File Investigation Report
U91.EXEMalware Downloader
Your PC may be infected. The presence of a file called U91.EXE is a possible sign of infection.
You should urgently check your PC to make sure it is not infected. The free version of Prevx CSI will scan your PC in less than two minutes and check for millions of spyware and malware infections including U91.EXE. Don't put your confidential data, or your identity at risk, check your PC now with Prevx CSI.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Malware Downloader
File Behavior
U91.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- The Process is polymorphic and can change its structure
- Can communicate with other computer systems using HTTP protocols
- Executes a Process
- Enables the system to use a Communications Proxy Server
- Registers a Dynamic Link Library File
- Writes to another Process's Virtual Memory (Process Hijacking)
- This Process Deletes Other Processes From Disk
U91.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed from Temporary Folders
- Executed as a Process
- Deleted as a process from disk
- Terminated as a Process
- Has code inserted into its Virtual Memory space by other programs
Country Of Origin
The filename U91.EXE was first seen on Aug 16 2008 in the following geographical region of the Prevx community:
- SPAIN on Aug 16 2008
File Name Aliases
U91.EXE can also use the following file names:
- U.EXE
- U91[1].EXE
- 28460341.EXE
- 84990829.EXE
- 14457937.DAT
- OMHCKMPM.EXE
- 1DEC1493-0659-42FA-921C-66E94D9625DC_U91.EXE
Filesizes
The following file size has been seen:
- 368,128 bytes
- 214,016 bytes
- 93,946 bytes
Vendor, Product and Version Information
These files have no vendor, product or version information specified in the file header.
File Type
The filename U91.EXE refers to many versions of an executable program.