home

cryea.dll

The library cryea.dll has been detected as malware by 10 anti-virus scanners. The file has been seen being downloaded from fix4dll.com and multiple other hosts.
MD5:
f7cd1b54e619e20add6d40148e301e59

SHA-1:
88d9d6015e4207aff8fb3a5d91c4003c2216f2f1

SHA-256:
28427a9e2a82ac09abe6b8f662f722de1f38ad71a05dc3d3d9f14d675e266e6a

Scanner detections:
10 / 68

Status:
Malware

Analysis date:
12/27/2024 6:39:15 PM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
Troj.W32.Mepaow
2.1.4+

AhnLab V3 Security
Win-Trojan/Obfuscator.M.179712
14.04.11

Bkav FE
W32.Clod0ad.Trojan
1.3.0.4959

Comodo Security
UnclassifiedMalware
18081

IKARUS anti.virus
Virus.Win32.Obfuscator.XZ
t3scan.1.6.1.0

McAfee
Generic Packed
5600.7164

Microsoft Security Essentials
VirTool:Win32/Obfuscator.XZ
1.10401

Norman
Suspicious_Gen4.DCQAU
11.20140411

Panda Antivirus
Trj/Thed.W
14.04.11.07

Sophos
Mal/Generic-S
4.98

File size:
175.5 KB (179,712 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\r.g. mechanics\crysis 3\bin32\cryea.dll

File PE Metadata
Compilation timestamp:
2/25/2013 3:49:55 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:oTH/E62xVC80KZ6SGNGJtHwkC48pPvVBOj5BQJ1BzJFkYLs2KZAtgPF1Pio:eH862xVrDZYCJVCPV2BQDHFkYBw

Entry address:
0x2BC0

Entry point:
55, 8B, EC, 8B, 45, 08, A3, 68, 8D, 00, 10, B8, 01, 00, 00, 00, 5D, C2, 0C, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 33, C9, 33, D2, 33, FF, 39, 4D, 0C, 76, 2F, 53, FE, C1, 0F, B6, C9, 8A, 1C, 31, 47, 8D, 04, 1A, 0F, B6, D0, 8A, 04, 32, 88, 04, 31, 02, C3, 0F, B6, C0, 88, 1C, 32, 0F, B6, 1C, 30, 8B, 45, 08, 30, 5C, 07, FF, 3B, 7D, 0C, 72, D3, 5B, 5F, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, E9, 47, 9A, 02, 00, 8D, 64, 24, 24, 0F, 8E, 43, 01, 00, 00, 53...
 
[+]

Entropy:
7.3279

Developed / compiled with:
Microsoft Visual C++

Code size:
12 KB (12,288 bytes)

The file cryea.dll has been seen being distributed by the following 10 URLs.

http://fix4dll.com/.../?file=CryEA.dll&md5=F7CD1B54E619E20ADD6D40148E301E59

http://www.dll-found.com/dll-8d/.../CryEA.dll

http://www.dll-found.com/dlld3/.../CryEA.dll

http://freecache8-free.uloz.to/Ps;Hs;fid=31354946;cid=1910171434;rid=1097800993;up=0;uip=118.208.237.165;tm=1404025796;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=28b57f28818fec4b61427bab53776ad7;Pe/.../cryea.dll?bD&c=1910171434&De&redirs=1

http://dla.uloz.to/Ps;Hs;fid=31354946;cid=1910171434;rid=1097800993;up=0;uip=118.208.237.165;tm=1404025796;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=28b57f28818fec4b61427bab53776ad7;Pe/.../cryea.dll?bD&c=1910171434&De

http://freecache5-free.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=1480590480;up=0;uip=118.208.237.165;tm=1404025560;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=ff345b910a0613f9e6a3c98b6d304f56;Pe/.../cryea.dll?bD&c=1910171434&De&redirs=1

http://dla.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=1480590480;up=0;uip=118.208.237.165;tm=1404025560;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=ff345b910a0613f9e6a3c98b6d304f56;Pe/.../cryea.dll?bD&c=1910171434&De

http://freecache5-free.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=1740971550;up=0;uip=118.208.237.165;tm=1404025264;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=b7dc9e120925ff2ffa2e7fbd0440a122;Pe/.../cryea.dll?bD&c=1910171434&De&redirs=1

http://dla.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=1740971550;up=0;uip=118.208.237.165;tm=1404025264;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=b7dc9e120925ff2ffa2e7fbd0440a122;Pe/.../cryea.dll?bD&c=1910171434&De

http://www.dll-found.com/download/.../CryEA.dll

Remove cryea.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.