home

installer.exe

This is a setup and installation application. The file has been seen being downloaded from www.ranchbundleshead.com.
MD5:
22e65383954565bb3a85df93ad8c657b

SHA-1:
76e05165498d8b79837d5202a96cb1810da91498

SHA-256:
9c901ec5512701008ee56a3f2567ee6750de961e647cdc82ffa8e11ea30c528f

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/27/2024 1:08:37 AM UTC  (today)

File size:
548.8 KB (561,955 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\installer.exe

File PE Metadata
Compilation timestamp:
12/27/2015 11:08:55 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:3fOfcxfJx1K0nj4ST3aWsCpIwrYoRi8je7nl:3fecx/Zyf8htR+7l

Entry address:
0x310D

Entry point:
0F, CF, 88, DE, 0F, CE, 2B, F8, B3, 96, 73, 0B, BF, 8C, F4, DF, 6D, C7, C0, 06, 38, 6D, E2, 81, FE, 7C, 4F, 00, 00, 73, 03, F6, C2, 82, 68, 39, 0A, 00, 00, 69, D1, 0A, 79, 56, 98, 5A, 81, F2, 39, 0A, 00, 00, 69, EE, 76, B2, A7, BA, 80, C8, F9, 81, E0, 68, 7A, DC, 9C, 81, C2, 60, F1, FF, FF, 81, C2, A1, 0E, 00, 00, 0F, AF, F8, 0F, B7, D8, 80, CB, C7, 81, FA, 5F, 01, 00, 00, 72, D4, 81, C0, 79, B8, BC, 4A, 0F, AF, C1, E8, 21, 00, 00, 00, 8B, C5, 72, 0A, 8B, EA, F7, D3, 85, C6, 86, F1, 11, C3, 84, CF, 81, EF...
 
[+]

Entropy:
7.9759  (probably packed)

Code size:
24 KB (24,576 bytes)

The file installer.exe has been seen being distributed by the following URL.

http://www.ranchbundleshead.com/.../installer.exe

Scan installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.