» instalarifa.exe
Overview
Analysis
File Details
Downloads (7)

instalarifa.exe

The Xceed Zip Compression Library

Xceed Software Inc. 1-450-442-2626 info@xceedsoft.com www.xceedsoft.com

This is a setup program which is used to install the application. The file has been seen being downloaded from www.towerbitscenter.com and multiple other hosts.

File name:

instalarifa.exe

Publisher:

Xceed Software Inc. 1-450-442-2626 info@xceedsoft.com www.xceedsoft.com

Product:

The Xceed Zip Compression Library

Description:

32-bit Self-extractor module

Version:

1, 3, 1, 4

MD5:

79d0eea0f0fefa40cad6a984906e4f37

SHA-1:

f1e61aba4ca726d3f1724423b489fd7537a4da1d

SHA-256:

e2cb2efd559029378d54e05b629f0d7b860a8d91a8d9c85082732b56a1437d5c

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

11/24/2024 6:23:30 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Trojan.Banker.BE

7.1.1

File size:

894.9 KB (916,393 bytes)

Product version:

1, 3, 1, 4

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\instalarifa.exe

File PE Metadata

Compilation timestamp:

1/5/2001 8:24:19 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

3.0

CTPH (ssdeep):

24576:NUQ2B7RXCM8TKR75gAJT0iQHqt3wNf7CuQqOQNCSSWu5dJW:OQU0M8TKR7JJT0i8qt3EDDIQNCDWwJW

Entry address:

0x10000

Entry point:

64, A1, 00, 00, 00, 00, 55, 8B, EC, 6A, FF, 68, 60, 40, 41, 00, 68, 34, 1D, 41, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 60, 53, 56, 57, 89, 65, E8, FF, 15, 78, 24, 43, 00, A3, 3C, 5F, 41, 00, 33, C0, A0, 3D, 5F, 41, 00, A3, 48, 5F, 41, 00, A1, 3C, 5F, 41, 00, C1, 2D, 3C, 5F, 41, 00, 10, 25, FF, 00, 00, 00, A3, 44, 5F, 41, 00, C1, E0, 08, 03, 05, 48, 5F, 41, 00, A3, 40, 5F, 41, 00, E8, CA, 01, 00, 00, C7, 45, FC, 00, 00, 00, 00, E8, 1E, 12, 00, 00, E8, 49, 09, 00, 00, FF, 15, 1C, 25, 43, 00, A3, 64, 0A... 
[+]

Developed / compiled with:

Microsoft Visual C++ v4.2

Code size:

73.5 KB (75,264 bytes)

The file instalarifa.exe has been seen being distributed by the following 7 URLs.

http://www.towerbitscenter.com/hi8CLeCUWHYkyEOmbtvlfnDrRtPBr6XOU 9syhZHclRm_sc1puyd NTw6TQtwuLpv2gyimrOJSvSW19OiNRXLNI1ya VT8sxrIyXGdYgKkR_Sz l G r1enmCwWTXHnbTfSLiP4jo v68lLV3N5TpTT7d1MVQzXAlttOjq5XdkoacVyfEzeA_pnK7XhsfOvO_HSmCr6mV 5PovK_e3gSIV0sUadaUyXdab9SYidhGgM6U36j22c=-Gy4AAATUOek2qTveQ9SgN4eJHLC3RZjIXd8ceKa0MfC_Do8NY7JRQzXpgcYqXJW_AQ==

http://www.ranchsendgift.com/KHZhNxHQbuQBr0dZLATUWHpZYkn1dP7ev4_Of56ROqZH3ZbJWnTLM8rL6eUnGGKWkAild__c2SqRDRgYpJGxQ4Hhf1BrNtyZVici BRhiRR4XZ0 TkHQxxn__pk91i1Pap8crpD2BdohmpBTDXfNTBKWU0eSLAoN5YxVwHqaw6ivBgRBvbxXX0lER33r7cj9rSq1enBaEjNYe0OWB2LvmIGlb0 4Kw==-Gy4AAATUOek2qTveQ9SgN4eJHLC3RZjIXd8ceKa0MfC_Do8NY7JRQzXpgcYqXJW_AQ==

http://www.ranchsendgift.com/5IxecVA7ZKpzG7pt6BduPpryvWyKt2fm1plV8GXMa1mLFaWWcFjZJaJsalm5bZKiMvSHxy4GcclpYxA36zwnVmKR2TA4wXiBAvLLzXe4DwHDOdFAA4re6mKWwk XTxRYj_ rG_lTpBxeJv j9Wc5KXKL3iNiFmSuuN6DTqPij8CsC_F1w93XZMThR udSfq_jj7CAIhed7Fdp_HfST 6iid4sTFgXA==-Gy4AAATUOek2qTveQ9SgN4eJHLC3RZjIXd8ceKa0MfC_Do8NY7JRQzXpgcYqXJW_AQ==

http://www.ranchsendgift.com/A7YErw3jiLJE17XaKGl5SOevmJjTBanof6LJ_Or 298LwELG897diMm6PSikT2k4UiKyQBKqZ aZ8EO0ibi94Ju1Otmou8EL67q4z07GYkgjCB83WbjvyrfgDqVDm4R_aLqg_idXmZ5_sXli04O7JMReaMPBYracLAW_NGx5oChgB6NMqT3Rm2UXMI3Yl eLp2j0B78NseJXIKs16wKTGS7W1ziIVIohOCYnZ8xQdTVIhlzQ9FnxjdDVYVhlr1aGBUO8pTj0Uk07yE9oSzJ rRqaTygcFEImcl2MrjqHuvnLUXImF3EKKyCo8hMc9S7SpFhnvy owAGsivRcYdTS97fUPNTS646oqb0BKuTjcVqL86RAL6T2FJB2KNB2mRgBgCRYvfvlwe loU72tey 3w_ WwPcbSbUgY2DfYauFqNfzgfzd3b0ccMuoO8xgFFINV1Gybl5igFy9vr_e3hiBSoPX32DOFPW7xC3omRslI4tsuyYT7WZwNKVL1bo5VkEvuT5631T4frV2CE55_lv4lODGILFEw==-Gy4AAATUOek2qTveQ9SgN4eJHLC3RZjIXd8ceKa0MfC_Do8NY7JRQzXpgcYqXJW_AQ==-e

http://www.ranchsendgift.com/VgwVUZK 2WrI9xnZfx7 8HJd_xJQK21lweUHgCwLG6qhqOgK7C5CGjJMw9cI7l3OyLkMqB jY66YprghyJsN1PK3f7xz0_YWVl 09IOVZP7DgfAd ZrVuOgjA7u8DI0RtbHPlmchFbbSFefuu7ibTTgFsuuHz6K3XKHFKFkEPYeZaeIZmGWwVXv5fQLU51yzAj2IBN2p0mwXOCfiTTnTTDuSQV04AA==-Gy4AAATUOek2qTveQ9SgN4eJHLC3RZjIXd8ceKa0MfC_Do8NY7JRQzXpgcYqXJW_AQ==

http://www.aondedownloads.com/mirror26459.htm

http://www.adisioribeiro.com.br/instalarifa.exe

Scan instalarifa.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.