home

gnqroeqj.scr

The file gnqroeqj.scr has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from fs01n4.sendspace.com and multiple other hosts.
Version:
1.0.0.0

MD5:
a8726a933f44619c4e55c8b403c91415

SHA-1:
9113e247da3d75e140632f438f8a728a20fd3ad7

SHA-256:
a7677ed43bd7c12e4190feb60a1c4ea4d8bedefe13d3e4d3601dfcf8e163d15f

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 12:19:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Downloader.Meta (M)
16.6.26.11

File size:
1.4 MB (1,423,360 bytes)

Product version:
1.0.0.0

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\gnqroeqj.scr.part

File PE Metadata
Compilation timestamp:
6/19/2016 12:30:15 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:rHMMnheiieP8FbY1SshkzlEIDoCFdBobD82S+kFujUrp/mtFOIxgqkctSYRUO2Q:7OkPCYw+kzlFD/FdBobDFvp6p/mtFOIj

Entry address:
0x2EFC40

Entry point:
60, BE, 00, 40, 5A, 00, 8D, BE, 00, D0, E5, FF, C7, 87, 30, 0C, 24, 00, 4A, B9, DE, 55, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...
 
[+]

Entropy:
7.7892

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:
1.3 MB (1,359,872 bytes)

The file gnqroeqj.scr has been seen being distributed by the following 18 URLs.

http://fs01n4.sendspace.com/dl/ad2547293e12e29af85fb9e6b1707a09/576858da2470edba/.../facebook.scr

http://fs01n2.sendspace.com/dl/5b6e3ce024763aa50d8579b93a8a2115/5768897f506d226f/.../facebook.scr

http://fs01n5.sendspace.com/dl/5e29e26f860c0820871077e72856512d/57689cb175ed2463/.../facebook.scr

http://fs01n5.sendspace.com/dl/b4defd430030a099ca3f2d30fa1f96b7/5769502404c328e1/.../facebook.scr

http://fs01n3.sendspace.com/dl/60d9a529558d322902d94750a2aa0193/57695df02c84f3e5/.../facebook.scr

http://fs01n5.sendspace.com/dl/f7e28b417faa9f275ad7201691db01f3/5768938028b46396/.../facebook.scr

http://fs01n5.sendspace.com/dl/5c5730de2301066e7d3536706aaf1430/5767f6e94c4ba1b3/.../facebook.scr

http://fs01n4.sendspace.com/dl/9a50df3931048e29b4e99c38985061b3/5768f3775bbd9f50/.../facebook.scr

http://fs01n5.sendspace.com/dl/357431b4a86c900372a40cad4a32ac34/57693a5001ca879e/.../facebook.scr

http://fs01n5.sendspace.com/dl/aa31cb0d596520cd4606a742354ea52e/576a05855b55ddea/.../facebook.scr

http://fs01n2.sendspace.com/dl/368355a40c3ec6b3f5cda5992ec383b7/576903cc35186d4f/.../facebook.scr

http://fs01n5.sendspace.com/dl/b3e4ded9da38080b4d5bfeb3ba922cef/576a04440226ca71/.../facebook.scr

http://fs01n3.sendspace.com/dl/86467318182b610e475ce4e4c787b868/5768a4d65dd5e323/.../facebook.scr

http://fs01n3.sendspace.com/dl/94e4ab2c56dd7cd424a8e8f513be2240/57692ef37e6f411a/.../facebook.scr

http://fs01n2.sendspace.com/dl/f32cdc4b6ebbc6f1eb52e4e96901ba94/576909ce56887951/.../facebook.scr

http://fs01n1.sendspace.com/dl/032e3bdabfbb5b0b13a320d287f6b6a9/57681e065c4825ec/.../facebook.scr

http://fs01n1.sendspace.com/dl/37a68ed2437dcd237e82a47628e9ba64/5769088c09e9c133/.../facebook.scr

http://fs01n2.sendspace.com/dl/490135e883fd518285dcca57deeaed68/576930a10f5efe47/.../facebook.scr

Remove gnqroeqj.scr - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.