file Windows-KB890830-x64-V5.19.exe has been seen being distributed by the following 9 URLs.

http://www.afterdawn.com/software/general/.../microsoft_windows_malicious_software_removal_tool_64-bit?mirror_id=0&version_id=92428&software_id=3501

https://doc-0s-bo-docs.googleusercontent.com/docs/securesc/bthdv762km7r4g0bhvf154b3hf0rulea/orke4oskpjt808lpm9f5v0g7gngv5jpo/1420214400000/11262698435120745476/.../0ByULz2Kx2TwKbXFkR3dFX0lWajQ?e=download&h=14148971696748162925&nonce=otsijdiioqh16&user=00309692998346380031&hash=upraaare2fjsc7adnnn50erg9pmbjn1q

https://docs.google.com/a/rubyride.co/nonceSigner?nonce=otsijdiioqh16&continue=https://doc-0s-bo-docs.googleusercontent.com/docs/securesc/bthdv762km7r4g0bhvf154b3hf0rulea/orke4oskpjt808lpm9f5v0g7gngv5jpo/1420214400000/11262698435120745476/00309692998346380031/0ByULz2Kx2TwKbXFkR3dFX0lWajQ?e=download&h=14148971696748162925&hash=nsg0kshl1cht5mos8j2fer5tur8rc32n&urp=https://mail.google.com/mail/u/.../&pli=1&auth=DQAAALUAAACJyu1m3qeIDzP_f62omJhkQKN4ZuLxJxl48seYVx5xdMeCl6lVjqoRI6VFpTjjugLn0VSdkj8p7AFbVk7d8a0YmkNU1OmBOo1XR7ycG85i8eSL2nrK106WoG_zPY-965HuonSj9frGlypx9grDoD3uP6E9mEZUTZvI6BBPZLjBJ0hSdyZdil0V_BCMRcP1OfxfXDJbhFlIY_ts87Y9gh_A6w1FIkDxgWIBRMBh8YP53EgC_E9zVMIiDhPnJCj3Qj0&authuser=0

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/a/rubyride.co/nonceSigner?nonce=otsijdiioqh16&continue=https://doc-0s-bo-docs.googleusercontent.com/docs/securesc/bthdv762km7r4g0bhvf154b3hf0rulea/orke4oskpjt808lpm9f5v0g7gngv5jpo/1420214400000/11262698435120745476/.../0ByULz2Kx2TwKbXFkR3dFX0lWajQ?e=download&h=14148971696748162925&hash=nsg0kshl1cht5mos8j2fer5tur8rc32n&urp=https://mail.google.com/mail/u/0/&followup=https://docs.google.com/a/rubyride.co/nonceSigner?nonce=otsijdiioqh16&continue=https://doc-0s-bo-docs.googleusercontent.com/docs/securesc/bthdv762km7r4g0bhvf154b3hf0rulea/orke4oskpjt808lpm9f5v0g7gngv5jpo/1420214400000/11262698435120745476/.../0ByULz2Kx2TwKbXFkR3dFX0lWajQ?e=download&h=14148971696748162925&hash=nsg0kshl1cht5mos8j2fer5tur8rc32n&urp=htt

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/a/rubyride.co/nonceSigner?nonce=otsijdiioqh16&continue=https://doc-0s-bo-docs.googleusercontent.com/docs/securesc/bthdv762km7r4g0bhvf154b3hf0rulea/orke4oskpjt808lpm9f5v0g7gngv5jpo/1420214400000/11262698435120745476/00309692998346380031/0ByULz2Kx2TwKbXFkR3dFX0lWajQ?e=download&h=14148971696748162925&hash=nsg0kshl1cht5mos8j2fer5tur8rc32n&urp=https://mail.google.com/mail/u/.../&followup=https://docs.google.com/a/rubyride.co/nonceSigner?nonce=otsijdiioqh16&continue=https://doc-0s-bo-docs.googleusercontent.com/docs/securesc/bthdv762km7r4g0bhvf154b3hf0rulea/orke4oskpjt808lpm9f5v0g7gngv5jpo/1420214400000/11262698435120745476/00309692998346380031/0ByULz2Kx2TwKbXFkR3dFX0lWajQ?e=download&h=14148971696748162925&hash=nsg0kshl1cht5mos8j2fer5tur8rc32n&urp=https://mail.google.com/mail/u/.../&ltmpl=homepage&emr=1&authuser=0

http://download.microsoft.com/download/2/C/5/.../Windows-KB890830-x64-V5.19.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.