home

e798.exe

The executable e798.exe has been detected as malware by 1 anti-virus scanner. This is a setup program which is used to install the application. The file has been seen being downloaded from b.datacardbar.info.
MD5:
8391b9e3c4f8bc3687bb342d3a5c7528

SHA-1:
2d7aa8a21cdaab20cd2d2a8a1d7131cc4da8bc47

SHA-256:
2dc9c065edfa669dfeab081f9f6dd50d88fbbc0dae5256dc814c761eda34ead2

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/23/2024 6:06:25 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.6.16.6

File size:
450.5 KB (461,312 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\e798.exe

File PE Metadata
Compilation timestamp:
4/16/2013 9:53:24 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:5sSXdFp9Nv/c7HDn9DzUwHIw9Xu+dtj6E7RrihU/A0feYe735O6rMjZMyET0JniV:ewdFBHs9D/P9z6By5fg7rMsDF

Entry address:
0x40B0B

Entry point:
E8, E6, 12, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 20, B2, 44, 00, E8, EF, 17, 00, 00, E8, B3, 14, 00, 00, 0F, B7, F0, 6A, 02, E8, 79, 12, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 28, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
279 KB (285,696 bytes)

The file e798.exe has been seen being distributed by the following URL.

http://b.datacardbar.info/hp/?q=zQ6N1 6YvjUCPCDWYSJS16 alkdV/ZWIseBA5ctaWkcE1Yzw9reGqv7TLZKh1di3yQ FSQFMiwG9D5E0Vb76HzPP3A4fvgqvZ4d qt1VKSVabONNzJXh/vPFo8Gm8dB0YhPXtiz0M2CSICNwgIhTAPhPT4eRMPhWf5LIrlC/JDYTgdjKoQi1LZwEMmt a6WEy8Evk3pdTlmvC3IXHe1DnJ3ipJrWx34txuY7R8M7pSkyNZI29J0nTU9SnEiAOBQQS1Q8qYwNZicdy8MljgXfQzDtlZfDBt7EJj3sMc8a nXlnOgKbNUcWcacgIbAwedAzd7l7f80IUJwACr/sOgFrH AsnOPsYmVgdJkXt62X8laG72CTbfDb3LsPWfbXGYTkHJx 6T1ESxHySuNA65QMBL9EVXdTlGsludyNhv/7AYgmUA4VhTTdncfaEutlxNSQPRRBle1hLEo6opkafpHESx p5QN2OiInh yHChq2vrKm QZ0gO8LxrA4a3GT67eDyLOJFs1hjFHk1WakzjhdwTnHFcL3z260gd8Y4FPDMpj8hn8ZuMEH9K2JJrh6BDoI5ANeVmCCgrrWYmpoIz63djX61WNeFdKJwH0YudXEYb29r4moLfttzfDfl/Xq7oQ adhB2u3nKaCX/wcMwB7BUe9rtHRVvpmF7MrKTG4CivnuSlPP5EJ0K 1znOI944K 0lqf8LGIUU22/YTk FLhQ5RESxHqknfo6EVX4hrVfhN9viG8cS/cgKqkh/M8u36Za83jYmCOBKq1 44zrjedyKHn8UkVbs4JqzHisPahOa/5UgxHr10HaaBde1KrdT4dz24l1hf169mve44AXA8/4xOebn1xKD53m2Ez H1HCx2a/IB3YKtCC3lycxUSlhJGDobg/.../HRIohlDXQ8uKV8Yzaz8EjWO8TbmaaB MuzP8 D7sllnyYYwXvygU232LIc

Remove e798.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.