» huelightfinder.exe
Overview
Analysis
File Details
Downloads (12)

huelightfinder.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from doc-08-44-docs.googleusercontent.com and multiple other hosts.

File name:

huelightfinder.exe

MD5:

8ea15c138e0d8ccb82f99d2ca742fdf3

SHA-1:

49c955a2e43ec38a20701049a0180adac2891264

SHA-256:

17ba0b68e78baea319bd4fff295d96e3b535af009ee237df24221bf764b30a48

Scanner detections:

2 / 68

Status:

Inconclusive (not enough data for an accurate detection)

Analysis date:

11/24/2024 5:24:59 AM UTC (today)

Scan engine

Detection

Engine version

McAfee

RDN/Generic.dx!dgx

5600.6814

VIPRE Antivirus

Trojan.Win32.Generic

38798

File size:

701.7 KB (718,514 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\huelightfinder.exe

File PE Metadata

Compilation timestamp:

4/30/2014 4:02:15 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.21

CTPH (ssdeep):

12288:p2Geuk038tn40n3alBYMVDj4DzvLiRK3a2giJ8S/cN0H37ymmlP:pDU04Tne2wDjITL6WngU/TnmlP

Entry address:

0x1290

Entry point:

55, 89, E5, 83, EC, 08, C7, 04, 24, 02, 00, 00, 00, FF, 15, 8C, 12, 41, 00, E8, A8, FE, FF, FF, 90, 8D, B4, 26, 00, 00, 00, 00, 55, 8B, 0D, C4, 12, 41, 00, 89, E5, 5D, FF, E1, 8D, 74, 26, 00, 55, 8B, 0D, B0, 12, 41, 00, 89, E5, 5D, FF, E1, 90, 90, 90, 90, 55, BA, 80, 00, 00, 00, 89, E5, 57, 31, C0, 8D, BD, E8, FE, FF, FF, 56, 53, 81, EC, 1C, 01, 00, 00, 89, 54, 24, 08, 89, 44, 24, 04, 89, 3C, 24, E8, BF, 41, 00, 00, 89, 7C, 24, 04, C7, 04, 24, 18, 00, 00, 00, E8, 47, 0C, 00, 00, 85, C0, 0F, 84, 7C, 00, 00... 
[+]

Entropy:

7.9835

Packer / compiler:

MingWin32

Code size:

18 KB (18,432 bytes)

The file huelightfinder.exe has been seen being distributed by the following 12 URLs.

https://doc-08-44-docs.googleusercontent.com/docs/securesc/7ht1c24be8kvpp2ks6pqd0ut7d6t7jtd/ka6s1s95uvikgl35ahidre15n3vdv29s/1423584000000/14999514997075301405/.../0B-Imz0AwCF5-QXZzUlRuc3l6VEk?e=download&nonce=30emqtsg0tf0k&user=02413090302808765510&hash=t7nsi0osrodqkrkiu3nvdiv68i56tsdv

https://docs.google.com/nonceSigner?nonce=30emqtsg0tf0k&continue=https://doc-08-44-docs.googleusercontent.com/docs/securesc/7ht1c24be8kvpp2ks6pqd0ut7d6t7jtd/ka6s1s95uvikgl35ahidre15n3vdv29s/1423584000000/14999514997075301405/.../0B-Imz0AwCF5-QXZzUlRuc3l6VEk?e=download&hash=d8s8061sdv1pmptbplge29tp694ckqbe

https://doc-04-2g-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/q3nfs9vtvoncij5vhv5ik92v0i9qh2qd/1420768800000/14999514997075301405/.../0B-Imz0AwCF5-QXZzUlRuc3l6VEk?e=download

https://docs.google.com/uc?id=0B-Imz0AwCF5-QXZzUlRuc3l6VEk&export=download

https://docs.google.com/uc?authuser=0&id=0B-Imz0AwCF5-QXZzUlRuc3l6VEk&export=download

https://doc-0c-68-docs.googleusercontent.com/docs/securesc/rovl7b82i2iosp2tvq4peb2duarjiks4/20huk6krf906tbjignnaq9123o1guk4u/1422720000000/14999514997075301405/.../0B-Imz0AwCF5-QXZzUlRuc3l6VEk?e=download&h=15670171863925033789&nonce=d3qlqkpd39sa4&user=11176537504168871136&hash=mq5uhbbs9d3btj4per4b6vjapm5fp7qq

https://docs.google.com/a/brown.edu/nonceSigner?nonce=d3qlqkpd39sa4&continue=https://doc-0c-68-docs.googleusercontent.com/docs/securesc/rovl7b82i2iosp2tvq4peb2duarjiks4/20huk6krf906tbjignnaq9123o1guk4u/1422720000000/14999514997075301405/.../0B-Imz0AwCF5-QXZzUlRuc3l6VEk?e=download&h=15670171863925033789&hash=6fdomqihu09o8at9j7qlem6a1iel0hnn

https://docs.google.com/a/.../uc?id=0B-Imz0AwCF5-QXZzUlRuc3l6VEk&export=download

https://docs.google.com/a/.../uc?authuser=0&id=0B-Imz0AwCF5-QXZzUlRuc3l6VEk&export=download

http://www.everyhue.com/wp-content/uploads/2014/.../hueLightFinder.exe

Scan huelightfinder.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.