GridinSoft Threat Intelligence

KBF468010286A5910F.exe file report

Under review File reputation report
MD5 b35d158fc7473f92a7c0affbef62ce5d
Latest seen 2022-02-19 23:48:48 (4 years ago)
First seen 2017-05-21 13:07:29 (9 years ago)
Size 4 MB
Product MailRuSputnik
Signed by LLC Mail.Ru

Why it matters

Evidence available for this file

Detection

No final classification is available yet.

Timeline

First seen 2017-05-21 13:07:29 (9 years ago); latest analysis 2022-02-19 23:48:48 (4 years ago).

Publisher context

Product metadata: MailRuSputnik.

Digital signature

Signed by LLC Mail.Ru. The signature is reported as valid, but signed files can still be bundled or abused.

Aliases

This hash has appeared under multiple file names, which can happen with repackaging, bundling, or deliberate renaming.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Use the hash and metadata below to verify the exact file identity.
  2. Review publisher, signature, paths, and PE details for inconsistencies.
  3. Run a local scan if the file appears unexpectedly or starts with Windows.

File context

KBF468010286A5910F.exe is a Windows file recorded in the ThreatInfo database. It is associated with MailRuSputnik. The current detection status is Undefined, based on the latest analysis from 2022-02-19 23:48:48 (4 years ago).

ThreatInfo does not have a final classification for this file yet. Use the technical details below to compare the hash, size, signature, and observed locations with the copy found on your device.

File Details

Product Name: MailRuSputnik
MD5: b35d158fc7473f92a7c0affbef62ce5d
Size: 4 MB
First Published: 2017-05-21 13:07:29 (9 years ago)
Latest Published: 2022-02-19 23:48:48 (4 years ago)
Status: Undefined (on last analysis)
Analysis Date: 2022-02-19 23:48:48 (4 years ago)

Overview

Signed By: LLC Mail.Ru
Status: Valid

The signature on KBF468010286A5910F.exe is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

Common Places:

%localappdata%\temp
%temp%\3bf385a9-9ee3-4ee8-982e-fedd82d888b1
%temp%\0435e294-1d9c-41eb-a1c8-9ccefd6f4f90
%sysdrive%\$recycle.bin\s-1-5-21-3118798610-2729874070-2900721389-1000\$redv5h3
%sysdrive%\$recycle.bin\s-1-5-21-3118798610-2729874070-2900721389-1000
%sysdrive%\$recycle.bin\s-1-5-21-3118798610-2729874070-2900721389-1000\$re23eb5.ru\sputnik\ptls
%temp%\bd24ebd6-e9a8-4b53-9ee4-2e64c03576ed
%temp%\fb2c86b8-d5ff-4655-9c1e-cd036a889de1
%temp%\c93a9dbb-8a6b-4747-b933-c0d11c891d7e
%profile%\иха\local settings\application data\mail.ru\sputnik\ptls

ThreatInfo has observed KBF468010286A5910F.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

File Names:

