home

3eebdfe20858d43b1e31b8c28eaa289d.exe

The application 3eebdfe20858d43b1e31b8c28eaa289d.exe has been detected as a potentially unwanted program by 2 anti-malware scanners. While running, it connects to the Internet address server-54-192-75-209.hkg50.r.cloudfront.net on port 80 using the HTTP protocol.
Version:
2.37.2.29

MD5:
c17fc0972e22ab61a8af5005c4a49f70

SHA-1:
38ac42078d7bd731acf92f83875ca92dccafb014

SHA-256:
6d259a07307d0fe4e7ca71b92501331dded76626f7d2e74f409afd0bb9929bc2

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 2:16:10 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Wajam.Meta (M)
16.2.9.21

Rising Antivirus
PE:Malware.RDM.32!5.26[F1]
23.00.65.151018

File size:
308.5 KB (315,904 bytes)

Product version:
2.37.2.29

Original file name:
FL8TS9.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\wnetenhancer\wnetenhancer internet enhancer\3eebdfe20858d43b1e31b8c28eaa289d.exe

File PE Metadata
Compilation timestamp:
10/16/2015 5:17:01 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:uadWcr/w4X+hvuCj9WTZN/T/la14EX284zRP6EzYiZSh3U6R:Hh/wOCj92Z1jc14EXZ4zcEzYJh3U6

Entry address:
0x4E7EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 10, 00, 00, 00, 20, 00, 00, 80, 18, 00, 00, 00, 38, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 50, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 68, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
306 KB (313,344 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP SSL):
Connects to edge-star-shv-01-hkg3.facebook.com  (31.13.95.8:443)

TCP (HTTP SSL):
Connects to static.vnpt.vn  (113.171.64.82:443)

TCP (HTTP SSL):
Connects to edge-star-mini-shv-01-hkg3.facebook.com  (31.13.95.36:443)

TCP (HTTP SSL):
Connects to edge-star-mini-shv-01-sin6.facebook.com  (157.240.7.35:443)

TCP (HTTP SSL):
Connects to edge-star-shv-01-sin6.facebook.com  (157.240.7.20:443)

TCP (HTTP SSL):
Connects to coccoc.com  (123.30.175.14:443)

TCP (HTTP SSL):
Connects to xx-fbcdn-shv-01-hkg3.fbcdn.net  (31.13.95.12:443)

TCP (HTTP SSL):
Connects to server-54-230-182-215.icn50.r.cloudfront.net  (54.230.182.215:443)

TCP (HTTP):
Connects to server-54-192-183-186.icn50.r.cloudfront.net  (54.192.183.186:80)

TCP (HTTP):
Connects to rtr3.l7.search.vip.gq1.yahoo.com  (208.71.45.11:80)

TCP (HTTP SSL):
Connects to mc.yandex.ru  (87.250.251.119:443)

TCP (HTTP SSL):
Connects to ec2-52-201-145-238.compute-1.amazonaws.com  (52.201.145.238:443)

TCP (HTTP):
Connects to ec2-52-201-128-113.compute-1.amazonaws.com  (52.201.128.113:80)

TCP (HTTP):
Connects to ec2-52-1-145-160.compute-1.amazonaws.com  (52.1.145.160:80)

TCP (HTTP):
Connects to b0.1a.5177.ip4.static.sl-reverse.com  (119.81.26.176:80)

TCP (HTTP):
Connects to a60-254-168-205.deploy.akamaitechnologies.com  (60.254.168.205:80)

TCP (HTTP):
Connects to a23-53-210-66.deploy.static.akamaitechnologies.com  (23.53.210.66:80)

TCP (HTTP):
Connects to a23-41-75-27.deploy.static.akamaitechnologies.com  (23.41.75.27:80)

TCP (HTTP):
Connects to a104-76-107-101.deploy.static.akamaitechnologies.com  (104.76.107.101:80)

TCP (HTTP):
Connects to 94.31.0.90.IPYX-076665-ZYO.above.net  (94.31.0.90:80)

Remove 3eebdfe20858d43b1e31b8c28eaa289d.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.