home

arenainstaller_win32.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
MD5:
ff1e852473d1c1c309b40e5b4a93fb1c

SHA-1:
62c260dcfd61de1a7930f52546f93302837c6b51

SHA-256:
547c94db72e3a93b4e50b8407887b7737dff472e1a297b44a3906710815e819b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 3:59:28 AM UTC  (today)

File size:
2.7 MB (2,797,279 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\arenainstaller_win32.exe

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:fUAOOLs0w667O8S4rzNabxIsn9eTuCl/UU6qEIriHbhkm9HckxK5t8GfuFJ:f/LHw6GRrzuIw9eTuKUSEIm7hd9XK5tk

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file arenainstaller_win32.exe has been seen being distributed by the following 6 URLs.

https://dw.uptodown.com/dwn/ptOT3z7M0EngOXpshIJjC60faIu853pTHosVK_-b_x_50IWYM3va_0zael67dN5l2zxyUqu-a4KSaqETjBeDn1pjMh4MvxLGxMhuJ80rlmM1KGKkBdh9juVe29PCjuI6/k20TgEcSzEM74dmegtkT6h0Z1_TfA7wHiZSQt4x8rz7ZRhxxWk14oLK9OzG8p_pdk-Xsm59VV3ugwJAAMpE0R5LSgkl3AFsktNg2bwey62U93lTQbSqDe0dut34h9yiT/G2I_L2fMxuxGJKStzl0b2n2B4fegJdvPHktrPOoZflQYnaONXXm-RcnbM9byw2TVuYIbLYgKjo5q61yBmT4vilKXHDXKFZIa5sIFvKhiwi-ekUbLlEkG5KTH7npkURrQ/.../

https://dw.uptodown.com/dwn/_pchjF5dgaFqaZjY8KKN34gowwCMCK1bPg8_yOZ9U4qu01BkRWijq8XXcC_U74LGp61PTuZFWZKCQplDpnR72yzuUN38YhtIhIq1b-u8A-h0-tU0S8TXSeX2o7P1P3Od/Z8DMRn7zwUd7WxvgMO6AGZxBjPHHixXALagPhNGZH4NJQGPstaejourV99hPPTznTd_iyIjYWJUSDFtm2wrxBszDSMOT7yG-o0Rx95WWUA94ga0qa5YLG9N2Z41rGzDx/5TEzb3oUITvrhN-JMEmgxBLEo9kIZsnefH2wz4DMgkuYTJTCO25hnOheGkC-7zGiZGP3NRImdUjREiDSrSP3Y6C7O9xQQHuP8aBQPuga9vo-ULVNg7cHQ-IqFSRzHK7Y/.../

https://dw.uptodown.com/dwn/iui2lAsUT3BywcoE2djEyvdCcxSkN6PXQzK2C0T5b43grCne6bIDGkPYSHgXpdMftgTPyT7i4CEG2W-YAi-Y6zzTTzgN2SIy2lHF7jjkFsY-dVg9nM4p6ucZS-8NHKLK/lb3VhRewXWxJf_NfedH9UXRAeqKxvRM_flxbXeA22y8vlXl4cwgpkenkohq2buH85SHTkN3rD_YgGWesMyxs3wqJoDwJ7yDRoZgNrM4tpaTLG8Nv-VRsvVGfB7gEMVE4/t2jvG4KJRrcisf26XPPJC_VdqYPwKsVIbO3nITbQiEmghfdT2MefuW5UH5bFFi6U1zFn1o49RnPN1hK5ptqBybDXNewtun2o_b2QQcDdE7-OJBbdvY4DD1fNXFb3tlj7/.../

http://dw.fr.uptodown.com/dl/1447953407/.../dofus-arena-2-70-9-en-win.exe

http://dl.ak.ankama.com/games/dofusarena/client/.../ArenaInstaller_win32.exe

http://download.dofus-arena.com/full/.../

Scan arenainstaller_win32.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.