home

mb_warband_setup_1143.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from download.taleworlds.com and multiple other hosts.
MD5:
5e152126a30687753b0cd03827eaac67

SHA-1:
94fb829068678e27bcd67d9e0fde7f08c51a23af

SHA-256:
c519cd37f5ce03ec06b3f0b0a894d8198a02fa25eda68df84fedfd14450b5739

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 6:54:08 PM UTC  (today)

File size:
585.4 MB (613,853,181 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\mb_warband_setup_1143.exe

File PE Metadata
Compilation timestamp:
6/6/2009 3:41:59 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12582912:+fasH1va7iV49LqHuLGhALKU5gFyjbqDd9dtSUC82595h6nEmtgp86WaCniw0M4C:QtH1y7iMDKRFYy/CP9/ATgpds+M0RO

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9882

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file mb_warband_setup_1143.exe has been seen being distributed by the following 27 URLs.

http://download.taleworlds.com/cdn-cgi/l/.../s&jschl_answer=265

http://www.tamindir.com/indir/MjAxNi0wNy0xMyAxMzo1OToxNQ==/mount-blade-warband/.../1.143

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=fec6f31be417fe5909036cc222be2d2a&pass=1481108122.994-M5s3hGUqYW&jschl_answer=4247

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=38e6686246446abc33f9e510fc739ce8&pass=1479427937.247-XrB637JyBn&jschl_answer=76642444

http://download.taleworlds.com/cdn-cgi/l/.../rZlW3n&jschl_answer=119

http://www.tamindir.com/indir/MjAxNi0wNy0xMSAxNzoyMDo1MA==/mount-blade-warband/.../1.143

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=fad52f9078772e0b05015c92c41af2e8&pass=1478902614.62-sdPKoXea0s&jschl_answer=24663

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=3615fa2830447b20ef3956d49466b59c&pass=1482692207.472-14qeNGSCWA&jschl_answer=149

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=548c02cf7e953708f664e2bfb19e1751&pass=1480312449.933-szvh7NpAcl&jschl_answer=68

http://ref.gamer.com.tw/redir.php?url=http://.../mb_warband_setup_1143.exe

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=657c03520492ccb0078e91318f851981&pass=1480284506.532-py3BkDU RN&jschl_answer=75

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=23465a1a753d836820df0bdccb42d020&pass=1476651141.728-9GU1dBgXD2&jschl_answer=15819

http://www.ranchsendgift.com/xw3OEYOeRLd9tA0jA2w42DssJ0sJqwnxDXrVTweq6tm5Dylg_Am4_MARtXJlQUQzpr5d39lcBkmVsJLC67C_lVBNwpLlpL0JyLZHE_9XUaaezSEn4YBa4pP UTe1CqvuKwXXPOj sy4mSgzHYb9qCz GywPd0d0B3rrX8j1yIBJKN4H64awX8blvPpVOnzsQBaIfjFZxGxvEKP_4Dm7m gYQ64fWhA==-GzcAAEQ3F5sg2vpQWBREf35wyIHDV3KzQDDYGDtLEDy9ssYVKbcemJs1lXgxtQ_LcxuqbsJP

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=552e63bf6ef5b09b350aa207cc40195c&pass=1481587608.708-u0SaPxXASh&jschl_answer=-15

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=cdbe8685a8158fe7785217b4cfbfcc21&pass=1478506046.045-OsNLwybk0D&jschl_answer=80

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=c81f342209c35ae09aaf2aaf497d3e91&pass=1480818245.042-0V9JzHcL D&jschl_answer=48560

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=a37fcad00339b18212be9f9f41055997&pass=1479344869.351-5fflFV8vcs&jschl_answer=8144

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=510a47a340b89bab16c9636f333a569a&pass=1475619842.202-HVZlgc9Uzz&jschl_answer=783

http://download.taleworlds.com/cdn-cgi/.../chk_jschl?jschl_vc=2425f9806226f82f6cc18ad7120db973&pass=1478980213.241-MqaKBZBga7&jschl_answer=216

http://www.ag.ru/fdl/?f=/demos/.../mb_warband_setup_1143.exe&dl=??????? ???? ? AG (?????? ??????)

http://www.tamindir.com/indir/MjAxNS0wNy0xNyAyMTowMDoxOQ==/mount-blade-warband/.../1.143

http://www.tamindir.com/indir/MjAxNi0wNS0yMCAxODozMDo1NQ==/mount-blade-warband/windows/.../

http://www.tamindir.com/indir/MjAxNi0wNS0yOSAxNzowNzoyMA==/mount-blade-warband/windows/.../

http://www.tamindir.com/indir/MjAxNi0wNS0yMiAyMjozNjozNg==/mount-blade-warband/windows/.../

http://www.tamindir.com/indir/MjAxNi0wNS0wNyAyMToxNDoyNQ==/mount-blade-warband/windows/.../

http://download2.taleworlds.com/mb_warband_setup_1143.exe

http://download.taleworlds.com/mb_warband_setup_1143.exe

Scan mb_warband_setup_1143.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.