home

dude-install-3.6.exe

The executable dude-install-3.6.exe has been detected as malware by 3 anti-virus scanners. The program is a setup application that uses the Nullsoft Install System installer, however the file is not signed with an authenticode signature from a trusted source. This file is typically installed with the program Overlook Fing by Overlook. The file has been seen being downloaded from mikrotik.c4.hu and multiple other hosts.
MD5:
ab994838f5f6f61d4ebf45f49ff87a94

SHA-1:
930d5ffcae4dfc31d2dd5558bd0e138470f37b5b

SHA-256:
1d8555dac23043dbbe30151f98f00565d522b06cb857a634e4f3371b4edf1fc4

Scanner detections:
3 / 68

Status:
Malware

Explanation:
This is part of the Crossrider Internet browser extension framework which may modify the user's web browser settings including changing the home and search pages.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application.

Analysis date:
11/15/2024 3:07:24 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
HW32.CDB
1.3.0.4613

Reason Heuristics
Threat.Win.Reputation.IMP
16.11.28.22

ViRobot
Worm.Win32.A.VBNA.3702898
2011.4.7.4223

File size:
3.5 MB (3,702,898 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\downloads\dude-install-3.6.exe

File PE Metadata
Compilation timestamp:
7/11/2008 3:11:04 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
49152:/YLBgQ6LW6Srn532/TvzQi2LS+yKPFc5jNm4uxh4IFgpRooIUiVkIaMuReDQgSEa:Q6EJ6zQxrhPmjRunZF/1zt5bA

Entry address:
0x3987

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, 7C, 01, 00, 00, E8, D8, 49, 00, 00, 83, EC, 0C, 68, 01, 80, 00, 00, E8, 3B, 43, 00, 00, 6A, 00, E8, 14, 4A, 00, 00, A3, 78, 4C, 42, 00, 6A, 08, E8, 37, 27, 00, 00, A3, 28, 4D, 42, 00, 8D, 85, 90, FE, FF, FF, 6A, 00, 68, 60, 01, 00, 00, 50, 6A, 00, 68, A4, A2, 40, 00, E8, C9, 48, 00, 00, 83, EC, 0C, 68, A5, A2, 40, 00, 68, 58, 4D, 42, 00, E8, 57, 29, 00, 00, 83, C4, 18, E8, FF, 42, 00, 00, 52, 52, 50, 68, 00, D0, 42, 00, E8, 42, 29, 00, 00, 57, 6A, 00, E8, BA, 41, 00, 00, 83...
 
[+]

Entropy:
7.9965  (probably packed)

Code size:
29.5 KB (30,208 bytes)

The file dude-install-3.6.exe has been discovered within the following program.

Overlook Fing  by Overlook
http:\\www.overlooksoft.com
About 2% of users remove it
 
Powered by Should I Remove It?

The file dude-install-3.6.exe has been seen being distributed by the following 21 URLs.

http://mikrotik.c4.hu/.../dude-install-3.6.exe

http://www.layer7tecnologia.com.br/.../dude-install-3.6.exe

http://www.afterdawn.com/software/.../download.cfm?version_id=25864&software_id=1151&mirror_id=0&installer=0&perion=0&air_installer=0

https://www.dropbox.com/scl/.../dq2o7dni2gnnwikifdu0o?oref=wn&r=AAMl0q6hf9BfoHFQbeEAlWj-O1BseBSevTW8zINNgIszFYGnhk4LoGUUv3Ez1po_84U-pBFUnb98IuOB9t5YNxyh0GdxuuIKtSbeATYOY0cosCldYzVsD7OvQudcbaD_QPq6sWh__9-yl9jpFhM69Rdo2tLhH3PL71cGx9C0lokEeA&sm=1&dl=1&_download_id=050086256973992387185033994975158236613085794216148980304137645168&_notify_domain=www.dropbox.com

https://mail.wds.co.id/service/home/.../?auth=co&loc=en_US&id=71317&part=2

https://docs.google.com/uc?id=0BwuV0gktVRSZSFp2d01DdUVzREk&export=download&authuser=2

http://ultradownloads.com.br/.../2,936693.html

http://the-dude.software.informer.com/.../

https://download.heise.de/software/6eb5eafe442816ea3b449e30111887b6/5718cfbc/.../dude-install-3.6.exe

http://www.lo4d.com/get-file/the-dude/.../

http://10.8.0.3/upload/.../7IDcz6jXhS-dude-install-3.6.exe

http://www.mikrotikacademybd.com/.../dude-install-3.6.exe

ftp://ftp.redenet.org/.../dude-install-3.6.exe

ftp://ftp.redenet.com.br/.../dude-install-3.6.exe

http://es.kioskea.net/download/.../descargar-946-the-dude

http://www.slunecnice.cz/sw/the-dude/stahnout/.../?m=7d156c261ca79cc0f4def220da6a4152&t=54c78406

http://download.heise.de/software/842c84115140429d135a3c1b4a4525d6/542bf868/.../dude-install-3.6.exe

http://dl.cdn.chip.de/downloads/.../dude-install-3.6.exe

http://www.mikrotik.com/download/dude/.../dude-install-3.6.exe

http://www.commentcamarche.net/download/.../telecharger-34056532-the-dude

http://download.mikrotik.com/dude-install-3.6.exe

Remove dude-install-3.6.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.