home

cain_and_abel 4.9.43_setup.exe

The application cain_and_abel 4.9.43_setup.exe has been detected as a potentially unwanted program by 16 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.dropbox.com and multiple other hosts.
MD5:
6fd3c21ef5e301a91e44d2666d9dc90c

SHA-1:
6a77bb40f384cdbcdb520b0765029459add78fcf

SHA-256:
5344fe4124b232a1dbde7e9d91385231327cb611caf3aa695b262e3064af919b

Scanner detections:
16 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 12:52:43 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Win-AppCare/Pswtool.7992528
2014.01.06

Avira AntiVirus
SPR/Cain.7992528
7.11.123.168

avast!
Win32:PUP-gen [PUP]
2014.9-131222

Bkav FE
W32.Clod248.Trojan
1.3.0.4613

Dr.Web
Tool.Cain.71
9.0.1.0356

F-Prot
W32/Backdoor2.HMWL
v6.4.7.1.166

IKARUS anti.virus
not-a-virus:PSWTool.Win32.Cain
t3scan.2.2.29

K7 AntiVirus
Hacktool
13.175.10735

Kaspersky
not-a-virus:PSWTool.Win32.Cain
14.0.0.4584

Malwarebytes
PUP.PasswordTool
v2013.12.22.06

McAfee
PWCrack-Cain
5600.7274

Reason Heuristics
Unnamed.Threat.14
14.3.2.17

Rising Antivirus
PE:Trojan.Win32.Generic.136D87B6!325945270
23.00.65.131220

Trend Micro House Call
HKTL_CAIN
7.2.356

Trend Micro
HKTL_CAIN
10.465.22

VIPRE Antivirus
Cain & Abel (not malicious)
25130

File size:
7.6 MB (7,992,528 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
5/27/1997 7:03:53 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
4.20

CTPH (ssdeep):
196608:TSiLBRiuSljfl1hfDk4F4DulUT6qnOBqhliAiVFoxGva:Tx7iRFfg4uS6OOl6FdS

Entry address:
0x31A0

Entry point:
64, A1, 00, 00, 00, 00, 55, 8B, EC, 6A, FF, 68, 00, 50, 40, 00, 68, 40, 48, 40, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 60, 53, 56, 57, 89, 65, E8, FF, 15, 80, 82, 40, 00, A3, BC, 62, 40, 00, 33, C0, A0, BD, 62, 40, 00, A3, C8, 62, 40, 00, A1, BC, 62, 40, 00, C1, 2D, BC, 62, 40, 00, 10, 25, FF, 00, 00, 00, A3, C4, 62, 40, 00, C1, E0, 08, 03, 05, C8, 62, 40, 00, A3, C0, 62, 40, 00, E8, 9A, 01, 00, 00, 85, C0, 75, 0A, 6A, 1C, E8, 2F, 01, 00, 00, 83, C4, 04, C7, 45, FC, 00, 00, 00, 00, E8, 40, 14, 00, 00...
 
[+]

Entropy:
7.9990

Developed / compiled with:
Microsoft Visual C++ v4.2

Code size:
15.5 KB (15,872 bytes)

The file cain_and_abel 4.9.43_setup.exe has been seen being distributed by the following 5 URLs.

https://www.dropbox.com/sh/jwvw9ghi15wwusq/.../ca_setup.exe

http://s10455.chomikuj.pl/File.aspx?e=t9EYzFiWpXHubJtqBm8b3komIZh30UX3eaYqr4WbQ4dv0BM4wNYgE9AYYmbGQajW5_0XWmfC5OvWXchdVOfjdIuNje5kRjFLMirfjNYzFcFN6uqcUYOp3305xaUPOwo7NoT1sqvp2o3nXiBkNfQrylRfZwoQjttIn4M7q1yLtZk&pv=2

http://download1us.softpedia.com/dl/808047d9caa2fb1d9706511b2dc02e5b/501088a3/100038678/software/security/.../ca_setup.exe

http://192.168.10.101/ca_setup.exe

http://www.oxid.it/.../ca_setup.exe

Remove cain_and_abel 4.9.43_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.