home

windowsdriver.exe

Salung International Corporation

The executable windowsdriver.exe has been detected as malware by 14 anti-virus scanners.
Publisher:
Salung International Corporation  (signed and verified)

MD5:
e2c5abbe75e3b6ab4f5ae7408f1cc218

SHA-1:
f31228fc867846846d2f8a5ce8888532b0046641

SHA-256:
e63298ecbdfb98103c87f738ab8e8bc8eb31b6ecc7db623e1591f3dcb908315c

Scanner detections:
14 / 68

Status:
Malware

Analysis date:
11/24/2024 7:51:53 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.3353969
190

Avira AntiVirus
TR/Dropper.MSIL.vmna
8.3.3.4

Arcabit
Trojan.Generic.D332D71
1.0.0.741

Baidu Antivirus
Win32.Trojan.WisdomEyes.151026.9950
4.0.3.16729

Bitdefender
Trojan.GenericKD.3353969
1.0.20.1055

Emsisoft Anti-Malware
Trojan.GenericKD.3353969
8.16.07.29.07

ESET NOD32
MSIL/Kryptik.GMF (variant)
10.13727

Fortinet FortiGate
MSIL/Kryptik.GMF!tr
7/29/2016

F-Secure
Trojan.GenericKD.3353969
11.2016-29-07_6

G Data
Trojan.GenericKD.3353969
16.7.25

McAfee
Artemis!E2C5ABBE75E3
5600.6324

MicroWorld eScan
Trojan.GenericKD.3353969
17.0.0.633

Qihoo 360 Security
HEUR/QVM03.0.0000.Malware.Gen
1.0.0.1120

Sophos
Mal/Generic-S
4.98

File size:
965.5 KB (988,712 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\windows\syswow64\windowsdriver.exe

Digital Signature
Signed by:
Salung International Corporation

Authority:
Salung International Corporation

Valid from:
6/25/2016 1:45:36 AM

Valid to:
6/26/2026 1:45:36 AM

Subject:
E=sales@salung.com, CN=www.salung.com, OU=Sales Department, O=Salung International Corporation, L=Columbus, S=Ohio, C=US

Issuer:
E=sales@salung.com, CN=www.salung.com, OU=Sales Department, O=Salung International Corporation, L=Columbus, S=Ohio, C=US

Serial number:
00866E0A24F3686932

File PE Metadata
Compilation timestamp:
6/27/2016 4:46:19 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:lMOfsSAOwipBABF55FRxDrFqL9c2Poro6ncA/FZW5Q2e7:lMbSAzuYX5FRtc+dLbx7

Entry address:
0xEE8FE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
948 KB (970,752 bytes)

Remove windowsdriver.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.