home

f1fa-15.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from am4-r1f7-stor06.uploaded.net and multiple other hosts.
MD5:
0d1ad3696dd85dc3624cab944d9892d8

SHA-1:
f3fa0a47e6637f3adfc455916779f86fab61aeeb

SHA-256:
778a48043bd3addf8281ecd1e3e63ea87b24941d37807fefa8229b9883c34139

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/29/2024 12:47:23 AM UTC  (today)

Scan engine
Detection
Engine version

Qihoo 360 Security
HEUR/QVM06.2.Malware.Gen
1.0.0.1015

File size:
3.9 MB (4,141,738 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\f1fa-15.exe

File PE Metadata
Compilation timestamp:
12/1/2013 10:08:28 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:BfmG5s4e2cR2kJ6dWKdp1Lyba6hgG61K7CZ+gb:hmG62kJyWE1LWC0C3

Entry address:
0x108AF

Entry point:
E8, 9C, 58, 00, 00, E9, 78, FE, FF, FF, 55, 8B, EC, 83, EC, 04, 89, 7D, FC, 8B, 7D, 08, 8B, 4D, 0C, C1, E9, 07, 66, 0F, EF, C0, EB, 08, 8D, A4, 24, 00, 00, 00, 00, 90, 66, 0F, 7F, 07, 66, 0F, 7F, 47, 10, 66, 0F, 7F, 47, 20, 66, 0F, 7F, 47, 30, 66, 0F, 7F, 47, 40, 66, 0F, 7F, 47, 50, 66, 0F, 7F, 47, 60, 66, 0F, 7F, 47, 70, 8D, BF, 80, 00, 00, 00, 49, 75, D0, 8B, 7D, FC, 8B, E5, 5D, C3, 55, 8B, EC, 83, EC, 10, 89, 7D, FC, 8B, 45, 08, 99, 8B, F8, 33, FA, 2B, FA, 83, E7, 0F, 33, FA, 2B, FA, 85, FF, 75, 3C, 8B...
 
[+]

Entropy:
7.9634  (probably packed)

Code size:
98 KB (100,352 bytes)

The file f1fa-15.exe has been seen being distributed by the following 33 URLs.

http://am4-r1f7-stor06.uploaded.net/.../9f97c0ce-b97a-4fc7-abc3-ed179698ccc2

http://am4-r1f7-stor06.uploaded.net/.../acf7cd85-373a-4e19-97ac-a0c757ef3749

http://am4-r1f7-stor06.uploaded.net/.../a3874184-9e87-4f95-8982-987c54e2f20c

https://oqbkif.oloadcdn.net/dl/l/CSZ5f6sNqIs/.../F1FA-15.exe

http://am4-r1f7-stor06.uploaded.net/.../f2d9fbf3-ea80-45e3-9bf8-6858a00087d6

http://am4-r1f7-stor06.uploaded.net/.../0c948ccd-bcbc-4cf5-91a1-8a02aeba0fe8

http://am4-r1f7-stor06.uploaded.net/.../ecac0c08-ed24-4569-ba67-21eb5764f77c

http://am4-r1f7-stor06.uploaded.net/.../4b6ecb5e-adea-4150-97e4-4b06200b247c

http://am4-r1f7-stor06.uploaded.net/.../a6ea28b4-9d4d-4370-87e4-25b58400ab0a

http://am4-r1f7-stor06.uploaded.net/.../00fde606-0b92-4e3f-bd1c-e867305deddc

http://am4-r1f7-stor06.uploaded.net/.../bf673641-2917-456b-8e3b-d6a73e032134

http://am4-r1f7-stor06.uploaded.net/.../87dfdbbd-4744-443d-a9de-d051bae64963

http://am4-r1f7-stor06.uploaded.net/.../1661b4e7-e373-4766-bcdf-3ea247e62fb2

http://am4-r1f7-stor06.uploaded.net/.../a78179c7-9d03-4d89-9670-e388f505f32d

http://am4-r1f7-stor06.uploaded.net/.../75a2e89c-6a8c-47a6-b045-6b4449859a05

http://am4-r1f7-stor06.uploaded.net/.../0237a976-674e-4cb1-b56e-e4e55f276c4e

http://am4-r1f7-stor06.uploaded.net/.../3ace5052-676b-4169-9c80-995fc5995de2

http://f2h.nana10.co.il/.../h9li8o0p1am|bcb048e4c8b4da60492e881aed840ea0|.exe

http://am4-r1f7-stor06.uploaded.net/.../14e8d610-4103-4379-b0a3-63c56d129b2a

http://am4-r1f7-stor06.uploaded.net/.../4403e88a-b45e-4605-80c6-8161b8f9ab29

http://am4-r1f7-stor06.uploaded.net/.../8697caac-cefb-4b08-bd6e-48f0fe9060b5

http://am4-r1f7-stor06.uploaded.net/.../2c655406-c597-4f4f-8555-b0db89bd532b

http://am4-r1f7-stor06.uploaded.net/.../d9e03593-7114-4326-a757-650df24ccd15

http://am4-r1f7-stor06.uploaded.net/.../d0b2ec73-844d-4139-b24e-6d2d5bc3a2e7

http://am4-r1f7-stor06.uploaded.net/.../e30cd692-8356-4c7f-ae0a-abe45d259bc6

https://oqbkif.oloadcdn.net/dl/l/-K0WnUMgREI/.../F1FA-15.exe

http://am4-r1f7-stor06.uploaded.net/.../59d0a794-296f-4399-9112-e676e89cd1a6

http://am4-r1f7-stor06.uploaded.net/.../62f61b7e-901b-4fca-8057-a565895fe66c

http://am4-r1f7-stor06.uploaded.net/.../2a7dffa7-4372-444f-a0b4-a4fd931eea30

http://am4-r1f7-stor06.uploaded.net/.../d7d94c8c-5c8f-4506-9058-141021ef9d70

Latest 30 of 33 download URLs

Scan f1fa-15.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.