home

хліб.exe

SunRav BookReader

SunRav Software

This is a setup program which is used to install the application. The file has been seen being downloaded from freemail.ukr.net.
Publisher:
SunRav Software  (signed and verified)

Product:
SunRav BookReader

Version:
3.7.0.391

MD5:
abd39ea2b4b837c1ad4ccc03909c5ecd

SHA-1:
7c906cc4d1e8176b4c3787d32996d39355ba6b16

SHA-256:
cf8a66cddd9804b02f6aec2753fc9316a6f82fb5380b063a6ff584466d0e65c5

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
1/8/2025 7:48:54 PM UTC  (today)

File size:
5.7 MB (5,993,585 bytes)

Product version:
3.7

Copyright:
2002-2009, SunRav Software

Trademarks:
SunRav BookReader

Original file name:
breader.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\My documents\хліб.exe

Digital Signature
Signed by:
SunRav Software

Authority:
VeriSign, Inc.

Valid from:
12/17/2009 2:00:00 AM

Valid to:
12/18/2010 1:59:59 AM

Subject:
CN=SunRav Software, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SunRav Software, L=Novosibirsk, S=Novosibirsk, C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
49EFE95383DEBE28270B241E5001DEDF

File PE Metadata
Compilation timestamp:
12/20/2009 10:38:01 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:ZJvxwzGEXIwghKvGRjlpMjN/R8+tCmofnXG8/WhUIh9oWZ6AhoMo49yj9L+abuAv:ZJvJwghJ+dRjtCmof28/Wh3h9oWZ6AbZ

Entry address:
0x1000

Entry point:
68, 01, C0, 8F, 00, E8, 01, 00, 00, 00, C3, C3, A4, 32, 66, 78, E0, 92, ED, 06, 5F, D0, 56, D0, 78, 98, 57, 58, DA, 88, F6, 95, 8E, 5B, AB, C2, FD, 2F, 2C, FB, 20, 91, 84, D3, 56, D9, B5, 54, 6B, 93, F0, 74, A1, C2, 91, D2, 34, 60, BA, 1C, 12, 0A, 32, 68, B1, 8F, B5, FA, 57, 78, 73, C1, DC, B3, 4C, 31, A7, 30, 73, BA, 28, CB, 60, 70, D9, C0, 31, 18, FA, 59, 19, 64, B7, 65, 92, 4B, 86, 89, 7B, 03, 93, 54, 07, EB, 0F, 72, E0, 6C, 22, 45, 1E, CF, 19, D7, 9B, 26, 4A, 26, 21, AE, 0D, D6, 0F, 7E, 20, C4, C5, 48...
 
[+]

Packer / compiler:
ASProtect v1.2x (New Strain)

Code size:
3.9 MB (4,109,824 bytes)

The file хліб.exe has been seen being distributed by the following URL.

https://freemail.ukr.net/attach/get/14019199750094971855/.../????.exe

Scan хліб.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.