home

flyhack by ipower.exe

The executable flyhack by ipower.exe has been detected as malware by 4 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from fs02n1.sendspace.com and multiple other hosts.
MD5:
4f13d11a5b4ac1b75d532dc5c1c0ce2c

SHA-1:
2509defcd7c49f7179eb310150df410b7a1fb3dc

SHA-256:
92167dcd0066f41efd77baef9063e044e3e91c350f0e53cb7e39d9e8193fab35

Scanner detections:
4 / 68

Status:
Malware

Analysis date:
11/25/2024 8:23:40 PM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Trojan.Win32.CheatEngine.AMN
8.16.02.15.03

ESET NOD32
Win32/HackTool.CheatEngine.AF (variant)
10.8048

Trend Micro House Call
TROJ_GEN.F47V1211
7.2.46

Vba32 AntiVirus
Trojan-Dropper.Dapato.btzx
3.12.20.2

File size:
3.2 MB (3,373,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\flyhack by ipower.exe

File PE Metadata
Compilation timestamp:
2/26/2011 4:09:20 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:h91hurRidi6RKZ3EPUdP8RZp9yu5x47CDNLQeFx0/1XpcUQoWY5vmceLZOd3b+3J:hpcRiY6RKJf8RZVjDhFC/hSUCYlQd

Entry address:
0x157A

Entry point:
E8, FD, 16, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 58, AD, 40, 00, 89, 0D, 54, AD, 40, 00, 89, 15, 50, AD, 40, 00, 89, 1D, 4C, AD, 40, 00, 89, 35, 48, AD, 40, 00, 89, 3D, 44, AD, 40, 00, 66, 8C, 15, 70, AD, 40, 00, 66, 8C, 0D, 64, AD, 40, 00, 66, 8C, 1D, 40, AD, 40, 00, 66, 8C, 05, 3C, AD, 40, 00, 66, 8C, 25, 38, AD, 40, 00, 66, 8C, 2D, 34, AD, 40, 00, 9C, 8F, 05, 68, AD, 40, 00, 8B, 45, 00, A3, 5C, AD, 40, 00, 8B, 45, 04, A3, 60, AD, 40, 00, 8D, 45, 08, A3, 6C, AD, 40...
 
[+]

Entropy:
7.9725  (probably packed)

Code size:
25.5 KB (26,112 bytes)

The file flyhack by ipower.exe has been seen being distributed by the following 3 URLs.

https://fs02n1.sendspace.com/dl/c4a8a8e9bbff580043e99093026aa7f3/5768878117a478b7/.../FlyHack by iPower.EXE

https://fs02n1.sendspace.com/dl/db0105878b0a0541fdf8263973e1b951/576f759e2a79e3a9/.../FlyHack by iPower.EXE

https://fs02n5.sendspace.com/dl/4b270bb425601744152bbf9b24554cb7/55b2df1e2b372369/.../FlyHack by iPower.EXE

Remove flyhack by ipower.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.