home

自由之门翻_墙-2014年8月6日版本.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from d.pcs.baidu.com.
MD5:
3657229289d10dde8ad2dbdd323de25f

SHA-1:
e197b74124c4bd1895ea594d841bd0d925e8cf0f

SHA-256:
7573a841f3e812508888552d2019ca2cc1b7cb320c132c4fedfd2c106a4bdc05

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/23/2024 5:05:54 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Freegate.A potentially unsafe application
8.0.319.0

File size:
2.9 MB (3,067,130 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
1/9/2012 9:44:06 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:kWHa7++ISvrKUF9Q08gqf3uYUjzNYIRKkKyHKBshh3nE62ZtX5V4Hrp6SAv:kRXv2gQ0Lq/uvDyOKBs33E62ZtXXAg

Entry address:
0xB3C1

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, F2, 2D, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, B0, A1, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 1C, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 1C, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, D9, A6, FF, FF, C3, 55, 8B, EC, 83, EC, 1C, 56, 33, F6, 56, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 40, 32, 41, 00, 85, C0, 74, 21, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 44, 32, 41, 00, 8D, 45, E4...
 
[+]

Entropy:
7.9924  (probably packed)

Code size:
71 KB (72,704 bytes)

The file 自由之门翻_墙-2014年8月6日版本.exe has been seen being distributed by the following URL.

http://d.pcs.baidu.com/file/3657229289d10dde8ad2dbdd323de25f?fid=2135590327-250528-14737369943383&time=1409655883&expires=1409656483&rt=sh&chkv=1&chkpc=et&sign=FDTERVYA-DCb740ccc5511e5e8fedcff06b081203-BhwMxHuOCbYLeptdKisd4UxhU7I=&r=792342242&sharesign=NpMupBS5kgV4lJsXfh5VDYwC7ZhvPZAiwk4n7nTK GbUlZhS8PfEalQQG V14OWKtLU6vNVZ3LisyXQcYr0N7tQh1Nxvagclfog/V15NSWjVfxaDiWpm74SZ qZk4xIXfkLOR2WzFOONf59SPn3ie5xwajpXstpaIQDH9QyQQe63SbGSi9HuSr39iTxPAti9mBq8ORYOQ7iyuD/.../yKbyg3MwXRNDKUMSTKVg58GXcjsdaqTzNsiKVgFZG2JodqOsXQme8uRLiNR96mbK2zeHXPj3SnGg==&sh=1&cflg=65535

Scan 自由之门翻_墙-2014年8月6日版本.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.