{"id":1569,"date":"2014-08-26T14:00:18","date_gmt":"2014-08-26T14:00:18","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=1569"},"modified":"2018-05-29T12:02:03","modified_gmt":"2018-05-29T12:02:03","slug":"kiril-skiba-anti-virus-report","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/kiril-skiba-anti-virus-report\/","title":{"rendered":"Kiril Skiba – 2 of 54 Anti-Virus programs detect the Kiril Skiba file"},"content":{"rendered":"

Hello there, just a quick post on a publisher called\u00a0Kiril Skiba<\/strong>\u00a0that\u00a0I found while running some tests on FreeFixer<\/a> v1.12. I should have this new version of FreeFixer out this week. The suspicious file is named ldownload.exe<\/strong> and the following screenshot shows the User Account Control dialog when running the Kiril Skiba<\/strong> file.<\/p>\n

\"Kiril<\/a><\/p>\n

The digital certificate appears to be relatively\u00a0new. It\u2019s valid from the 11th of Junly, 2014. According to the certificate, Kiril Skiba\u00a0is located in Ukraine. The certificate is issued by \u00a0Certum Code Signing CA<\/strong>.<\/p>\n

\"Kiril<\/a><\/div>\n
<\/div>\n

At the time being,\u00a0the detection score\u00a0for the Kiril Skiba\u00a0file is very low. When I uploaded the file to VirusTotal – as I usually do when I find something that looks suspicious – \u0018\u00a0only QIhoo-360<\/strong> and\u00a0VBA32<\/strong> detected the file. The detection names are\u00a0HEUR\/Malware.QVM10.Gen<\/strong> and suspected of Trojan.Downloader.gen.h<\/strong>. With those two detections, I’d stay away from the file. It will be interesting to see if the other anti-virus programs will add this file\u00a0it in the future.<\/p>\n

\"Kiril<\/a><\/p>\n

When I tested to run the Kiril Skiba file, nothing appeared to happen. I could not see any modification at all on my lab computer. No windows popped up. Nothing.<\/p>\n

Did you also find a file digitally signed by Kiril Skiba? Did it pose as something useful?<\/p>\n","protected":false},"excerpt":{"rendered":"

Hello there, just a quick post on a publisher called\u00a0Kiril Skiba\u00a0that\u00a0I found while running some tests on FreeFixer v1.12. I should have this new version of FreeFixer out this week. The suspicious file is named ldownload.exe and the following screenshot shows the User Account Control dialog when running the Kiril Skiba file. The digital certificate … Continue reading Kiril Skiba – 2 of 54 Anti-Virus programs detect the Kiril Skiba file<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54,16],"tags":[153,154],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1569"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=1569"}],"version-history":[{"count":5,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1569\/revisions"}],"predecessor-version":[{"id":1577,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1569\/revisions\/1577"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=1569"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=1569"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=1569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}