home

cleo4_setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from s6097.chomikuj.pl and multiple other hosts.
MD5:
ea95af5f1f90b95e26002f5d1a36edf2

SHA-1:
25513b27427bf034746d3260720078ac5207b3ce

SHA-256:
0e1b1739f3d48d7bc1b3839ff70b55efe209e8168c8627b6d1a90968dda0dd1a

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/25/2024 1:45:35 PM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
HTML.FileDownload_version_dll
2.1.4+

File size:
402.4 KB (412,023 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\cleo4_setup.exe

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:jopUHjm7olvdJnPSTti45MjIIQpPZ/WEtiDcdGk:jopEj5VdPSTtjaQZ/Wq2cdz

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9243

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file cleo4_setup.exe has been seen being distributed by the following 19 URLs.

http://s6097.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqbWPrt9Vb1k0YPDqCdI6ohW0zTn38tyrbn42yAVFbUX4QgP3Hii2dVDYTrWnxnisehnZuvvwWXeki-c80GKmwMybsVQ10I50Ixn6ISgHOC5qqreZc1bQZQeR9hjPRz3T7A&pv=2

https://downloader.disk.yandex.com/disk/cfeed95bbc60268bdc428e056eabcc03ea1e188d09eedca138b1f7e211581635/5842dc9f/.../x-msdownload&fsize=412023&hid=241a9eafdabdd07491fda55bdc1e552f&media_type=executable&tknv=v2

http://s6097.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC___h1xnlGLqStR6NAIChEC5nm0UKToUx8qEGnw3JBW5avkF6al4-3ylUt3gQ1lG7gjkcaF4vg1h2eoOxY8z6iu&pv=2

https://downloader.disk.yandex.ru/disk/9e7c01a44ef86306d8a0d98a1bb4e2fb7feb7dad4906157cab722f72da6ff777/5813b988/.../x-msdownload&fsize=412023&hid=241a9eafdabdd07491fda55bdc1e552f&media_type=executable&tknv=v2

http://s6097.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC96TRnQrkR3UABRaZcRRFooBa7GvbrBxmXElkPX8zLVQ1wiTJnhDNuodsUReiwT75f_NTKUK1X3ilIHi2ExyIeK&pv=2

http://s6097.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC8QOehC0Osx4AJny8BQGrQ863-HjyagxQ1bT_txoTFv2oA69j1bMwbkPW15Y_MmIH9Osg8n7n8bkVfyuj-puQy9&pv=2

https://mega.nz/persistent/.../epxmhLhD

http://s10377.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC_pRIIpOa2cd2KIEsFVDIyxDZ28OBAEAcPYL2W3c-QuejBQ8hXr-Lihv8Wq20RMEKdUUMCRgACqt1n2kk9peytq&pv=2

http://dc260.4shared.com/download/.../CLEO_4.exe

http://s6097.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqdjWQoRorw2MBZFh4InLG3gOvNqtw3Fh8MDMsyRjhLujoX1Xs1BhGZOtRvMeE__8vS7-6X0saRj-wCiJ0OrHXEAbZfVz4AFaORnnTX93gVSq&pv=2

http://s6097.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC8cVyy7micj1yX4HueErZnshKmtMmgofDMWpoB95KC5VxlScmjHcuMxfnEr-hY6JOCnGrkt1RD4YM9fCFAsFVxx&pv=2

https://mega.nz/temporary/.../J9sThLZR

http://s10377.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqdjWQoRorw2MBZFh4InLG3gaCDmXZNTOjQIqDI1zQvryDgAKsocacdm_Kh-HNnMfuyaM9hXzMPjNbGbJlpDRMpLzTI5dAdbSJhkt70nvzzrO&pv=2

http://s10377.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC-dQeuIdQIyCIa7j7dSCFDv7b_AEWF2o9uTdohZq5Ayr_Msh78vT99Ih9p9w-QznXWdorbiZCsUA7uI03tIr1fh&pv=2

http://dc699.4shared.com/download/.../CLEO_4.exe

http://s10377.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqboRlAtrnPE4_Pj253I4ZSlFc2wjDG1Qawho6_PpYh8baWWsPUtrAKCuv_Pt0mj6QUXJhYm8zeDdPFOtRMgGP_9YQeR_Yju3U0nEhlP9-1to_i2Zr_EztDSqnSbA7Sd8HA&pv=2

https://downloader.disk.yandex.ua/disk/8ac3e53054e95c358602adb80c394df4e4b4ca325159ff6bee18b0955238961f/56b7ccae/.../x-msdownload&fsize=412023&hid=241a9eafdabdd07491fda55bdc1e552f&media_type=executable&tknv=v2

http://s10377.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC__hDbpqOkSAgKBvcywy-yOMkbnrMLAES7SfSbcbjvuhZCHPXT6kTtrKb2ceNPP6hEV0PO-czzlXUlRgoN5sgFO&pv=2

http://s10377.chomikuj.pl/File.aspx?e=4vhBpLsjgytoKPfv9fDYqRSvRQKg68t3eBnn62TMgC8WsA3o6w2YqIysZ16pPpZrVB-P2XN6wt0tFtzGI1WcKhzXf9TNQXNeY-w5FyWUclm2oula9flUwFddOB0HIPIA&pv=2

Scan cleo4_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.