home

iscsiwm.exe

TCP/IP Arp Command

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The executable iscsiwm.exe, “TCP/IP Arp Command” has been detected as malware by 25 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft® Windows® Operating System

Description:
TCP/IP Arp Command

Version:
6.1.7600.16385 (win7_rtm.090713-1255)

MD5:
f192534b0067787750655ff45b09f00e

SHA-1:
e0734dececa890d614f3da3c4154092cfac5732a

SHA-256:
d6238c1bf74b9b7ffaf852f868f216c5497899d8430d44af6f2982b659518113

Scanner detections:
25 / 68

Status:
Malware

Analysis date:
9/27/2024 3:18:33 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Agent
7.1.1

AhnLab V3 Security
Win-Trojan/FCN.140610
2015.11.12

Avira AntiVirus
TR/Dropper.MSIL.222407
8.3.2.2

Arcabit
Trojan.MSIL.Cassiopeia.4
1.0.0.593

avast!
Win32:Malware-gen
2014.9-151112

AVG
MSIL9
2016.0.2928

Baidu Antivirus
Trojan.MSIL.Injector
4.0.3.151112

Bitdefender
Gen:Variant.MSIL.Cassiopeia.4
1.0.20.1580

Dr.Web
Trojan.Inject2.8495
9.0.1.0316

Emsisoft Anti-Malware
Gen:Variant.MSIL.Cassiopeia
8.15.11.12.10

ESET NOD32
MSIL/Injector.MLR (variant)
9.12553

Fortinet FortiGate
MSIL/Injector.MLR!tr
11/12/2015

F-Secure
Gen:Variant.MSIL.Cassiopeia.4
11.2015-12-11_5

G Data
Gen:Variant.MSIL.Cassiopeia
15.11.25

IKARUS anti.virus
Trojan.MSIL.Injector
t3scan.1.9.5.0

K7 AntiVirus
Trojan
13.212.17825

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.1133

McAfee
Artemis!F192534B0067
5600.6584

Microsoft Security Essentials
Trojan:Win32/Skeeyah.A!rfn
1.1.12205.0

MicroWorld eScan
Gen:Variant.MSIL.Cassiopeia.4
16.0.0.948

Panda Antivirus
Trj/CI.A
15.11.12.10

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.151110

Sophos
Mal/MSIL-PL
4.98

VIPRE Antivirus
Trojan.Win32.Generic
45168

ViRobot
Trojan.Win32.Z.Injector.253952.T[h]
2014.3.20.0

File size:
248 KB (253,952 bytes)

Product version:
6.1.7600.16385

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
arp.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\windows\temp\iscsiwm.exe

File PE Metadata
Compilation timestamp:
11/8/2015 8:31:16 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:4eYuDXIUZ22BadJnsgERPeYzcJ1yjLbsTmYfS30tbhl+uoqcnI3h:vYNaBoVsgmb8mY6IloB

Entry address:
0x2874D

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.6001

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
156 KB (159,744 bytes)

Remove iscsiwm.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.