home

installer.exe

The executable installer.exe has been detected as malware by 14 anti-virus scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.capitalsendhost.com.
MD5:
a2b25a2edc4f5470566979dcdfc6567e

SHA-1:
560f81fd9043ee870f73c6e140406110511e0583

SHA-256:
a5d5d846b7e17a970c2520193f9e394afa9fb2e59a2b2932f4bb89f2528fb5c8

Scanner detections:
14 / 68

Status:
Malware

Analysis date:
12/27/2024 2:42:41 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Mabezat [Wrm]
160203-0

AVG
Win32/Mabezat
2015.0.4522

Dr.Web
Trojan.Swizzor.19587
9.0.1.05190

Emsisoft Anti-Malware
Win32.Worm.Mabezat.Gen
10.0.0.5366

ESET NOD32
Win32/Mabezat.A virus
7.0.302.0

F-Prot
W32/Mabezat.A-2
4.6.5.141

F-Secure
Win32.Worm.Mabezat.Gen
5.15.21

Kaspersky
Worm.Win32.Mabezat
15.0.0.562

McAfee
Virus.W32/Mabezat.a
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.5231.0

Norman
Win32.Worm.Mabezat.Gen
11.01.2016 17:30:26

Sophos
Virus 'W32/Mabezat-B'
5.23

VIPRE Antivirus
Threat.303962
46838

File size:
352.9 KB (361,327 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\installer.exe

File PE Metadata
Compilation timestamp:
1/28/2016 10:39:27 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
6144:n32QfhLL+R539B1dQyRQ6gZQgG4psdDIXGg7VW8rKt5:n32QJn+R5NNF2ZCt5

Entry address:
0x26951

Entry point:
BB, 16, 37, 4E, 92, 93, E9, 20, 01, 00, 00, FA, A0, 03, FF, AB, 2F, 03, FF, 83, A3, 86, 83, 83, 03, 83, 83, F3, 83, 83, 83, E2, B4, B9, B4, B3, B4, BC, BA, B9, 83, 83, 83, F7, E4, FD, E8, E5, E4, F0, E4, B1, E7, EF, EF, 83, 83, 83, 83, DF, 83, 83, 83, C9, F5, E8, E8, CF, EC, E5, F5, E4, F5, FC, 83, C6, F5, E8, E4, F7, E8, C7, EC, F5, E8, E6, F7, F2, F5, FC, C4, 83, 83, 83, 83, CA, E8, F7, DA, EC, F1, E7, F2, FA, F6, C7, EC, F5, E8, E6, F7, F2, F5, FC, C4, 83, 83, 83, 83, CA, E8, F7, D0, F2, E7, F8, EF, E8...
 
[+]

Code size:
176 KB (180,224 bytes)

The file installer.exe has been seen being distributed by the following URL.

http://www.capitalsendhost.com/.../installer.exe

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.