ltr.exe threat report

MD5 d1abc8dafab24e22274c820842e0b5ee
Latest seen 2021-01-10 04:02:38 (5 years ago)
First seen 2021-01-09 11:51:07 (5 years ago)
Size 17 MB
Publisher Loaris Inc.

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as General Threat. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
General Threat
Recommended action
Scan and remove
Last analysis
2021-01-10 04:02:38 (5 years ago)
File hash
d1abc8dafab24e22274c820842e0b5ee
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as General Threat.

Timeline

First seen 2021-01-09 11:51:07 (5 years ago); latest analysis 2021-01-10 04:02:38 (5 years ago).

Publisher context

Company metadata: Loaris Inc.. Product metadata: Loaris Trojan Remover.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

ltr.exe is a Windows file recorded in the ThreatInfo database. It is associated with Loaris Trojan Remover. The reported company name is Loaris Inc.. The current detection status is General Threat, based on the latest analysis from 2021-01-10 04:02:38 (5 years ago).

If ltr.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as General Threat.

Product Name: Loaris Trojan Remover
Company Name: Loaris Inc.
MD5: d1abc8dafab24e22274c820842e0b5ee
Size: 17 MB
First Published: 2021-01-09 11:51:07 (5 years ago)
Latest Published: 2021-01-10 04:02:38 (5 years ago)
Status: General Threat (on last analysis)
Analysis Date: 2021-01-10 04:02:38 (5 years ago)
ltr.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

%programfiles%
%programfiles%
%programfiles%
%sysdrive%\tèlèchargement\loaris_trojan_remover_3.1.60\loaristrojanremover\app
%profile%\downloads\loaris trojan remover 3.1.60

ThreatInfo has observed ltr.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

40.0%
40.0%
20.0%

The strongest geographic signal for this file is Russian Federation with 40.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for ltr.exe is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

ltr.exe is identified as pe for 64 systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000000400000
Entry Address: 0x00b347b0

PE Sections:

Name Size of data MD5
.text 11921920 4cd7ba0af979fa6b6e9aa8ad78ef4645
.data 1095168 5b930e02523a4fb7aa041854e3ce4c17
.bss 0 d41d8cd98f00b204e9800998ecf8427e
.idata 49664 0ab5e3c880d6110a75b52dc584b996aa
.didata 5632 16d53456462b98d3443b4bc035f61f38
.edata 512 43c8bd81af7315fe7735c2a6974d7318
.tls 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 512 abf1740f2972909c752571a4f806d38f
.reloc 558592 8012ddb774a267c1b1f4aa0dce488c8c
.pdata 602624 59f54f38781ea7ac0f7efc3143c63661
.rsrc 3673088 e5a2ca7604a1b1a21664541139221086

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: