home

mep.exe

MD5:
8fd605b345fad450bdd1f1295ed436e5

SHA-1:
ef96ba15ed6588ed6be1c38baa44fc16e1327153

SHA-256:
1b218bbfc5db2c15c93f70b3073f6ce2ab795baab980101fafe0b1739c2cb029

Scanner detections:
2 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/26/2024 2:00:18 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.Winlock.4530
9.0.1.0229

NANO AntiVirus
Trojan.Win32.Winlock.cyhjli
0.28.2.61519

File size:
96 KB (98,304 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\mep.exe

File PE Metadata
Compilation timestamp:
2/20/2009 1:32:54 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
768:HJXWfQa9DzNhIdEc+ndrf9i2lYqvAlWoPFGdo8NNqSTSHWrrvtHowAUYhoVbcJf8:HJX4caNfo+noPFGak3GHCrsh4F5

Entry address:
0x25BF

Entry point:
55, 8B, EC, 6A, FF, 68, 50, 71, 40, 00, 68, A8, 4A, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, B8, 70, 40, 00, 33, D2, 8A, D4, 89, 15, 64, AE, 40, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 60, AE, 40, 00, C1, E1, 08, 03, CA, 89, 0D, 5C, AE, 40, 00, C1, E8, 10, A3, 58, AE, 40, 00, 33, F6, 56, E8, E2, 0B, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, B0, 00, 00, 00, 59, 89, 75, FC, E8, D0, 21, 00, 00, FF, 15, B4, 70, 40, 00, A3, 64, C3, 40, 00, E8...
 
[+]

Entropy:
4.6905

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
24 KB (24,576 bytes)

The file mep.exe has been seen being distributed by the following 7 URLs.

http://blackberryunlocking.biz/bb.exe

http://www.jacellular.com/files/.../Blackberry_IMEI_MEP_Reader3.exe

http://www.fonefunshop.co.uk/mep.exe

https://www.mobileunlocked.com/mepreader.exe

https://mega.nz/temporary/.../bcdEFZja

http://dc651.4shared.com/download/.../bb_mepreader.exe

http://www.unlockberry.co.uk/.../mep.exe

Scan mep.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.