home

installation.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from get.downward1227.info.
MD5:
7fe8311e585eacc1563a72f682971378

SHA-1:
d53081d9744678fafb6e0172d853b0bffa5060f5

SHA-256:
e25f4278609f9eaac6ed9eeef6169d69dc00f951b341579e7392999ed8b577c8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
1/13/2025 12:50:30 AM UTC  (today)

File size:
1.1 MB (1,126,155 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\installation.exe

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
24576:RNbzFgu33yeBRuJ7z/4b20vmjX2XrhVM66wzwBU9iEXazAxuP:TdriJ4b3eL2tVMR7C9bJ8P

Entry point:
A9, AC, BD, A7, 68, FF, FF, FF, F8, FF, FE, C7, FF, BC, FF, C5, FF, A3, FF, AA, FF, 8C, FF, 9A, FF, 8D, FF, 8C, FF, A3, FF, 94, FF, 92, FF, 8A, FF, 8D, FF, 8F, FF, 97, FF, 86, FF, CD, FF, A3, FF, BB, FF, 90, FF, 88, FF, 91, FF, 93, FF, 90, FF, 9E, FF, 9B, FF, 8C, FF, FF, FF, FD, DD, FF, B6, FF, 91, FF, 8C, FF, 8B, FF, 9E, FF, 93, FF, 93, FF, 9E, FF, 8B, FF, 96, FF, 90, FF, 91, FF, D1, FF, 9A, FF, 87, FF, 9A, FF, FF, FF, FC, E7, FF, A8, 96, 91, B1, AB, DF, B4, 9A, 8D, 91, 9A, 93, B2, 90, 9B, 9A, DF, BB, 8D...
 
[+]

Entropy:
7.9998  (probably packed)

The file installation.exe has been seen being distributed by the following URL.

http://get.downward1227.info/.../1424816195/1424816195?38121525014ZF1zMjI6bjgxMiw0KyViPC0yMTAwImk1MDQ4LyRpPS8iYSk8TFRIQEBSJV9pYWJpaF87Z2UwLF5rWGdVMyRkY25qOi0leGhrOy0mYmg6X2RyMTA

Scan installation.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.