home

bf2_sp_bot_change_v2.1.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from www.playground.ru and multiple other hosts.
MD5:
79f701da5075ed7c50adcc1424069f29

SHA-1:
6bdd9004e36f4098c1f8472cb7356f3b695d6a5b

SHA-256:
78b6c464cae5e07c97b84d67691c830f17f6d164b97c9b7c05cf0ae688551a0f

Scanner detections:
6 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/26/2024 1:06:26 PM UTC  (today)

Scan engine
Detection
Engine version

F-Prot
W32/SelfStarterInternetTrojan!M
v6.4.7.1.166

Norman
Suspicious_Gen2.VGLYF
11.20140803

Rising Antivirus
PE:Trojan.Win32.Generic.1270442F!309347375
23.00.65.14801

Trend Micro House Call
PAK_Generic.005
7.2.215

Trend Micro
PAK_Generic.005
10.465.03

VIPRE Antivirus
Trojan.Win32.Generic
28244

File size:
49.5 KB (50,688 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
10/4/2005 3:44:46 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.50

CTPH (ssdeep):
768:f3qlrx/FPvGWA7+Pp4ObzvWR+dq6+9ciWThSnHjiKPEZ5buD0vP+BgpU8hpalA:Cz/leWvp4Qz+R+anH2KPEZdM0v2+Laa

Entry address:
0x1CD80

Entry point:
60, BE, 15, 20, 41, 00, 8D, BE, EB, EF, FE, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75...
 
[+]

Packer / compiler:
UPX 2.90LZMA

Code size:
44 KB (45,056 bytes)

The file bf2_sp_bot_change_v2.1.exe has been discovered within the following program.

BF2SP64  by Viathon
bf2sp64.googlepages.com
About 7% of users remove it
 
Powered by Should I Remove It?

The file bf2_sp_bot_change_v2.1.exe has been seen being distributed by the following 4 URLs.

http://www.playground.ru/.../?file=67699&mirror=&from=http&hash=1j30uiub54fozuy7g3n5zpzcfwnxzz9j

http://download1587.mediafire.com/1djariafpamg/.../BF2 SP Bot Change v2.1.exe

http://www.playground.ru/.../?file=67699&mirror=&from=http&hash=b4fejvjmd4mat9tuk2mjb3nloxmdu86m

https://downloader.disk.yandex.ua/disk/a13369cbb32d23175c15ecff714f4b70c5bf7f8b96eaff3d45b902fc0d0ba6f9/56992853/.../x-msdownload&fsize=50688&hid=cd069dbb82c4a68d751671af2f8c3555&media_type=executable&tknv=v2

Scan bf2_sp_bot_change_v2.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.