home

去水印工具.exe

MD5:
f1dcb9929ab6b0a1a7d5ecbd878bce5b

SHA-1:
acd66ff0f16d770c5230da22f2adb0057bcfa627

SHA-256:
9f25dc6172b2c87faec81981c3d4bdd0b3fdf8bb1d78ff209db80fa814a0f389

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 7:36:25 AM UTC  (today)

File size:
317.4 KB (325,025 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\?????.exe

File PE Metadata
Compilation timestamp:
8/22/2013 9:00:55 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:FifSEHHbrpWIe3zUkJVO+1uTrY6Rk+w6CKLAJbm:Fif5xWIalUTr/R1w6CKL0bm

Entry address:
0x1085F

Entry point:
E8, 9D, 58, 00, 00, E9, 78, FE, FF, FF, 55, 8B, EC, 83, EC, 04, 89, 7D, FC, 8B, 7D, 08, 8B, 4D, 0C, C1, E9, 07, 66, 0F, EF, C0, EB, 08, 8D, A4, 24, 00, 00, 00, 00, 90, 66, 0F, 7F, 07, 66, 0F, 7F, 47, 10, 66, 0F, 7F, 47, 20, 66, 0F, 7F, 47, 30, 66, 0F, 7F, 47, 40, 66, 0F, 7F, 47, 50, 66, 0F, 7F, 47, 60, 66, 0F, 7F, 47, 70, 8D, BF, 80, 00, 00, 00, 49, 75, D0, 8B, 7D, FC, 8B, E5, 5D, C3, 55, 8B, EC, 83, EC, 10, 89, 7D, FC, 8B, 45, 08, 99, 8B, F8, 33, FA, 2B, FA, 83, E7, 0F, 33, FA, 2B, FA, 85, FF, 75, 3C, 8B...
 
[+]

Entropy:
4.4641

Code size:
98 KB (100,352 bytes)

The file 去水印工具.exe has been seen being distributed by the following 3 URLs.

http://171.111.152.30/ws.cdn.baidupcs.com/.../f1dcb9929ab6b0a1a7d5ecbd878bce5b?xcode=e840e94181c3a8a1dba69ebf0e0d05d5e8660f9dacc2f793837047dfb5e85c39&fid=2436106615-250528-683595305463027&time=1409416766&sign=FDTAXER-DCb740ccc5511e5e8fedcff06b081203-eNOq2Fjz0vkCWYBV6Vz2wX3cw5k=&to=sc&fm=Bei,B,U,ny&sta_dx=0&sta_cs=151&sta_ft=exe&sta_ct=5&newver=1&newfm=1&flow_ver=3&expires=1409417366&rt=sh&r=347079476&mlogid=3275413404&sh=1&vuk=-&vbdid=327412369&fn=?????.exe&wshc_tag=0&wsts_tag=5401fe3f&wsid_tag=7cf45a90&wsiphost=ipdbm

http://ws.cdn.baidupcs.com/.../f1dcb9929ab6b0a1a7d5ecbd878bce5b?xcode=e840e94181c3a8a1dba69ebf0e0d05d5e8660f9dacc2f793837047dfb5e85c39&fid=2436106615-250528-683595305463027&time=1409416766&sign=FDTAXER-DCb740ccc5511e5e8fedcff06b081203-eNOq2Fjz0vkCWYBV6Vz2wX3cw5k=&to=sc&fm=Bei,B,U,ny&sta_dx=0&sta_cs=151&sta_ft=exe&sta_ct=5&newver=1&newfm=1&flow_ver=3&expires=1409417366&rt=sh&r=347079476&mlogid=3275413404&sh=1&vuk=-&vbdid=327412369&fn=?????.exe

http://d.pcs.baidu.com/file/f1dcb9929ab6b0a1a7d5ecbd878bce5b?fid=2436106615-250528-683595305463027&time=1409416766&expires=1409417366&rt=sh&chkv=1&chkpc=et&sign=FDTERVYA-DCb740ccc5511e5e8fedcff06b081203-tf7nF4R33gEHmpmHriWWmyxVZgs=&r=347079476&sharesign=3iJU9 LFUTgLvetlCdsfg3dOfI/ZOysfUPlyn9XtvbuFDLMdnPM16 9EW2wMEKGflX6vmt5wkBumV/DftXmC0cOvTlp7qaLv4o/XjGPSLluTY c8YfsPTi10d9SpjIKct/IBb5hHQWxhlAy7kze05elb3lsXtfRqRaTpuRWmHMeAqjEbJ8rWj8FUstLsFd/k LfV6HmZR A3R8EZEh0RAiZUN6 8p NEOUNnkDz9Kmzc7F49OlDKdNgJrExCMf5pnt6nNCDX6aBQ0J/kQRsor13cz2PQCPtd/.../bB2ArEmwNVb69mA==&sh=1&cflg=511

Scan 去水印工具.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.