home

install.exe

www.portix.org

This is a self-extracting archive and installer. The file has been seen being downloaded from storage-ec2-36.sharefile.com.
Publisher:
www.portix.org  (signed and verified)

Version:
23.0.0.0

MD5:
b92e76ca6705df9974a8b60c7d4e5f0a

SHA-1:
ef6e5d63d7a06e3a9a094d6acc74feb05a79aa9e

SHA-256:
646417f96c33e29e89e1a7b0a0837b71d713abd21ec32c468f6c9f69a553be23

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/27/2024 6:28:24 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
MSIL/TrojanDownloader.Banload.GC trojan
7.0.302.0

File size:
124.4 KB (127,368 bytes)

Product version:
23.0.0.0

Copyright:
Copyright © 2016

Original file name:
FMOQVoooooPPPPPqqqqqP.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\install.exe

Digital Signature
Signed by:
www.portix.org

Authority:
www.portix.org

Valid from:
10/14/2015 8:47:19 AM

Valid to:
10/14/2016 8:47:19 AM

Subject:
CN=www.portix.org, L=EUA, S=EUA, C=US

Issuer:
CN=www.portix.org, L=EUA, S=EUA, C=US

Serial number:
00F99E4B4DEE4E42BF

File PE Metadata
Compilation timestamp:
2/18/2016 9:13:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
80.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:3MHxKMRzbA1RAXbarYX2NCanqDGXT+jXe:3MHIMRzbAvAXbarYX2NCanqy+ju

Entry address:
0x79E2

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 03, 00, 00, 00, 30, 00, 00, 80, 0E, 00, 00, 00, E0, 00, 00, 80, 10, 00, 00, 00, 10, 01, 00, 80, 18, 00, 00, 00, 40, 01, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 05, 00, 01, 00, 00, 00, 68, 00, 00, 80, 02, 00, 00, 00, 80, 00, 00, 80, 03, 00, 00, 00, 98, 00, 00, 80, 04, 00, 00, 00, B0, 00, 00, 80, 05, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
22.5 KB (23,040 bytes)

The file install.exe has been seen being distributed by the following URL.

https://storage-ec2-36.sharefile.com/download.ashx?dt=dt3fd561f35e1641ea934cdd71fd752fed&h=V5FQ0dPg3GhpWdVscQvrQMthqFA3pcz6OqCg84CarXI=

Scan install.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.