home

melvin resume with pic.exe

MD5:
1c51ee21a7bd7e3abb10532be7da4f1a

SHA-1:
fdec3ceda5766df777ea6dfe3e8617ea55f06d76

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 12:48:22 AM UTC  (today)

File size:
14.5 MB (15,186,432 bytes)

File type:
Executable application (Win16 EXE)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\melvin resume with pic.exe

File PE Metadata
OS version:
7950.3770

OS bitness:
Win16

CTPH (ssdeep):
3:WlWUqt/vllEYZcFTS9gXeF+X32ZpvQ8wQhQvNQ8MQYDSwYOlll:idqGVg3F+X32fQhQSomwYOt

Entry point:
4D, 5A, 90, 00, 03, 00, 00, 00, 04, 00, 00, 00, FF, FF, 00, 00, B8, 00, 00, 00, 00, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 0E, 1F, BA, 0E, 00, B4, 09, CD, 21, B8, 01, 4C, CD, 21, 54, 68, 69, 73, 20, 70, 72, 6F, 67, 72, 61, 6D, 20, 63, 61, 6E, 6E, 6F, 74, 20, 62, 65, 20, 72, 75, 6E, 20, 69, 6E, 20, 44, 4F, 53, 20, 6D, 6F, 64, 65, 2E, 0D, 0D, 0A, 24, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
0.0002

The file melvin resume with pic.exe has been seen being distributed by the following 2 URLs.

http://gq1.attach.mail.ymail.com/aa.f1127.mail.yahoo.com/ya/securedownload?mid=1_2209854_AOekiGIAAJpFT2xc3QTogyIp2Qg&fid=Inbox&pid=3&clean=0&appid=YahooMailNeo&redirectURL=http://aa.mg4.mail.yahoo.com/neo/.../outage.php?b=_4159&fid=Inbox&mid=1_2209854_AOekiGIAAJpFT2xc3QTogyIp2Qg&pid=3&yid=rowenapendoz&nAtt=1&cred=0K3AffFD6Q0WdqLIQGixV0yPWwwmTKlXGtkrAf6R32M.8Zrnoriwxy4OvLAT54UXiMVNaxFmGBIZrJjTuKMrOhy8zXoKqkUrCcOB5p5rqdmp0cINc__OHFadfg--&ts=1332502133&partner=ymail&sig=exM5sDg41A7fpMgdcOsI1g--

http://gq1.attach.mail.ymail.com/aa.f1127.mail.yahoo.com/ya/securedownload?mid=1_49676_AOSkiGIAALIyT2F1IQZbqzwcFvc&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&redirectURL=http://aa.mg4.mail.yahoo.com/neo/.../outage.php?b=_4159&fid=Inbox&mid=1_49676_AOSkiGIAALIyT2F1IQZbqzwcFvc&pid=2&yid=rowenapendoz&nAtt=1&cred=LQpx5wPT_w2o002iVNHd00bgFcFJDPZzR3c7yuQ2fymmPKQBiwr2xuP5snIL4VsMXJL4TLJtUeU_Nt.8WzLcir8f7AM_bggsicctk1F7z1VV8Cwr7KUQFM6IFg--&ts=1332496613&partner=ymail&sig=qXDOTL1_nWDHD_JkPHBDCA--

Scan melvin resume with pic.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.