home

checker.exe

checker

Product:
checker

Version:
1.0.0.2

MD5:
387404c481dd7a25060f8598f7e7eadb

SHA-1:
265ac642e3a8e030db7c57830209da12661ded64

SHA-256:
5737c027e50fdd8fbde93152b7b100a274034174d1673299f754b417678dd0d6

Scanner detections:
5 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/23/2024 5:09:41 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clod9d9.Trojan
1.3.0.4959

McAfee
Artemis!387404C481DD
5600.6609

Norman
Downloader.HJJU
11.20151017

Trend Micro House Call
TROJ_GEN.F47V1012
7.2.290

Vba32 AntiVirus
BScope.Trojan-Downloader.Obfuscated
3.12.24.3

File size:
180 KB (184,320 bytes)

Product version:
1.0.0.2

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\checker.exe

File PE Metadata
Compilation timestamp:
10/4/2013 1:11:48 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
10.0

CTPH (ssdeep):
3072:CVaOpOtnaY9Gf4NEf2qBVbqFU4TtOO/93MZgwGMx9tWqoP:UaDFz95+2qB8FUKtOO/ZMcQLoP

Entry address:
0x147CC

Entry point:
E8, AB, 6A, 00, 00, E9, 95, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 54, 24, 0C, 8B, 4C, 24, 04, 85, D2, 74, 69, 33, C0, 8A, 44, 24, 08, 84, C0, 75, 16, 81, FA, 80, 00, 00, 00, 72, 0E, 83, 3D, 24, D5, 42, 00, 00, 74, 05, E9, 0B, 6B, 00, 00, 57, 8B, F9, 83, FA, 04, 72, 31, F7, D9, 83, E1, 03, 74, 0C, 2B, D1, 88, 07, 83, C7, 01, 83, E9, 01, 75, F6, 8B, C8, C1, E0, 08, 03, C1, 8B, C8, C1, E0, 10, 03, C1, 8B, CA, 83, E2, 03, C1, E9, 02, 74, 06, F3, AB, 85, D2, 74, 0A, 88, 07, 83, C7, 01, 83, EA...
 
[+]

Entropy:
6.3858

Code size:
138.5 KB (141,824 bytes)

The file checker.exe has been seen being distributed by the following URL.

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../checker.exe

Scan checker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.