home

breveCreatures.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
MD5:
af5b394f98e725e52d68d54a1cac5910

SHA-1:
e89e7ecbae1885d9f893aa62723af7bf887b3c74

SHA-256:
32a9d098ed7bab28c039177fee6025f3da0efd17da50a53c6402aaf513f8718f

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/25/2024 10:51:05 AM UTC  (today)

File size:
7.2 MB (7,504,344 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\brevecreatures.exe

File PE Metadata
Compilation timestamp:
7/1/2006 2:05:58 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:CqdNlUlxP8ZCIox3FcMXEkM2yyW3Vi4rnPCN8xukh8J:XI3EoIox3FXUDIWVHXxukh8J

Entry address:
0x3166

Entry point:
81, EC, 7C, 01, 00, 00, 53, 55, 56, 33, F6, 57, 89, 74, 24, 18, BD, 40, 92, 40, 00, C6, 44, 24, 10, 20, FF, 15, 30, 70, 40, 00, 56, FF, 15, 70, 72, 40, 00, A3, D0, F4, 42, 00, 56, 8D, 44, 24, 30, 68, 60, 01, 00, 00, 50, 56, 68, 60, 98, 42, 00, FF, 15, 58, 71, 40, 00, 68, 30, 92, 40, 00, 68, 20, EC, 42, 00, E8, 23, 28, 00, 00, BB, 00, 64, 43, 00, 53, 68, 00, 04, 00, 00, FF, 15, B4, 70, 40, 00, E8, 64, FF, FF, FF, 85, C0, 75, 24, 68, FB, 03, 00, 00, 53, FF, 15, B0, 70, 40, 00, 68, 28, 92, 40, 00, 53, E8, 0E...
 
[+]

Entropy:
7.9976

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file breveCreatures.exe has been seen being distributed by the following 11 URLs.

http://dw.uptodown.com/dwn/rL-j9T-qypT1WGAY4Cvj4U-ZVqk2XRKMjk0LCr1trtSJKiNaBb12WID5uGfOAp7sIma_Upp-kaQVe0aqiXRyWXqw1MjWk_O1h_NtwwaM5DU-G2jlSgnADzgGr_uoJ9HY/yEEvIwDSvc2rGU_8OjxPDX8XMm7hbPpqSvllebRAwSgtd1G9UP0M0bMttrpQ45WMpKLfUeKu0PaepKQ68-e9OhfI7VlVWevjui-s4jR2lB2IV60yn0DmLYEerOGHgKox/tGQQ9SN4ewZeH20BlJup3s8jyYe0NdFCWGrHQLHk6J4nBZXdn6QR7mD9FkLv4mavJBNibW1D_fW4QO3tHIBPam13VCAuzHE70YwNOKVkZZf5qTXnw0Y9lf0_2mV74Mc4/.../

http://dw.uptodown.com/dwn/xNCiUu9GKxySrbJmzj9nQrJUu3W0SaXmpcgfDJqHl7LCP3sk1UC76yP5TORhfQ7uWybs3MLBQP8x2aE_JIihd9ZhFK0g3D5_6w-_a88WljznyWDls1Razkezvs0ast1w/2R8s6BAM2rx9xa7DCTPVZMS7F63GXw4OLhXEFJCkOhw65Q5_bAw3pPEVWQwDSR20RqAys0KGGkEx6A0j-JG21HuSAMhJ06SpT9VDEnvnLORTpeH_8oldBry3TkUS9tkj/ECYvr1jGrHC_5YgIhH2iERPrUBCBiNZgcrzIm2V-GqfjpJnjgHYeunDwMnYPh9yiV320UiUOG4-TMRc2-rm0HKB8AiIw5J8hPbuCCVWgSYu8JWwxOsKHAWBj55fVamWw/.../

