home

chew-wga.exe

Chew-WGA v0.9

Anemeros Software

The application chew-wga.exe, “The Perpetuation Endeavor” has been detected as a potentially unwanted program by 23 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from www28.zippyshare.com and multiple other hosts. While running, it connects to the Internet address moscow.cdnmail.ru on port 80 using the HTTP protocol.
Publisher:
Anemeros Software

Product:
Chew-WGA v0.9

Description:
The Perpetuation Endeavor

Version:
0.9.0.0

MD5:
6738d790fc0f3928a8a5f19d829cae4d

SHA-1:
db0a727520178061506c7ec07a99bac581610329

SHA-256:
60ca507ef4ba7dbbb7ef6ea4b975b9b09a24d7d0c91d38d0876331203f962d98

Scanner detections:
23 / 68

Status:
Potentially unwanted

Analysis date:
11/2/2024 1:30:33 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
HackTool.WinActivator
7.1.1

AhnLab V3 Security
Win-AppCare/Wpakill.M.9458428
2013.12.24

avast!
Win32:PUP-gen [PUP]
2014.9-131223

AVG
Tool_c.M
2014.0.3616

Dr.Web
Tool.Wpakill.4
9.0.1.0357

ESET NOD32
Win32/HackTool.WinActivator
7.9190

F-Prot
W32/Backdoor2.HMEE
v6.4.7.1.166

IKARUS anti.virus
possible-Threat.HackTool.Wpakill
t3scan.2.2.29

K7 AntiVirus
Trojan
13.174.10588

Malwarebytes
Hacktool.ChewWGA
v2013.12.23.03

McAfee
Crack-WindowsWGA.b
5600.7272

Microsoft Security Essentials
HackTool:Win32/Wpakill.C
1.165.247.01

MicroWorld eScan
HackTool:Win32/Wpakill.C
14.0.0.1071

NANO AntiVirus
Riskware.Win32.Wpakill.vrveq
0.28.0.57029

Norman
Suspicious_Gen2.SIJEP
11.20131223

nProtect
Trojan/W32.Agent.9458428
13.12.23.01

Reason Heuristics
Unnamed.Threat.24
14.3.3.12

Rising Antivirus
PE:Trojan.Agent!6.566
23.00.65.131221

Sophos
Generic PUA NL
4.96

Trend Micro House Call
HKTL_WPAKILL
7.2.357

Trend Micro
TROJ_GEN.F0C2C00JH13
10.465.23

VIPRE Antivirus
Trojan.Win32.Generic
24664

ViRobot
Trojan.Win32.S.Agent.9458428
2011.4.7.4223

File size:
9 MB (9,458,428 bytes)

Product version:
0.9.0.0

Copyright:
Copyright (c) 2009 - Anemeros Software

Trademarks:
Chew-WGA

Original file name:
cw.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\chew-wga.exe

File PE Metadata
Compilation timestamp:
6/23/2009 6:57:07 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:9O1vl2I4a7SdzRDymXLa4mnb0DtUog3jCUE2nKNfMILF9UBDHLSwxT1aQhS:Wt2O7Sd1ymX+4mnOU9+UCZM6kzWu12

Entry address:
0x173A6

Entry point:
55, 8B, EC, 6A, FF, 68, 90, 2C, 43, 00, 68, C4, BE, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, AC, 01, 43, 00, 33, D2, 8A, D4, 89, 15, A0, 0A, 44, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 9C, 0A, 44, 00, C1, E1, 08, 03, CA, 89, 0D, 98, 0A, 44, 00, C1, E8, 10, A3, 94, 0A, 44, 00, 6A, 01, E8, 45, 38, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, C3, 00, 00, 00, 59, E8, 86, 1A, 00, 00, 85, C0, 75, 08, 6A, 10, E8, B2, 00, 00, 00, 59, 33, F6, 89, 75...
 
[+]

Entropy:
7.9657

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
188 KB (192,512 bytes)

The file chew-wga.exe has been seen being distributed by the following 50 URLs.

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://atv.zp.ua/downloads/.../CW.eXe

https://download.poczta.onet.pl/11512779/.../ChevWega.exe

https://ud.interia.pl/.../getattach,mid,4720,mpid,3,uid,01859c14da70503c?f=aktywator.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www62.zippyshare.com/d/64874291/.../crack KB971033.eXe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

https://download.poczta.onet.pl/46894995/.../7CW.eXe

https://mega.nz/temporary/.../nFFFja6J

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://276049083.srv1.supershare.pl/getfile.php?id=192200&access_key=4d2b18d4024e4499171e95881c75ea7f&t=5808ce5b&o=35693BA7AF699C2B9A20EC377972B273396361AC4B852B31C74D2DEDD6F48C620360273FB9A90ED566D33D8C57606EAC732C&name=ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

https://doc-0o-8k-docs.googleusercontent.com/docs/securesc/fv90l116q26i7ibe14vduhu15eee77ga/b4n65345jecertf75i2blif34h0ih4ga/1481832000000/.../08858180628624383507/0B3pQ1B-8t1eqcmRhbk1wOWN4MDA?e=download

http://dla.uloz.to/Ps;Hs;fid=138910844;cid=203762021;rid=874157948;up=0;uip=84.16.53.10;tm=1487003046;ut=f;aff=ulozto.sk;did=ulozto-sk;He;ch=776060b75361ac151eb8f18298291a6a;Pe/.../aktivator-windows-7-vsechny-verze-exe?bD&c=203762021&De

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://382568990.srv1.supershare.pl/getfile.php?id=192200&access_key=a249a1db3e83a9adfc8253d1f826d927&t=57ebbe56&o=B8E4D0CBB0EFEBC1DA86DA67EBD8AD12B1FFD3CEB6E7F7C4DA9BDA67BCC5FB44BBAD80CDAAE598918ED2C61B92D8AF0EB8E4&name=ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

http://www28.zippyshare.com/d/dRLeh1QU/.../ChevWega.exe

Latest 30 of 329 download URLs

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to moscow.cdnmail.ru  (94.100.180.110:80)

Remove chew-wga.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.