home

1911.dll

The library 1911.dll has been detected as malware by 9 anti-virus scanners. Additionally, the file is typically installed by a number of programs including Ultimate Vehicle Pack v10 for "Grand Theft Auto IV" by ZZCOOL and GTA IV - Maximum Graphics from Cyber 3D Club by Cyber 3D Club. The file has been seen being downloaded from mega.co.nz and multiple other hosts.
MD5:
45944658e93e052eb631dbb4fd5a3d97

SHA-1:
f13e4e7728c5a48a380f612023fb58b77eaa7c97

SHA-256:
5b8ad408fdde29e6c549f739f5d5a2826e6f803add4ffc32448b4760ee83c2ac

Scanner detections:
9 / 68

Status:
Malware

Analysis date:
11/30/2024 10:13:02 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Cloda28.Trojan
1.3.0.4613

F-Prot
W32/Backdoor2.HMGF
4.6.5.141

K7 AntiVirus
Backdoor
13.175.10766

McAfee
Artemis!45944658E93E
5600.7257

Norman
Suspicious_Gen4.ASEMQ
11.20140107

Sophos
Troj/Agent-XCR
4.96

Trend Micro House Call
HKTL_GAMEHACK
7.2.7

Trend Micro
HKTL_GAMEHACK
10.465.07

VIPRE Antivirus
Trojan.Win32.Generic
25196

File size:
166 KB (169,984 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\rzr\1911.dll

File PE Metadata
Compilation timestamp:
4/14/2009 2:20:16 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:gYVV3WE5T37uLaknMFLUR9T3w1NTOe/dP4BZcKeBs+xd4Jti+:h4k7TLLUR9TsT994BKVkti+

Entry address:
0x52A70

Entry point:
80, 7C, 24, 08, 01, 0F, 85, D9, 01, 00, 00, 60, BE, 00, A0, 02, 10, 8D, BE, 00, 70, FD, FF, 57, 83, CD, FF, EB, 0D, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 - v1.22, 0x

Code size:
164 KB (167,936 bytes)

The file 1911.dll has been discovered within the following programs.

GTA 4 RePack  by KloneB@DGuY
www.homedition.ru
About 1% of users remove it
GTA IV - Maximum Graphics from Cyber 3D Club  by Cyber 3D Club
73% remove it
GTA IV + EFLC version 1.5  by Black_Box
www.gGamez.org
About 9% of users remove it
GTA IV Final eEvolution 2015  by ABAllA
About 9% of users remove it
GTAPoliceMods Mod Pack  by GTAPoliceMods
www.GTAPoliceMods.com
About 8% of users remove it
LCPD First Response  by G17 Media
www.lcpdfr.com
About 3% of users remove it
Ultimate Vehicle Pack v10 for "Grand Theft Auto IV"  by ZZCOOL
About 7% of users remove it
Ultimate Vehicle Pack v11 for "Grand Theft Auto IV"  by ZZCOOL
About 5% of users remove it
 
Powered by Should I Remove It?

The file 1911.dll has been seen being distributed by the following 13 URLs.

https://mega.co.nz/temporary/.../8ZJ1iS7L

http://s6932.chomikuj.pl/File.aspx?e=BBxQ9dUQVNU9HwrGOtw2uVyA3GBA9jbeEV4kBFc5F0IPNdraj8czfso2u9pLaO1QEw6rU03pKSgBn1lI4r6FKTVJBaTzjO0OBaLlyEPBXHrResdiZULq_NnwqLOfx7Qe&pv=2

http://s6932.chomikuj.pl/File.aspx?e=BBxQ9dUQVNU9HwrGOtw2udBzTv29bNjFMRp1t9ycScYI8t10olxeN-FzYH7BOUY-6stWYzdczc76WEObod3E20MKNqcospaHP19MCMxDS_N0qFMxRH5mjm6_2EGxgaps&pv=2

http://s6932.chomikuj.pl/File.aspx?e=BBxQ9dUQVNU9HwrGOtw2uaiHU3ZV2jgFjVH6B90v1iEUdtw8NrO0MBM1Qn7Wh9Uw0CE6XBi9NNdRCqjUFYlvlT7LosxVBd9irnSYHnTv1kDouZjyiEVNOFc1E3ZWuXzX&pv=2

