Gridinsoft Logo
File Icon

The AULA F75 Setup v2.0 20230923(1).exe File Analysis

Updated 11 months ago
Checked by Malware Check
AULA F75 Setup v2.0 20230923(1).exe

Technical Analysis

File Name AULA F75 Setup v2.0 20230923(1).exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows
SSDEEP Hash
49152:OKVbr2u/cd1t+fDDlU6knXa/s/r1nXIBLp1gr5KXrS/3f+TGh1oWGe24ZSQeQO06:bbT/cfqknmsB471S5KO3eG9ZZE0o/
Scanner Version 1.0.183.174
Database Version 2024-08-05 09:00:37 UTC
⚠

Suspicious File Detected

Detected by 28 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

Convagent is riskware or adware that displays unwanted advertisements and generates revenue through user interactions and ad clicks.
38%
Detection Rate
3,138,372
File Size (bytes)
28/74
Engines Detected
2024-08-05
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
d2fe9aa9aa2373a22ff48c2cbc49b4f9
SHA1
4d87e97d2a818bb54ee1cdb3866b09af8a180abd
SHA256
53c05f8669aa0bb2fd950650ea845e9410205f5d543fe192c6c3563fc46cc1ce
SHA512
0a843c3afcb890840511b10694ed048eb9928892dd825a27d35d398e8a4724014f98e81d7fde1e8c0f75bf62d21e34afc3adb1efe9bfa534bc8159c1526dedf4
ImpHash
72faf036969f0d1e2da5e177111256fc

Security Engines with Detections (28 of 74)

Bkav
W32.Common.FC4EC5A2 Malicious
Lionic
Adware.Win32.Convagent.2!c Malicious
MicroWorld-eScan
Trojan.GenericKD.71953368 Malicious
FireEye
Trojan.GenericKD.71953368 Malicious
CAT-QuickHeal
Trojan.Agent Malicious
Cylance
unsafe Malicious
Sangfor
Trojan.Win32.Agent.Vc6b Malicious
Cybereason
malicious.9aa237 Malicious
Paloalto
generic.ml Malicious
TrendMicro-HouseCall
TROJ_GEN.R002H09CG24 Malicious
Avast
FileRepMalware [Misc] Malicious
Kaspersky
not-a-virus:UDS:AdWare.Win32.Convagent.gen Malicious
BitDefender
Trojan.GenericKD.71953368 Malicious
Emsisoft
Trojan.GenericKD.71953368 (B) Malicious
VIPRE
Trojan.GenericKD.71953368 Malicious
McAfeeD
ti!53C05F8669AA Malicious
MAX
malware (ai score=82) Malicious
GData
Trojan.GenericKD.71953368 Malicious
Webroot
W32.Trojan.Gen Malicious
Google
Detected Malicious
Varist
W32/ABRisk.MKWI-8968 Malicious
Antiy-AVL
GrayWare[AdWare]/Win32.Convagent Malicious
Arcabit
Trojan.Generic.D449EBD8 Malicious
ZoneAlarm
not-a-virus:UDS:AdWare.Win32.Convagent.gen Malicious
VBA32
BScope.TrojanSpy.Keylogger Malicious
AVG
FileRepMalware [Misc] Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
AdWare:Win/Convagent.gen Malicious
46 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 814617a1bc2c9d26f74cd025ec5b5579
Fuzzy: f9638652d09599bec17d335f323f975c
dHash: 11ccccf0f0713244
Image Base 0x00400000
Entry Point 0x004163c4
Compilation Time 2009-08-15 19:29:32
Checksum 0x00000000 (Actual: 0x00309180)
OS Version 5.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 5 libraries
oleaut32, advapi32, user32, kernel32, comctl32
Exports 0 functions
Resources 20 Resources
Sections 9 Sections

Version Information

▼
Comments This installation was built with Inno Setup.
CompanyName AULA
FileDescription
FileVersion
LegalCopyright
ProductName
ProductVersion
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 82,900 bytes 82,944 bytes 6.48 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ CDA3F5DB2A563079F68FF49207A072E8
.itext 0x00016000 2,860 bytes 3,072 bytes 5.73 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 751BE2588CBFE7E40EB201C2CFF8A4C7
.data 0x00017000 3,484 bytes 3,584 bytes 2.67 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E62932C7214C54C4C642C26544C71FC3
.bss 0x00018000 22,232 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.idata 0x0001e000 3,990 bytes 4,096 bytes 4.96 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0C8776D0BDC06DF93BA1292A2E0AAAEB
.tls 0x0001f000 8 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x00020000 24 bytes 512 bytes 0.19 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3746F5876803F8F30DB5BB2DEB8772AE
.reloc 0x00021000 6,484 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.rsrc 0x00023000 185,460 bytes 185,856 bytes 3.72 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1C456E28E815E25499852F482FB78133

Resource Analysis

▼
Total Resources: 20 (184,263 bytes)
Resource Type Count Total Size Percentage
RT_ICON 7 144,408 bytes
78.4%
RT_STRING 6 3,200 bytes
1.7%
RT_RCDATA 4 33,956 bytes
18.4%
RT_GROUP_ICON 1 104 bytes
0.1%
RT_VERSION 1 1,208 bytes
0.7%
RT_MANIFEST 1 1,387 bytes
0.8%

Certificate Chain Analysis

▼
Certificate Information

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
28 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware