home

fifa_14.exe

OOO DELTA-SOFT

The application fifa_14.exe by OOO DELTA-SOFT has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from doc-0o-4g-docs.googleusercontent.com.
Publisher:
OOO DELTA-SOFT  (signed and verified)

MD5:
cea82cb8eb9f71ba41b3ebbd84a577a2

SHA-1:
f2043ff10662190dd68ff5ad8510600c481a1c50

SHA-256:
c402407c924dcd62351279772c0b467aaea78473f7503682220160f1df00c5bd

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/30/2024 8:34:10 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebAlta.OOODELTA (M)
16.7.13.22

File size:
2.1 MB (2,239,392 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\fifa_14.exe

Digital Signature
Signed by:
OOO DELTA-SOFT

Authority:
COMODO CA Limited

Valid from:
12/14/2015 4:00:00 AM

Valid to:
12/14/2016 3:59:59 AM

Subject:
CN=OOO DELTA-SOFT, O=OOO DELTA-SOFT, STREET=ul. Lesi Ukrainki 8, L=Irkutsk, S=Irkutskaya obl, PostalCode=664074, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AE59A5A233D6B09E49486B18A399DE0D

File PE Metadata
Compilation timestamp:
6/20/1992 2:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:I9DWNINWpSYWMB/QxJn7RABoUVSGWEG7eSxKfF4h1ZBIQ8bNJZghVUV/Ve7Mscf5:2DSSHUGyouS/4fFWZSZghy/VwMH5T3f

Entry address:
0x113E74

Entry point:
55, 8B, EC, 83, C4, F0, B8, EC, 3A, 51, 00, E8, 78, 2E, EF, FF, A1, 58, 72, 51, 00, 8B, 00, E8, 30, 05, F5, FF, 8B, 0D, DC, 6D, 51, 00, A1, 58, 72, 51, 00, 8B, 00, 8B, 15, D4, 70, 4B, 00, E8, 30, 05, F5, FF, 8B, 0D, 88, 74, 51, 00, A1, 58, 72, 51, 00, 8B, 00, 8B, 15, 38, 6F, 4B, 00, E8, 18, 05, F5, FF, 8B, 0D, E4, 6F, 51, 00, A1, 58, 72, 51, 00, 8B, 00, 8B, 15, 2C, 38, 51, 00, E8, 00, 05, F5, FF, A1, 58, 72, 51, 00, 8B, 00, E8, 74, 05, F5, FF, E8, 53, 07, EF, FF, 8D, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.3765

Developed / compiled with:
Microsoft Visual C++

Code size:
1.1 MB (1,126,400 bytes)

The file fifa_14.exe has been seen being distributed by the following URL.

https://doc-0o-4g-docs.googleusercontent.com/docs/securesc/rvqcl3ngqn9tdau631ph4mkto54823ao/o3br5lb281khc3kkpbgiinlhfjmlv1pj/1467439200000/14136384632422035986/.../0B0czrzf2XYmgRElEbTNwM1RnNzg?e=download&nonce=ghebojslaqn8a&user=01488000295252116155&hash=ga7j4sjhpkvbkf2sk7q0g7sh385lku0e

Remove fifa_14.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.