home

ch.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from rgho.st and multiple other hosts.
MD5:
1246a985aaf9d324315d346b62b722c7

SHA-1:
aca9c143e0c402b043f19b35ff0536d528c4bc33

SHA-256:
436218b731adf8cb4f78c9cd4254b5cbd7acc4ab666d5e904a3620e133f0ad4b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 4:40:23 AM UTC  (today)

File size:
118.5 KB (121,344 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
1/30/2015 1:26:22 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
3072:jFf8OCiPsCvscgKka3vkdRgISj3EPAzN+9:l8OCilkO4R/4EPAz09

Entry address:
0x12A0

Entry point:
55, 89, E5, 83, EC, 08, C7, 04, 24, 02, 00, 00, 00, FF, 15, 0C, 34, E2, 00, E8, 98, FE, FF, FF, 90, 8D, B4, 26, 00, 00, 00, 00, 55, 8B, 0D, 24, 34, E2, 00, 89, E5, 5D, FF, E1, 8D, 74, 26, 00, 55, 8B, 0D, 18, 34, E2, 00, 89, E5, 5D, FF, E1, 90, 90, 90, 90, 55, 89, E5, 5D, E9, 07, 10, 01, 00, 90, 90, 90, 90, 90, 90, 90, 55, 89, E5, 83, EC, 38, 8B, 45, 08, A3, A4, B2, 41, 00, 8B, 45, 0C, A3, A8, B2, 41, 00, 8B, 45, 10, A3, AC, B2, 41, 00, 8B, 45, 14, A3, B0, B2, 41, 00, E8, DD, CA, 00, 00, 85, C0, 75, 27, C7...
 
[+]

Packer / compiler:
MingWin32

Code size:
90 KB (92,160 bytes)

The file ch.exe has been seen being distributed by the following 10 URLs.

http://rgho.st/download/7tlWJVbRZ/.../Hesoolver v2.5.6.exe

http://www.fayloobmennik.net/files/.../138085684.html?check=718bdd1c61aab89b085c6975ba9f04bc&file=4726673

http://www.fayloobmennik.net/files/.../97832316.html?check=96c7f8aa563b3d3901e0369516c5abf5&file=4726673

http://www.fayloobmennik.net/files/.../87423596.html?check=116683243cf6baae178ca95261918107&file=4717083

http://rghost.ru/download/8xGNYB5vt/.../8e5f8e9d7f0f2005d981f45e49967b96dfa0375c/Hesoolver v2.5.6.exe

http://www.fayloobmennik.net/files/.../57997428.html?check=50e54e1b67e2d0ba3164b143988bc902&file=4717083

http://www.fayloobmennik.net/files/.../51064086.html?check=c0eb9072d8f11f93d14fe8ef6481e4f4&file=4717083

http://rghost.net/download/7tlWJVbRZ/.../9924007e94e3f55602e8cb73d946eb649b2914c8/Hesoolver v2.5.6.exe

http://www.fayloobmennik.net/files/.../42905060.html?check=61dba33e487b6f7bcdd7dbc6c37b9b2c&file=4726673

http://rghost.ru/download/8xGNYB5vt/.../Hesoolver v2.5.6.exe

Scan ch.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.