home

microsoft_word_instalator_sciagnij.exe

The application microsoft_word_instalator_sciagnij.exe has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from s9066.chomikuj.pl and multiple other hosts.
MD5:
97863e69f5c40ef59d8e5922a65281e2

SHA-1:
914e9bed834d50645ca9b9ea91b4706e0fcf50b0

SHA-256:
e8b566152547f0eb44d87a2faff2ce4d492465895dbcdca9759884d3cbe27f5f

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/30/2024 3:32:16 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.1392
9.0.1.0253

Reason Heuristics
Adware.Downloader.DB (M)
16.4.28.0

File size:
1.4 MB (1,415,864 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\microsoft_word_instalator_sciagnij.exe

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:t6vN06KCMIeAFNXSHSFw2KS6kr5unz1c0wjC6q/K71MjSMT:ewZIemNiy+2KKrsnz1wjC6ms1MjSW

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9915

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file microsoft_word_instalator_sciagnij.exe has been seen being distributed by the following 22 URLs.

https://s9066.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3hrnOvB3PgaD5ws6D-aBKQYRsuF56-tXjOoFqaRGpSKFwkPJ00AYO4kgPF0Q2SWDOGCDS9VWQmgzkGcaoma0pCOD2SpnflvDQ18jSR-QwKzUWKypICJCSkRQ58WSNYabe3If5LCaJPQxx1MkWBTuRlU&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3sn6M5nZBazSsb2ob_tNUMpIJZckFkxS3J0qkzTOhavvuZwug43fx_Gvq7QIAvxSyZz7WDg4f73yMOLRR3C9NJ2xGHAx-Ge7UJA7o5M_1PvbNsEowh7cgUqYjNJAR2zkoTd8AXeTLNI1ofFPq1KKf0A&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XLZw2Q0pFYQ8zIiKsUXemmxYtWIvNtisasQAhFBc-EoNkjPo1NFJE_giXwLW0_yBkWu68oh23UrtZxbxUTeNx8zGNI9NdOr7Hr9l2LFV8djGwjMHP1uau_fycs2o6JIJv4&pv=2

http://s7935.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XJk4Y9LuMBBQFDqBl9fXC7DxYuQXLUe3w1nZjgfOl9t-jLRvAPFrPPokbuCa2UAloIINWucQKU1SNW22D62NS8eJhQ7EvcTDJkKoMMlcdeMmQxx6SLJdaKMw6IZcNBtCNE&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XI34R6ob3snNOXOZE6Hur9DTm2gTTqrJfLFmO1ue3jaxJLFoZXzFY_D8gigBrCC8Lm7qP0k9dxt2deRo-VloCBDyM6_uAG5VbuO_YN5ZD_dea1cD-CdPUFWBrIGpo3dNf0&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XKvgho0qPUmpllMxxixn6GXLz-GvNYJ4NaeyhzVgoNjy1p5cKLhtLXhRXWeD90V2L5g5ABRqfxZCjw6e0B_CWFMlj9uiI43GqVHt03lNg3xMvGGyrRcgz67WSyW7COk0s0&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3hHKCm9_icJJulmMcAdAFeFEvjVWdZx3X_eHTeTtemQC4_G3LOZXjsUlMU_d9VlfCc0OlQOJ6MuErxhloft0sDmsEPDLVVX_DKLQV-mxXBKVS3tKwt-QQv2TExYI--wDiu0zYzyqviPXF8f6MXGBb6tp9IbMxhw9lGa6BC63o2Jg&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3hHKCm9_icJJulmMcAdAFeGd7gReh0FIaFpV0_UHU6Fam0pApse0S7vftQcyTbK7kWroLBpON9GUhWCZ2BSfh8j4FgnoY-uBh9lIt1sXUhgc6BeODN-0hzG6YCJ7I3gpa2R5emEOUAAu2gXqm2b1zuOuC83KlB9-A5f3hcpXRlB0&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3it4u5zWguCzt45Ly2hXBRS7nych--alG5fLD2kd38MvHNkJDiAlsC64vJWUhTjF7-AUN2zVRVazil4TRmRHqMuc0PuMUzwxIHTVfq063-CU3gbsjS93i2w4LCkkh0KIe7sMJoOwg7RJMIRUnJVV1Bc&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XLY7IdcftZzKhjPqvtNTvUhNNAgiOMq9vab3spIE9HUQbxkTuZHrwtdqqUXEJ5sfk_AbhhTyqTxnrXQBn0D2o9Wnuu82eWCd6QGr-PnzuUEONJXRYFzitaGBcT8CzETIEM&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XLRNbM5NvSveYFDfxBsBDXnaxB9AIMyuZ1p-y4uLh9ALwMaKixjqksUP36GzdvlbdbJyd4G3lEL8B0ZB3idL2KcBWBc_031yv7lDSvAKDpt2sJOoY38Jj3DA5wQ5ixQrks&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3s2Ct9QT3E3QtXVHWrPI0P0PsNwUfqJfxUBE7BCdFbBRxdL4ouHh1dS-IBJMOaDpiuPvXPMYcVuHQ3MAfWs2R0-Fjs2u4O4D62p55U774UA86r3zHfE0ZLQODswaLKA54dosuvudLJnlxid_5UoSkA8&pv=2