http://dw4.en.uptodown.com/u2d/.../brevecreatures-screensaver-2.7.5.exe

http://dw.uptodown.com/dwn/BMyoqw4NBvX5OA2OfBHrTtSXeSqy3446KOnaLlSiRBWT-yWs8x4gopJOoWBr0WkiSBlMuxdsziutukqYLoIkgM1b0olu9Zu6LwusGpE61sQ4hmLZVGeX9oxcB7uDr5GU/T4XOdXEej8L-qkNM2ny8m6fSdUZBeMyhSDgYucIHBGCDBTl-7DXPcZLI-mZL3p1nArO-vkVEBRMhM7l7Ce2UB9wkQCt0Y6A2uziDq6oE2YNNAdKKtk5mxBzsAeG88pal/kOnNepNrIhKQQ0EqBGsEing5EkwrAvJssjHSUqKECwDzNbxkC0vAB6vTMd_xOcwOcDuMDfec8HSHsyUfnM6rymzp6jWXWFTe7goLa266CRKU0V3v7uMJOVhmnn8oSW8O/.../

http://dw.uptodown.com/dwn/28rR-dUAT3vZEc6SECJ8PwnJqyDwco7DVQY9zrXypl_tAP7VvBnQsEvPApE4S-4eHlDQOGneUcsbIlp3i8AaS8svO5LNVLjGRfuDjr__1YMfesGhm0xq7VPORte0QOiz/V-cfmxD7foZLSk5xbhBVu7aSRB8RPFzkRPUySc-h5oFDH-WxzLT3fm5Ex-7zDwxIHSHsWpO0keLss2HQyJE5-I2r1wiW-vA90HMIcSFsP6xzaLUFNmQXcLRRLrCIanP0/.../

http://dw12.uptodown.com/dwn/JbKd-oCB15fUHOop2sb79t-TABvql-8tqev31sJKBmJbmLM5AW1Km2Pya0dUyqbh0GFAZsTA6jVm9_cIXMT8peYO0kefqQP11ib9oqRO6jDwU71KFiuMmLfZKZguTfL1/c75M3CdNCApqvLIz6esu6oMpz3kLEkB3aKOD4R3KegBSzHGqHrIF51Clxazwcu9eg1saq7PV3ml83T15RMMWMW8KU-q4XZjDCb5b2QtmuFOAvqoNikTxkV2k4XOyONFL/TqPKK8yjFNFd6SgRE1vgAbhJ9qgAIhbQlT8v0c5sDdWUVnXECtybSRLRGu68I6s_mklqEUnrBjJ_UShqBQEybGgHAr4kQUV3J6uCA8anrabrcCTYxUezXkE9pXNQVttk/.../brevecreatures-screensaver-2.7.5.exe

http://dw.uptodown.com/dwn/YS_1uN2XIFCokRwPtO0tAQ3LF7k7aCRkumA6S6VUaliqtVFXu5NHIeG_OYaQ-NLbKj8wW9UCNkxRRroI8rR4u0VKn-JpUS8WdLaJ-9GiXMP5m4mM_7hqOIqcfB5bURMv/1F-jcieI9aQwXKy7FxJEpAAKoJF2FxPR5fx2xwi3o9OxaBhStNCE--T6ehVrWVzw1UgmeSm0qOfFmDEO1neR3caiYslooUcK768gD0tlkV2_94bXhqQYxeo7gRQbMNqr/kpwakJaUECkVsGWymxVG5dPSRRrL1pBYxRGNQr3arLmk_TK9HHbX3gk2n2b_YR9DMt_fiaLBsd0b4trse_sTczD715E1jGzB0wK7tEGS5oXIWKOyl69gMPeCtQltkvUi/.../

http://dw6.en.uptodown.com/dw/1446937279/.../brevecreatures-screensaver-2.7.5.exe

http://dw.en.uptodown.com/dl/1420048786/.../brevecreatures-screensaver-2.7.5.exe

http://dw.en.uptodown.com/dl/1436346746/.../brevecreatures-screensaver-2.7.5.exe

http://www.spiderland.org/.../breveCreatures.exe

Scan breveCreatures.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.