fas language selector - mirrors edge.exe

The application fas language selector - mirrors edge.exe has been detected as a potentially unwanted program by 32 anti-malware scanners. The file has been seen being downloaded from s10135.chomikuj.pl.
MD5:
163dce271332b538cdec4ac791937cd8

SHA-1:
f4bfac1e8229368333b2543a7afab193986248b1

SHA-256:
15daa78a1f2e6fe2730af30eeb5ef85a8e1a75ead10c5718657752a738ec7d80

Scanner detections:
32 / 68

Status:
Potentially unwanted

Analysis date:
1/13/2025 1:00:14 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.7695657
814

Agnitum Outpost
Adware.AdSpy
7.1.1

AhnLab V3 Security
Trojan/Win32.Xema
2014.10.21

Avira AntiVirus
TR/Virtl.23997
7.11.179.192

AVG
PSW.Ldpinch
2015.0.3292

Baidu Antivirus
Hacktool.Win32.Obfuscator
4.0.3.141113

Bitdefender
Trojan.Generic.7695657
1.0.20.1585

Bkav FE
W32.Clod227.Trojan
1.3.0.4959

Comodo Security
TrojWare.Win32.Trojan.Inject.~II
19854

Emsisoft Anti-Malware
Trojan.Generic.7695657
8.14.11.13.08

Fortinet FortiGate
PossibleThreat
11/13/2014

F-Prot
W32/Heuristic-210
v6.4.7.1.166

F-Secure
Trojan.Generic.7695657
11.2014-13-11_5

G Data
Trojan.Generic.7695657
14.11.24

IKARUS anti.virus
Trojan.Win32.Tilcun
t3scan.1.7.8.0

K7 AntiVirus
Trojan
13.184.13741

McAfee
Artemis!163DCE271332
5600.6948

Microsoft Security Essentials
VirTool:Win32/Obfuscator.C
1.11005

MicroWorld eScan
Trojan.Generic.7695657
15.0.0.951

NANO AntiVirus
Riskware.Win32.23997.hpswz
0.28.2.62841

Norman
Packed_Upack.H
11.20141113

nProtect
Trojan/W32.HackTool.13801
14.10.19.01

Qihoo 360 Security
HEUR/Malware.QVM14.Gen
1.0.0.1015

Quick Heal
(Suspicious) - DNAScan
11.14.14.00

Rising Antivirus
PE:Trojan.Win32.Generic.128E4555!311313749
23.00.65.141111

Sophos
Mal/EncPk-BW
4.98

Trend Micro House Call
Cryp_Xed-12
7.2.317

Trend Micro
Cryp_Xed-12
10.465.13

Vba32 AntiVirus
TrojanPSW.LdPinch
3.12.26.3

VIPRE Antivirus
Packed.Win32.Upack
34100

ViRobot
Packed.Win32.UPack
2011.4.7.4223

Zillya! Antivirus
Trojan.LdPinch.Win32.13737
2.0.0.1960

File size:
13.5 KB (13,801 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\ea games\mirror's edge\binaries\fas language selector - mirrors edge.exe

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
0.57

CTPH (ssdeep):
384:XlDpygPG4ISpkD21P9Hzsst+CttM2x3WfHdBG58XceXGncvUoq:VDpZI871Bllt3x3Ww86ncM

Entry address:
0xF10D

Entry point:
60, E8, 09, 00, 00, 00, 8B, EF, 00, 00, E9, 06, 02, 00, 00, 33, C9, 5E, 87, 0E, E3, F4, 2B, F1, 8B, DE, AD, 2B, D8, AD, 03, C3, 50, 97, AD, 91, F3, A5, 5E, AD, 56, 91, 01, 1E, AD, E2, FB, AD, 8D, 6E, 10, 01, 5D, 00, 8D, 7D, 1C, B5, 07, F3, AB, 5E, AD, 53, 50, 51, 97, 58, 8D, 54, 85, 5C, FF, 16, 72, 57, 2C, 03, 73, 02, B0, 00, 3C, 07, 72, 02, 2C, 03, 50, 0F, B6, 5F, FF, C1, E3, 00, B3, 00, 8D, 1C, 5B, 8D, 9C, 9D, 0C, 10, 00, 00, B0, 01, E3, 29, 8B, D7, 2B, 55, 0C, 8A, 2A, 33, D2, 84, E9, 0F, 95, C6, 52, FE...
 
[+]

Entropy:
7.4725

Packer / compiler:
WinUpack v0.39 final (relocated image base)

Code size:
22.3 KB (22,835 bytes)

The file fas language selector - mirrors edge.exe has been seen being distributed by the following URL.

Remove fas language selector - mirrors edge.exe - Powered by Reason Core Security