home

audition_ht_manualpatchclient160623_001.exe

勁舞團

HappyTuk Co., Ltd.

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from f.sync.hamicloud.net and multiple other hosts.
Publisher:
HappyTuk Co., Ltd.

Product:
勁舞團

Description:
勁舞團 Setup

MD5:
c551ef114c4d2af34fa45daccaa85395

SHA-1:
909a7dadfca945f2f038a1ac3ee48887dd7a7ca3

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/25/2024 1:40:34 PM UTC  (today)

File size:
123.7 MB (129,739,696 bytes)

Product version:
1.0.0.1

Copyright:
HappyTuk

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\Documents and Settings\{user}\My documents\downloads\audition_ht_manualpatchclient160623_001.exe

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
3145728:ET/7Qy02x02AT7JLiLVBDkwqueRTf78uDo/V7/EXBMr738xcYTM7:ETjQy02xo3JC2RRTfADVIXoLmC7

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
8.0000

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file audition_ht_manualpatchclient160623_001.exe has been seen being distributed by the following 6 URLs.

http://f.sync.hamicloud.net/.../@download?b9b7ca6c226d29964270c71c42c559ea&6efdcf2887a394a7e77ac4bcb379cc34

http://f.sync.hamicloud.net/.../@download?4928402f684992be53ef153093838296&0173cfbb1df2d59f9d896f918ba144f3

http://f.sync.hamicloud.net/.../@download?2d27905920e7a00c95e8d76d0827bcc6&99a96b62ae5043b287129eca919cb5ac

http://f.sync.hamicloud.net/.../@download?b1f3dd3a7f5c38a6142bd8ec0e4bebc2&8b6279cd7bdbf79b7e595794353a1f65

https://docs.google.com/uc?export=download&confirm=HVNK&id=0B10AxbDB9Rv5czZjOTJNbkdnSEU

http://f.sync.hamicloud.net/.../@download?f931166330d17f2345025dea29e7a8a6&cea58daf9de86dfe5e4ca7672d508fa0

Scan audition_ht_manualpatchclient160623_001.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.