home

____ _____ _______ ____ - 50 ____!.exe

The executable ____ _____ _______ ____ - 50 ____!.exe has been detected as malware by 1 anti-virus scanner. The file has been seen being downloaded from a.datacardbar.info.
MD5:
3f59d1fbde61791311968e6d80694013

SHA-1:
30a1e29be91e8cf5360727ce31e0c714d3c0ce83

SHA-256:
bd96239a62576953fd96b3eddfb9465349235300df3afc55016af31cc0408afe

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/23/2024 4:39:34 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.7.27.5

File size:
450 KB (460,800 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\____ _____ _______ ____ - 50 ____!.exe

File PE Metadata
Compilation timestamp:
8/25/2013 3:32:59 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:nHLwFWGXmibr6qUerwW78KZqDCurJOKVxMVMQjt7XRv9RdW6Q3EBXDKMJ5s0T7z6:0Fl2iiFe17Z0C4VxMWWbfIYJUF

Entry address:
0x409BB

Entry point:
E8, E6, 12, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 60, B1, 44, 00, E8, FF, 17, 00, 00, E8, B3, 14, 00, 00, 0F, B7, F0, 6A, 02, E8, 79, 12, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 28, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.4063

Code size:
278.5 KB (285,184 bytes)

The file ____ _____ _______ ____ - 50 ____!.exe has been seen being distributed by the following URL.

http://a.datacardbar.info/hp/?q=vw1/Zbwz8JWYxQIKEGrmuhHRwqP74bUrZz8ye8JcnHWFo8TaN2vJXlutJ0gmNa6Wlzi1K3rL4aHQR UrS87SIRJclAqEvZO6YerLf9AZqOf/SVWFpGFMnHY5Ba1CSDNiKduuwnQ8nwGPnz07c9giPbJnEDQL1hl3ad76PFuYIa0lZv0AaDz DS4Nf6 DBXXHJ3tzroFNc66X3zyTHHqFicxYwNeOsgf/YfXHECZlgiIb9l19wg9tOQWFvWP7c/J36a075whf8sZg2LDt k74ATK4tDNiwtB DZuuFqbbBYkqkzkoTk5hFI pd7YzOkOOY4YgWWy6sgTuXHFJXcJMH8Mzu3sq53w6EgYMflLPojun/HBuhrmE920W54VFp6lywFMztDqhu8TFYlRZ/u8rcO9mTb57Bmd1lTf5NdCp6JlzvjG0oD5Le0MqHcvSicRSUrmECQdbbpwA mIJi BbQKIegXYOdsih2vzYqVGpVt4236kxHBXanHA7yBUU0H8r3BCpADoIaSd1gBYRhabZqXzv0Gd1lMF2cRBvaZMzvjqgydYI0shMfqQYDa3Qnwh9hif5MNYY9QlDvHSjaDekdi8rdnNtjoDiNcE1g4VodcaFeP4QeUfdtuVeCPYq3odsuSt8yJJAJSEWsgD8LY23dXZlgkEVTo9uwgloFTKdysz 8LO6ZcjvBDOfAf6WjxZlbUYjBS9u XQBso2caYP7dBokUdsycE9tI5vJYI2cbTNmNnokX4qghmPIFRAYGULeJw6X6lOf9uqEstB 5loPaJ9itW845 g38OZudFHKikEA2aWla9ErYgH4/Ito9bpaiboRlM8K gsrdlE1g4Nsorh9gbqhsJwLzoYIbgsqfhX0rGaYC/.../

Remove ____ _____ _______ ____ - 50 ____!.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.