home

01dc28f12894a0f25a08f6f6edb5c0e5.exe

The application 01dc28f12894a0f25a08f6f6edb5c0e5.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address server-52-85-83-119.lax1.r.cloudfront.net on port 80 using the HTTP protocol.
Version:
2.40.2.49

MD5:
9bb71ce16e4e87b4785dcf12652ef76b

SHA-1:
de25dc769cffde6a125fd5458b669db30153f20d

SHA-256:
6ba736db51858f4bc3aaa4a614690e1ce33a56b8b0730858024e958b091f1c51

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/28/2025 6:54:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Wajam.Meta (M)
16.1.26.15

File size:
489 KB (500,736 bytes)

Product version:
2.40.2.49

Original file name:
TF0GZS.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\wanetworkenhancer\wanetworkenhancer internet enhancer\01dc28f12894a0f25a08f6f6edb5c0e5.exe

File PE Metadata
Compilation timestamp:
1/19/2016 11:43:08 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:jX6qxm0NGNy8uQfUbAhnT2lcG5HA+j/DHfic0pNsybRs:jhGRIf52C

Entry address:
0x7B93E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
4.8011

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
486.5 KB (498,176 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 212-83-168-196.rev.poneytelecom.eu  (212.83.168.196:80)

TCP (HTTP):
Connects to a23-15-155-27.deploy.static.akamaitechnologies.com  (23.15.155.27:80)

TCP (HTTP SSL):
Connects to a23-195-156-171.deploy.static.akamaitechnologies.com  (23.195.156.171:443)

TCP (HTTP):
Connects to host-66-96-225-200.myrepublic.co.id  (66.96.225.200:80)

TCP (HTTP SSL):
Connects to host-66-96-224-173.myrepublic.co.id  (66.96.224.173:443)

TCP (HTTP):
Connects to a104-93-234-29.deploy.static.akamaitechnologies.com  (104.93.234.29:80)

TCP (HTTP):
Connects to rtr3.l7.search.vip.sg3.yahoo.com  (106.10.162.43:80)

TCP (HTTP):
Connects to ip-160-153-16-231.ip.secureserver.net  (160.153.16.231:80)

TCP (HTTP):
Connects to ec2-23-23-248-231.compute-1.amazonaws.com  (23.23.248.231:80)

TCP (HTTP SSL):
Connects to xx-fbcdn-shv-01-sin6.fbcdn.net  (157.240.7.26:443)

TCP (HTTP):
Connects to server-52-85-83-175.lax1.r.cloudfront.net  (52.85.83.175:80)

TCP (HTTP):
Connects to server-52-85-77-111.lax3.r.cloudfront.net  (52.85.77.111:80)

TCP (HTTP):
Connects to s3-1-w.amazonaws.com  (54.231.82.138:80)

TCP (HTTP):
Connects to r-246-58-45-5.ff.avast.com  (5.45.58.246:80)

TCP (HTTP):
Connects to r-239-44-234-77.ff.avast.com  (77.234.44.239:80)

TCP (HTTP):
Connects to r-238-44-234-77.ff.avast.com  (77.234.44.238:80)

TCP (HTTP SSL):
Connects to host-66-96-224-162.myrepublic.co.id  (66.96.224.162:443)

TCP (HTTP):
Connects to host-66-96-224-158.myrepublic.co.id  (66.96.224.158:80)

TCP (HTTP):
Connects to host-66-96-224-157.myrepublic.co.id  (66.96.224.157:80)

TCP (HTTP SSL):
Connects to host-66-96-224-147.myrepublic.co.id  (66.96.224.147:443)

Remove 01dc28f12894a0f25a08f6f6edb5c0e5.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.