http://s6932.chomikuj.pl/File.aspx?e=BBxQ9dUQVNU9HwrGOtw2udXfOxj7cVAEkAvdI9AEcyS7R-0zOyWvflHLMc3VT0-0IKceSkeAXijd8Q_uKConEhBu4MW-MwOhJGvxpnxkZ3zAblaRRyQyC_v56skZ_aQJ&pv=2

http://s6932.chomikuj.pl/File.aspx?e=BBxQ9dUQVNU9HwrGOtw2udXfOxj7cVAEkAvdI9AEcyTtDUVCeG9gB1_-S-hgp9Km845rWtuWnGM_sP5mkA8ZEeHGgu-c8JqXWmTfztUl-1fT2Cago9KEjOe442cUDqLi&pv=2

about:internet

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_192752_ALXmjkQAABBKVUad1QI6UDmaKb8&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=6ef30d32-58dc-972e-0158-cf0010010000

https://downloader-ams3.disk.yandex.com.tr/rdisk/e017e85a3e68d360742e3ea0d46e6818/540109a5/4ZJ941FLJM6s4zzGhOG6Kaijgz3J1ehiSjdcHkwc7gwpzXgX_XBRF_s1ErM429T5MlnXKCMtWMw6JLmf-ueKtQ==?uid=0&filename=1911.dll&disposition=attachment&hash=gzMPDLC0lYUZK03ZX4sqLy77bR8JrCygLdv4nuGYxDY=:/.../x-msdownload&fsize=169984&hid=a5df9f2ebdf564c6f25df04622bac2f9&media_type=executable&rtoken=c6211bffed319795cd145d1a93580883&rtimestamp=5400d166&force_default=no

https://downloader.disk.yandex.com.tr/disk/e017e85a3e68d360742e3ea0d46e6818/540109a5/4ZJ941FLJM6s4zzGhOG6Kaijgz3J1ehiSjdcHkwc7gwpzXgX_XBRF_s1ErM429T5MlnXKCMtWMw6JLmf-ueKtQ==?uid=0&filename=1911.dll&disposition=attachment&hash=gzMPDLC0lYUZK03ZX4sqLy77bR8JrCygLdv4nuGYxDY=:/.../x-msdownload&fsize=169984&hid=a5df9f2ebdf564c6f25df04622bac2f9&media_type=executable

https://downloader-ams3.disk.yandex.com.tr/rdisk/dcecd58d061ebf1b76fd6bcddf272c51/54010955/4ZJ941FLJM6s4zzGhOG6Kaijgz3J1ehiSjdcHkwc7gwpzXgX_XBRF_s1ErM429T5MlnXKCMtWMw6JLmf-ueKtQ==?uid=0&filename=1911.dll&disposition=attachment&hash=gzMPDLC0lYUZK03ZX4sqLy77bR8JrCygLdv4nuGYxDY=:/.../x-msdownload&fsize=169984&hid=a5df9f2ebdf564c6f25df04622bac2f9&media_type=executable&rtoken=d598364ecb72d4f19c9d0e0e602f5658&rtimestamp=5400d116&force_default=no

https://downloader.disk.yandex.com.tr/disk/dcecd58d061ebf1b76fd6bcddf272c51/54010955/4ZJ941FLJM6s4zzGhOG6Kaijgz3J1ehiSjdcHkwc7gwpzXgX_XBRF_s1ErM429T5MlnXKCMtWMw6JLmf-ueKtQ==?uid=0&filename=1911.dll&disposition=attachment&hash=gzMPDLC0lYUZK03ZX4sqLy77bR8JrCygLdv4nuGYxDY=:/.../x-msdownload&fsize=169984&hid=a5df9f2ebdf564c6f25df04622bac2f9&media_type=executable

http://s10221.chomikuj.pl/File.aspx?e=BBxQ9dUQVNU9HwrGOtw2udXfOxj7cVAEkAvdI9AEcyQiYtVUP-0pW84vvm76kcUmO756EigVNpfX0Jh72324VkwlJ5G6IUNCTg6H7Z6ahc6aCDVuk6tJ51KOQNDWQ_xM&pv=2

Remove 1911.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.