โปรปั้มเลือด.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from download1847.mediafire.com and multiple other hosts.
Description:
AutoIt v3 Compiled Script

Version:
3, 0, 102, 0

MD5:
03dbd25d41ef9de7e2a25ad0d73c8665

SHA-1:
5265eb5992c70e368eb9eabde68ff475f81e2914

SHA-256:
6b49f2e29cacc56f411640c1215e1e63050890bbb49884b6f650b91706273cdd

Scanner detections:
4 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/26/2024 4:28:06 AM UTC  (today)

Scan engine
Detection
Engine version

IKARUS anti.virus
Trojan.SuspectCRC
t3scan.1.8.9.0

Trend Micro House Call
PAK_Generic.005
7.2.298

Trend Micro
PAK_Generic.005
10.465.25

ViRobot
Trojan.Win32.A.Blocker.90631[h]
2014.3.20.0

File size:
88.5 KB (90,631 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United Kingdom)

File PE Metadata
Compilation timestamp:
8/5/2004 3:29:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:uccZ5lhNCvL/OeTbERu3jBjeSEArDzDcya14k+B2QcRKzcVvsgOjVP5NSYKZa:uccZ34F/ERuVySjrDUyxZcQcRKTjd5Sa

Entry address:
0x441C0

Entry point:
60, BE, 00, 00, 43, 00, 8D, BE, 00, 10, FD, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 19, 8B, 1E, 83, EE, FC, 11, DB, 72, 10, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 78, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11...
 
[+]

Entropy:
7.7836

Packer / compiler:
UPX 2.90LZMA

Code size:
84 KB (86,016 bytes)

The file โปรปั้มเลือด.exe has been seen being distributed by the following 10 URLs.

http://download1847.mediafire.com/1ajfadqbqhqg/.../pro.exe

Scan โปรปั้มเลือด.exe - Powered by Reason Core Security