home

badblocklauncher.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from l.facebook.com and multiple other hosts.
MD5:
147ad95064d240906da93ab7d84df758

SHA-1:
0e07f33f1f7be625ef99d3d8c79a258327eb590d

SHA-256:
2c42bb5b74b69878f4c7b604575959dd20b718cc242498e77deb92354e901726

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/5/2024 1:56:12 PM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
Suspicious_GEN.F47V0301
7.2.109

File size:
290.6 KB (297,560 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\load\autres\badblocklauncher.exe

File PE Metadata
Compilation timestamp:
1/29/2015 5:29:20 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
1536:DAFtWBQ71YdmDjc1jjH8mrvY2h7dasr5F+njTTI4ds7PCwK4xJUW/yU:gtjKsOD8B2h7dasN4wdewK4ToU

Entry address:
0x1590

Entry point:
83, EC, 1C, C7, 04, 24, 02, 00, 00, 00, FF, 15, 0C, 43, 41, 00, E8, DB, FB, FF, FF, 8D, 74, 26, 00, 8D, BC, 27, 00, 00, 00, 00, A1, 50, 43, 41, 00, FF, E0, 89, F6, 8D, BC, 27, 00, 00, 00, 00, A1, 38, 43, 41, 00, FF, E0, 90, 90, 90, 90, 90, 90, 90, 90, 90, 55, 89, E5, 83, EC, 18, 83, 3D, 0C, B0, 40, 00, 00, 0F, 84, 8A, 00, 00, 00, A1, 00, 70, 40, 00, 85, C0, 75, 5C, A1, 74, B0, 40, 00, C7, 44, 24, 04, 00, 00, 00, 00, C7, 05, 0C, B0, 40, 00, 00, 00, 00, 00, 89, 04, 24, E8, 0D, 4C, 00, 00, 83, 3D, 70, B0, 40...
 
[+]

Code size:
21 KB (21,504 bytes)

The file badblocklauncher.exe has been seen being distributed by the following 8 URLs.

http://l.facebook.com/l.php?u=http://badblock.fr/.../download.php&h=tAQFKbqsyAQGNMwD2UJggODYGwwnXZt__ObQdThSQjLKg_A

https://badblock.fr/.../BadblockLauncher.exe

http://ccs.infospace.com/ClickHandler.ashx?ld=20160119&app=1&c=livestartpage2&s=live&rc=livestartpage2&dc=&euip=90.57.149.118&pvaid=616c3e472a8f415691947b8222b51bc5&dt=Desktop&fct.uid=3098ab65eea545ea8e4f173d79ba5859&en=gJizEtTfCiNzLV6yKL44mSX1JEWniA mVM3Js50M83N1cAlRFQ/kXg==&du=badblock.fr/.../download.php&ru=http://badblock.fr/.../download.php&ap=2&coi=1494&cop=main-title&npp=2&p=0&pp=0&ep=2&mid=9&hash=57C49D6DE127386B01BBF472AB72C5F2

https://badblock.fr/.../download.php

http://www.badblock.fr/.../download.php

https://badblock.fr/.../download.php

http://badblock.fr/LauncherV2/.../BadblockLauncher.exe

http://badblock.fr/.../download.php

Scan badblocklauncher.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.