home

lod3claws-fadoge.exe

Fancy3D Launcher

Beijing FancyGuo Tech Ltd

This is a setup program which is used to install the application. The file has been seen being downloaded from admin-lod.3claws.com and multiple other hosts.
Publisher:
Hongfeng Hengyu (Beijing) Tech Ltd.  (signed by Beijing FancyGuo Tech Ltd)

Product:
Fancy3D Launcher

Version:
0,15,0410,1620

MD5:
c79d7eceb1ac5ba732a79c1940d25b02

SHA-1:
ae1354805250cfe836018dfc4df8ea8f3d336bc4

SHA-256:
be5116791e74dc19018139adf48af5a71fa719e4195d6f7a07dbc2ee7878317d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 2:57:51 AM UTC  (today)

File size:
2.1 MB (2,249,456 bytes)

Product version:
0,15,0410,1620

Copyright:
Copyright (C) Hongfeng Hengyu 2009 - 2015. All rights reserved.

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\lod3claws-fadoge.exe

Digital Signature
Signed by:
Beijing FancyGuo Tech Ltd

Authority:
VeriSign, Inc.

Valid from:
6/12/2015 8:00:00 AM

Valid to:
7/15/2017 7:59:59 AM

Subject:
CN=Beijing FancyGuo Tech Ltd, OU=IT Support, O=Beijing FancyGuo Tech Ltd, L=BeiJing, S=BeiJing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6D09E707C0C807139E9F7382746AF7CF

File PE Metadata
Compilation timestamp:
4/10/2015 4:20:19 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:KXRGbsqQc6TNDVdwPR0b7m+a14iOSLToZE4U:4cwVTNAqPRi9PqrU

Entry address:
0x2F2330

Entry point:
60, BE, 00, 20, 4E, 00, 8D, BE, 00, F0, F1, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, FA, 05, 2F, 00, 57, 83, C3, 04, 53, 68, 2E, 03, 21, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Entropy:
7.9717  (probably packed)

Code size:
2.1 MB (2,166,784 bytes)

The file lod3claws-fadoge.exe has been seen being distributed by the following 43 URLs.

http://.../dl?t=dl&s=http://.../16.html?uid=1017535332&sid=16&time=1442625031&gw=1&sign=d1d1972876aa18e54cbbf09fdfd20142&ip=120.29.68.96

http://.../dl?t=dl&s=http://.../23.html?uid=2015122189268&sid=23&time=1450691200&gw=1&sign=c8dd44dfa1762f9651e857acfcae3866&ip=186.244.41.155

http://.../dl?t=dl&s=http://.../32.html?uid=2016031006758&sid=32&time=1457604409&gw=1&sign=2a6dab76ac8fba84eb2ce083e3f21ca4&ip=173.245.62.107

http://.../dl?t=dl&s=http://.../2.html?uid=2015062815600&sid=2&time=1435544746&gw=1&sign=49c1a8141fc15396e64d846bab2d6195&ip=121.54.44.94

http://.../dl?t=dl&s=http://.../11.html?uid=2015070738536&sid=11&time=1436270260&gw=1&sign=a060bd1e55553f67d8a85772891bdfba&ip=110.54.175.86

http://.../dl?t=dl&s=http://.../27.html?uid=1013482805&sid=27&time=1454196642&gw=1&sign=c1b08e25344a024a1e4097981d0b35bc&ip=189.71.104.205

http://.../dl?t=dl&s=http://.../35.html?uid=201603193456&sid=35&time=1458470979&gw=1&sign=0bb5447b647d418792f49e02d6408f1d&ip=104.155.229.211

http://.../dl?t=dl&s=http://.../28.html?uid=2016020768145&sid=28&time=1454840337&gw=1&sign=aab40767ff0c09d8b292ef036d77f2a0&ip=179.99.238.232

http://.../dl?t=dl&s=http://.../23.html?uid=2015122660340&sid=23&time=1451107784&gw=1&sign=114d9dc6b567be9870b2a79653e1e69c&ip=112.198.103.17

http://.../dl?t=dl&s=http://.../1.html?uid=2016030165553&sid=1&time=1456802675&gw=1&sign=0854add501d0534ce23172d96ba3ebdb&ip=108.162.215.202