http://revpx14.chomikuj.pl/.../File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XLNubRVkDI1wbviu4rgKLfnY0BL3liMtSgn9xGJXF7M9t6EAXFVgJvwHR3ynbgSImqces0mww52dM-czP27FT_agCaf5X70yAiUm0zB_sphkfkIEdecEZvH6ncnW5kpQ64&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3hHKCm9_icJJulmMcAdAFeH_tblkL9dC1rxCUXNcpnK9KaxPzqN4vR67ffRZReUhiC9tyiStZpEbdmX662lc04x-ggzikveZ1OHSN1ZlsZlIB1kWFaJgZJ2qW5_u6nVbKNxn-_NtwC4E-086vAhoRGJauyvkPPjq_jHuQCW_OSDO&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3hHKCm9_icJJulmMcAdAFeEzbNBEM9igsfxdDsZT2ktUN8HcJe66KKc7d_gr_fhku0wj5BQc1V5SLxDjzkm4FHtwQMD1hy5WqJoHWc6CjApqcpcocCQdIAdqrvnExjEl0lJrRqWiXJCb0H8LAEI0a0m0BCflRzcHwoIckzbmg6dZ&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3sn6M5nZBazSsb2ob_tNUMrBJlAvVFaTXNY2doNaWvTaVOHYiWBLjJM0ejDz2ub5eWPmCYFm4vWWTj6J_9F60NdPFJukO0ivogk19UFllUOQ525J7cD8ZZtuUOUVFYNUuPycju_ZwBU-MmjrUv8cPBk&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3s2Ct9QT3E3QtXVHWrPI0P0tjXw4EKiEQUsiv4Poqyhxm7Fu6K3XZ6lwn_Ve5SqmxNQ4qhNlctkBRjfF3TK5gjKe6O9zJGPF2BZDTJ7IZ23WDB_cLzKpp8_1gOHJv50mrZ7bD0asQPUqp3YgHmPi2L4&pv=2

http://bi.sciagnij.pl/0/.../Microsoft_Word_instalator_sciagnij.exe

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XKoIzLjXkLWI3rIcAgnNFhz1wKKPPY9aYv53FL5Oedi9mt8HF7Fs-jes8BZVK7yXR5tipEIdW8sQRtXxvbO6-N5fObPYsEvgpdWra-5-wiOO1CdcIc_LkiB4GAN_M_LOoU&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3sn6M5nZBazSsb2ob_tNUMrGZChrksZL8s4W14OOmeye8cN2cty-xQV1tAlrT-TZ_FhwE-kYT6xdCdQhSMxw7s21niFGjZ00cnq-PSxC5ZCfwWwaDqjFJdDnBoGfSxftuRpnz0G6auYXs6uzoxHLYB0&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3hHKCm9_icJJulmMcAdAFeHrBH_GfmwcsXfeHm_EPKKNz1JupepcjkTL0hVyMAgdxZ5ccQcsRmd1v2xQKDS93hgqmwtKosB6-rxvp7xp_VM_ZDE7g0SqSA_g1RH1Mgf2whoJLafzy2kOYZ25sFE8cEzMxOpR85Ra7Eu5uN7MS4OD&pv=2

http://s6338.chomikuj.pl/File.aspx?e=V9iH6C2A2kJk8lOq2Meh3mibZRAvVusIitUtzfcd6XJ-cv9eLloz1uVYFpJaORxD_va6koNoew5uQjCjHNl0YL16yb-RFpNrNMQNWiSoPcmMliTr-v34y-wHRSxwqH2J16f4LX5bCjxN2qvApGhV7OfyzVHp2YTSRGqQ7_siBKU&pv=2

Remove microsoft_word_instalator_sciagnij.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.