home

download windows xp sp3 32 or 64 bit activator and wat remover.exe

The executable download windows xp sp3 32 or 64 bit activator and wat remover.exe has been detected as malware by 1 anti-virus scanner. The file has been seen being downloaded from b.datacardbar.info.
MD5:
b3bb387ad205cf6972d7434cb0efe41e

SHA-1:
a34f3b1d6261bdf11042732b16da3094495d6cee

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/23/2024 5:42:51 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.2.17.13

File size:
450 KB (460,800 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\download windows xp sp3 32 or 64 bit activator and wat remover.exe

File PE Metadata
Compilation timestamp:
4/9/2012 10:09:57 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:qQQaRMSsxlxGNsphOzeAdTKn9fpjZl1rEVzvDRaRetAW0O6YgAxQV9S74KSTuIFV:h7MT/LweA9mrNbIVvLD3N8U

Entry address:
0x408DB

Entry point:
E8, E6, 12, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, E0, B2, 44, 00, E8, EF, 17, 00, 00, E8, B3, 14, 00, 00, 0F, B7, F0, 6A, 02, E8, 79, 12, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 28, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.3819

Code size:
278.5 KB (285,184 bytes)

The file download windows xp sp3 32 or 64 bit activator and wat remover.exe has been seen being distributed by the following URL.

http://b.datacardbar.info/hp/?q=J3aDY0QwBWCxfxztvq0R ZzXOsh98R401en37qwPaCsNvkngcEOcS0FeRSLS6ehnTB9zszUQpBWFpFYx8o5tLCQ/1evh/wuj0UMltAVjZhjqa3Hnb58d/1rMS0LEWg1KCVCFY8k5YIYQYq0GSJ6G8OjJare/Q35VupFk31dNXIwL6T4G1xix2IGy77XCLp2VX6AkE6ePrX g3xeOCej5lXqjFrBTgbfV JXs2cCiXAx7xSIN4ZlYvhTDNBM/EkBPkd1FOJzhH9BV5CC3LY8wee bNhvDXWXTk9SsM nTTFCJ4rIbQ/zYFKzDX7PruFYnOZyNASIZdICxSV7dgiQBHVte2UeTHRDYvk6 QLrl4Jxp7TeVBJLOz0Q5N4VGiWbbRCajkd7xfpqoXkvOZjDnD 1eVLmVmb/e7R9zD5eK26PALI1RBopEcg3nnE5aTCagDgRmW6yG mdg7p6uNbfIWR8WjmRCAEqFu/G5z3/6jvYdtSPLWlRmm9cjZfDJuo/lggiug5EZHDnV2HL7Td7kcYnrrn Od qj6rPFSbcb5s9jzpYlXpkcCEgzqAggEL7OcqB2rshQ3ym0ntxZpM8y3lA4li8VCtKwa R xHNVqHez8EDUD01S M Ka4QQqo30/zPS ZYkdcoRdo5UsUUuE8n 2ZGnY3ObwQjy3hY905Lm aSR8bxOoPzPZaVe8vMcYNQcN5W3K2 EpHEluLq KtSgbxMlg5/.../w1O7CugVqH5FszqXXgk4&external_id=1427823190681997336&uuid=7iS39uiTr6nquATszTHEe0nDUABN5Lfmr0qO1IFXKVaqpd2fsUHfvfUXSVRGLlBrhqeE7OlejjB55h9wbDoAzpezpEuafcDBnzwcAtKhKprK0VlexgigcJNrQpYxkyTiFVkyruvHSvyq0UJZaE

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.