http://.../dl?t=dl&s=http://.../11.html?uid=2015070546537&sid=11&time=1436076622&gw=1&sign=fd00cb9db02d67ea32adc91069e4289d&ip=112.198.103.67

http://.../dl?t=dl&s=http://.../36.html?uid=2016032709518&sid=36&time=1459083409&gw=1&sign=53f311fe62c5ca22a6dc1ef4c5ec083f&ip=104.155.229.211

http://.../dl?t=dl&s=http://.../11.html?uid=201507034228&sid=11&time=1435918024&gw=1&sign=b562401ee4be1ffab70a8a84e99b4956&ip=49.144.173.139

http://.../dl?t=dl&s=http://.../27.html?uid=1012638319&sid=27&time=1454074665&gw=1&sign=b3be5c266de6d3ba43e6ea07b4a53354&ip=112.208.215.20

http://asstnarva.playwebgame.com/lod/.../lod3claws.exe

http://.../dl?t=dl&s=http://.../16.html?uid=1017087320&sid=16&time=1442708281&gw=1&sign=7ce99d2670d5d481e63a5149dc956231&ip=114.108.216.188

http://.../dl?t=dl&s=http://.../13.html?uid=2016030452184&sid=13&time=1457045009&gw=1&sign=9fc1dc0f05f2ac92c40d436716410cdf&ip=188.114.98.174

http://.../dl?t=dl&s=http://.../9.html?uid=2015062057113&sid=9&time=1434786563&gw=1&sign=96c29b9b106460eafdfb7cb18d8a5454&ip=180.251.229.209

http://.../dl?t=dl&s=http://.../23.html?uid=2016012612898&sid=23&time=1453803430&gw=1&sign=41b55559cef4b0b0130030f2334eac3e&ip=112.198.90.163

http://.../dl?t=dl&s=http://.../16.html?uid=2015091946133&sid=16&time=1442670179&gw=1&sign=9030f18ace46c2e37bf7bc5dbf2e553b&ip=180.191.143.104

http://.../dl?t=dl&s=http://.../9.html?uid=2015062157981&sid=9&time=1434875783&gw=1&sign=c5ca7fa9b5caee6bc68fce2260ae47bd&ip=182.253.162.5

http://.../dl?t=dl&s=http://.../13.html?uid=2015121765125&sid=13&time=1450302630&gw=1&sign=9d33e580fa783efdf1c3291e56720e49&ip=5.66.100.54

http://.../dl?t=dl&s=http://.../21.html?uid=201512044954&sid=21&time=1459733026&gw=1&sign=73014fd6c4379b20818e8837826d3f4d&ip=104.155.229.211

http://.../dl?t=dl&s=http://.../23.html?uid=2015122396779&sid=23&time=1450856691&gw=1&sign=9677d214be9a21b73b834817c66f67bf&ip=112.207.238.190

http://.../dl?t=dl&s=http://.../10.html?uid=2016040186629&sid=10&time=1459648752&gw=1&sign=a9e41c17635aecced47aac4b9f537c1e&ip=104.155.229.211

http://.../dl?t=dl&s=http://.../32.html?uid=1017242655&sid=32&time=1457374639&gw=1&sign=d223dfbedec1d87b1f4f5c6ac45c59a6&ip=162.158.130.15

http://.../dl?t=dl&s=http://.../9.html?uid=2015062468632&sid=9&time=1435117075&gw=1&sign=6a7db361996564c99e675f5e7704a7ab&ip=180.191.118.50

http://.../dl?t=dl&s=http://.../32.html?uid=1016701559&sid=32&time=1457272965&gw=1&sign=0f73b15711094c1096ec661f19cd9bbd&ip=173.245.49.118

http://.../dl?t=dl&s=http://.../23.html?uid=2015122426372&sid=23&time=1450924726&gw=1&sign=c04568ebea0eeec763b2577c51e41841&ip=112.207.209.129

http://.../dl?t=dl&s=http://.../11.html?uid=2015071046702&sid=11&time=1436475911&gw=1&sign=9c445ba7bcab84af11a89d8ee5184e81&ip=139.0.250.180

Latest 30 of 43 download URLs

Scan lod3claws-fadoge.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.