» yahoomessenger.exe
Overview
Analysis
File Details
Behaviors (2)
Programs (4)

yahoomessenger.exe

Yahoo! Messenger

Yahoo! Inc.

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Messenger (Yahoo!)’. This is installed with multiple programs including AT&T Yahoo! Messenger and Yahoo! Messenger.

File name:

yahoomessenger.exe

Publisher:

Yahoo! Inc. (signed and verified)

Product:

Yahoo! Messenger

Version:

11,5,0,0152

MD5:

059fe2aa728f6bafd8e67b2416040073

SHA-1:

2e434604c76ec176ea45d8e3b8a00bedb1b68f14

SHA-256:

043aaa14ec10d30bba8314992e4b66634cbb74c9578e290f90a8491131a490a2

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/15/2024 7:54:26 AM UTC (today)

File size:

6.2 MB (6,497,592 bytes)

Product version:

11,5,0,0152

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\yahoo!\messenger\yahoomessenger.exe

Digital Signature

Signed by:

Yahoo! Inc.

Authority:

VeriSign, Inc.

Valid from:

8/13/2009 3:00:00 AM

Valid to:

9/3/2012 2:59:59 AM

Subject:

CN=Yahoo! Inc., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Yahoo! Inc., L=Santa Clara, S=CA, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3D7A9A7D12556AB8688CA048C60F6018

File PE Metadata

Compilation timestamp:

11/24/2011 9:01:34 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

98304:zeSQKsB/4PsXPpDJtDk64XuYBs7PWjl53iVsE:zeSI/44Pp/Dk64eYBs7+s

Entry address:

0x3EE82F

Entry point:

E8, DD, 05, 00, 00, E9, 36, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, 80, F9, 40, 73, 16, 80, F9, 20, 73, 06, 0F, AD, D0, D3, FA, C3, 8B, C2, C1, FA, 1F, 80, E1, 1F, D3, F8, C3, C1, FA, 1F, 8B, C2, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 56, 8B, 44, 24, 14, 0B, C0, 75, 28, 8B, 4C, 24, 10, 8B, 44, 24, 0C, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 08, F7, F1, 8B, F0, 8B, C3, F7, 64, 24, 10, 8B, C8, 8B, C6, F7, 64, 24, 10, 03, D1, EB, 47, 8B, C8, 8B, 5C, 24, 10, 8B, 54, 24, 0C, 8B, 44, 24, 08... 
[+]

Entropy:

6.4663

Code size:

4.2 MB (4,444,160 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Messenger (Yahoo!)

Command:

"C:\Program Files2\yahoo!\messen~1\yahoomessenger.exe" -quiet

Windows Firewall Allowed Program

Name:

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

The file yahoomessenger.exe has been discovered within the following programs.

AT&T Yahoo! Messenger by Yahoo! Inc.

AT&T Yahoo! Messenger is an AT&T branded version of Y! Messenger.

www.yahoo.com

21% remove it

Yahoo! Install Manager by Yahoo! Inc.

Yahoo Install Manager manages Yahoo program downloads and installations. The install manager keeps track of such programs and assists in the installations to put things in their proper places.

20% remove it

Yahoo! Messenger by Yahoo! Inc.

Yahoo! Messenger (YIM) is an ad-supported instant messaging client and protocol by Yahoo!.

messenger.yahoo.com

7% remove it

Yahoo!7 Messenger by Yahoo! Inc.

Publisher's description - “Just sign into Yahoo! Mail to enjoy the same Yahoo! Messenger for the Web service you know and love. Yahoo! Messenger within Yahoo! Mail also allows you to chat with your Facebook and Windows Live friends without requiring any installation.”

3% remove it

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.