103 observed names
KBF46CC17DD5D4BF76.exe KB366B5AF2DA9612BF.exe mailruhomesearch.exe hcv_mailruhomesearch (1).exe mailruhomesearch (1).exe 3BF385A9-9EE3-4EE8-982E-FEDD82D888B1.exe hcv_mailruhomesearch (2).exe 0435E294-1D9C-41EB-A1C8-9CCEFD6F4F90.exe KBF78E03F1BF5EDBBA.exe hcv_mailruhomesearch.exe F58ACB8A-89EA-4B63-9958-ABC1027FB2C9.exe $RI5KJH2.exe $RZ5ACPP.exe BD24EBD6-E9A8-4B53-9EE4-2E64C03576ED.exe gu7vUllazQFq.exe DMPGyGYywsPM.exe mailruhomesearchvbm.exe Z4YAAJ1FNOrc.exe C93A9DBB-8A6B-4747-B933-C0D11C891D7E.exe hcv_mailruhomesearch (5).exe hcv_mailruhomesearch (4).exe hcv_mailruhomesearch (3).exe 6CD04A46-F86E-42C1-82B2-7E83F2D85702.exe YaVpDKSFmICO.exe jBYHFRjxymM4.exe YNX3rHjwTOUZ.exe xrbwWmmyqUSD.exe VnvUmf20S4sB.exe Jtd4rULM9K2q.exe VNcJ1ArBV3Ap.exe 1E39AE01-F93F-470A-955E-F40A433F6FF4.exe ADDB62D9-9375-4AA6-9787-600A288D837C.exe 1yQ5cucR32iO.exe 1571B395-A7E3-47EB-9FE3-3515470A1BF8.exe R8i7S3f9OHhh.exe D477D24E-E38A-47B2-AC07-4112465981E6.exe FF450006-A0B5-4618-A907-E538AE2940FE.exe KB7DDB1277BE8D3C58.exe j02vrvXoqo3W.exe IiKmt1VkdaEl.exe pJNkFsbVx2dd.exe VAQwqrWSWJyS.exe xdvDhpfymH0q.exe A267CF95-A949-4A28-8CB0-583C536085AF.exe 4345E762-3D1D-4F62-9228-2598A1179E72.exe 0576088A-AEE8-48C8-97D0-517165CF9AB8.exe A79B0566-E1B9-4931-A86A-070E504E8797.exe 126EAB0E-FBAC-43B3-AF90-CB05641CD47C.exe 11704A6D-C3C9-46C9-91B7-D8352AF00FC9.exe A8D45236-FF44-4104-9FA4-031F0D41D9B9.exe 8805AB6F-ACD5-404B-ABAF-CCD7518EEE3C.exe EJUMvtMYTQLt.exe nmbc6KHtdwSR.exe DlsSbwNdz4gW.exe 60212B93-AC5B-4E08-82C0-06E3457C5777.exe 40YS7tFpzXwJ.exe mVRAle81XGFI.exe 2C5AD380-1A76-4DCF-AF90-2EE6F7858D88.exe A0053396.exe HIS8K5KhCHDG.exe Oebd0gK76jUO.exe H7KM9KzWQtrL.exe 63915FBF-5DA7-41D7-B3F6-8C7CE6082402.exe KB769AF08A11665EB7.exe KB286CFB62EED7F4EF.exe KBFE76952E3EB525EB.exe 91DC78089F0F4379ADA28420B4CFD934 55000F06-DB99-4C40-A2DE-F6FE6DB598B5.exe 0C94D629-C293-4839-97DE-968FC548A01C.exe APptvyc3CYnC.exe eZ9S88PJk9Mg.exe wn9HQl048xT8.exe gkizZ5ev8rF1.exe 8221E1EB-C1D2-455B-BBDF-8AB15E054487.exe 75341E4A-9FBB-48CE-BA77-4F70C39AB475.exe E7YdbUk93fpS.exe $RYTLSAM.vir 4305F2C6-DA59-4A0C-BB4B-8F4B55C5AAF8.exe 6C24C751-FDB4-4297-8C73-BEE4DD66721B.exe KB2579237C35922571.exe KB6F30E6F12A994ABA.exe yvSunvr98oe9.exe E5B9C9C7-E867-495F-A50C-38C2FCCCCB8E.exe 9ABE7F587428473EA3C0497B4EC35079 1353.tmp.exe mailruhomesearch[1].exe zo2xc5KJyzcZ.exe C9uKXOxgjAJN.exe 73776F34-0FB2-478A-BECD-E0D265A85A74.exe F830BD55-C88B-4591-BB4A-3A13B28A2941.exe UMncEjoyOGkF.exe z5edv03eU1Rj.exe 385C687D-D845-46DC-872B-2C650ACFB6D2.exe phK6S13h6Cp1.exe D6839871-191C-437F-9C30-2F682709C437.exe KB8390A02D95DAD8E6.exe x53SKMjXRJYH.exe RI6CSCFMPd2m.exe 8E783558-61D0-4B61-B31A-AE75C014AE78.exe uJeeSUw0hgLe.exe 5E87CE41-A474-4CB2-9861-A2843040E6D8.exe E68C7049-7466-4446-8801-8D6D120F4103.exe KBF468010286A5910F.exe

This hash has been seen with multiple file names. Alternate names can appear when software is updated, copied between folders, packed by an installer, or deliberately renamed to avoid recognition. Compare the exact MD5 above before assuming two names refer to the same file.

Geographic signal

Observed country distribution

ThreatInfo has seen KBF468010286A5910F.exe across 14 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Ukraine
Share 43.2%
Low High activity

The strongest geographic signal for this file is Ukraine with 43.2% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 7 63.3%
Windows 8.1 17.4%
Windows 10 8.9%
Windows XP 7.7%
Windows Vista 1.5%
Windows 8 1.2%

The most common operating system signal for KBF468010286A5910F.exe is Windows 7 with 63.3% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

KBF468010286A5910F.exe is identified as pe for 32-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Windows GUI
Entry point 0x001ed6d1
Image base 0x00400000

PE Sections:

Sections 6
Raw data 4416000

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 3200512 bytes · 72.5% of section data
MD5 6ad7c63f53adc9335b5c11f7723dec29
.rdata 609280 bytes · 13.8% of section data
MD5 30867440b9b6c499401c10d3aac178cb
.data 104448 bytes · 2.4% of section data
MD5 0b171e9c6e1017e20919af0f7e617b37
.tls 512 bytes · 0.0% of section data
MD5 bf619eac0cdf3f68d496ea9344137e8b
.rsrc 333824 bytes · 7.6% of section data
MD5 b02b5cf1b29c9060a0c50e201751c982
.reloc 167424 bytes · 3.8% of section data
MD5 17e4c2d28e8f2f0e10a1b574ad25a007

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

This file is still under review

ThreatInfo has not assigned a final verdict yet. Compare the file hash, location, signature, and publisher before trusting the file on a production system.

Scan with GridinSoft Anti-Malware Use a local scan if the file origin or behavior is unclear. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with b35d158fc7473f92a7c0affbef62ce5d.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan if the source, path, or behavior looks unusual.