home

mactypeinstaller_2013_1231_0.exe

MacType

FlyingSnow

This is a setup program which is used to install the application. The file has been seen being downloaded from p-def2.pcloud.com and multiple other hosts.
Publisher:
FlyingSnow

Product:
MacType

Description:
MacType 1.2013.1231.0

Version:
1.13.1231

MD5:
c875f417353682239827ab660f31f379

SHA-1:
c3c8da5ac557ffb1699f5983184deb4c5eb5e3cd

SHA-256:
8e5221b36606b76226a4fd0da5751237dc42815cefaa0e50c6bef2ca7be09a78

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/15/2024 5:56:42 AM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
TROJ_GEN.F47V0103
7.2.13

File size:
4.7 MB (4,944,219 bytes)

Product version:
1.13.1231

Copyright:
Copyright (C) FlyingSnow

Original file name:
MacTypeInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, China)

Common path:
C:\users\{user}\downloads\mactypeinstaller_2013_1231_0.exe

File PE Metadata
Compilation timestamp:
10/18/2012 6:04:11 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:XRqsnSnewFY5rkB+d/Euz79QvMI78FvK8x/G:Y5XFY5r+/+9EOF7xO

Entry address:
0xAB509

Entry point:
E8, 25, B9, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, F0, 33, DB, 3B, F3, 75, 1E, E8, CF, 44, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, CB, EB, FF, FF, 83, C4, 14, 8B, C6, E9, C2, 00, 00, 00, 57, 39, 5D, 0C, 77, 1E, E8, AB, 44, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, A7, EB, FF, FF, 83, C4, 14, 8B, C6, E9, 9D, 00, 00, 00, 33, C0, 39, 5D, 14, 66, 89, 06, 0F, 95, C0, 40, 39, 45, 0C, 77, 09, E8, 7C, 44, 00, 00, 6A, 22, EB, CF, 8B, 45, 10, 83, C0, FE, 83, F8, 22, 77...
 
[+]

Entropy:
7.7218  (probably packed)

Code size:
884.5 KB (905,728 bytes)

The file mactypeinstaller_2013_1231_0.exe has been seen being distributed by the following 8 URLs.

https://p-def2.pcloud.com/.../MacTypeInstaller_2013_1231_0.exe

http://r2.computerbild.de/exec/r2r.pl?m=w-cobi;u=http://d.computerbild.de/downloads/.../MacTypeInstaller_2013_1231_0.exe

https://p-def2.pcloud.com/.../MacTypeInstaller_2013_1231_0.exe

https://mega.nz/temporary/.../UFYRGQpR

http://dl.freesoft-100.com/.../MacTypeInstaller_2013_1231_0.exe

https://eddon.systems/.../MacTypeInstaller_2013_1231_0.exe

http://www.mactype.tk/MacTypeInstaller_2013_1231_0.exe

http://d.pcs.baidu.com/file/c875f417353682239827ab660f31f379?fid=1259133702-250528-3085980007&time=1389478142&sign=FDTAER-DCb740ccc5511e5e8fedcff06b081203-tVhNmllJ6KPltF3Ei9G47vsf7r0=&rt=sh&expires=1389478742&r=581440554&sh=1&sharesign=i2wOIC7m85BUM80i Wax0wEE/CDqaorGVVUzAA 4COPLK979FSFuTBzxxswmQru NcAdB9PoP7r8krpCvs71gSP8njdB7dpgR0ZHyAU1KzUYj jHuWAHHbG2nDZMkILX2V4S FNWGNGh7Vgux40pRAispMM/.../IB1co57noA202frcUyqas3FUpyiKLlYrOzeHXPj3SnGg==&cflg=1023

Scan mactypeinstaller_2013_1231_0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.