home

minecraftfreedownloadsuscom-setup-133523431.exe

Sonny Sun Interactive

The application minecraftfreedownloadsuscom-setup-133523431.exe by Sonny Sun Interactive has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from int.cdn.hw.designcontroller.com and multiple other hosts.
Publisher:
Sonny Sun Interactive  (signed and verified)

MD5:
758131762f095c2b398848ecad5aeb2b

SHA-1:
7327a335649032069c94e2cde501668349f463a7

SHA-256:
dfc8fa57d0e95cea6120565c6693fe1f8906aa3e5ba273c6a21a2b533019fd3e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/15/2024 1:01:29 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DownloadAdmin.SonnySun.Installer (M)
16.6.17.18

File size:
429.3 KB (439,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\minecraftfreedownloadsuscom-setup-133523431.exe

Digital Signature
Signed by:
Sonny Sun Interactive

Authority:
GoDaddy.com, Inc.

Valid from:
3/8/2016 5:13:39 PM

Valid to:
3/8/2017 5:13:39 PM

Subject:
CN=Sonny Sun Interactive, O=Sonny Sun Interactive, L=SAN FRANCISCO, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
0093AC568FBE0B686A

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
12288:yzxKdS7vd/x3z+NiqIJQ3I11NWkeytFkUMngat:ylKdSbPj+NiqIJQ3I110keoFkUMngat

Entry address:
0x4D830

Entry point:
C6, 05, 70, E2, 44, 00, 00, B9, 00, 10, 46, 00, BA, 04, 10, 46, 00, B8, B0, 07, 45, 00, E8, 65, FF, FF, FF, E8, 70, FF, FF, FF, B8, 90, 07, 45, 00, E8, C6, 39, FC, FF, C3, 00, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.4621

Code size:
306.1 KB (313,456 bytes)

The file minecraftfreedownloadsuscom-setup-133523431.exe has been seen being distributed by the following 39 URLs.

http://int.cdn.hw.designcontroller.com/dl-pure/1200279/.../?bc=1200279&checksum=168384581&cb=-981143845&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203701/.../?bc=1203701&checksum=162417063&cb=-121786523&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.medianotebook.info/dl-pure/1200319/.../?bc=1200319&checksum=121715035&cb=-1533852529&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1201093/.../?bc=1201093&checksum=59493305&cb=-1611616023&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203701/.../?bc=1203701&checksum=167346209&cb=387215236&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1200275/.../?bc=1200275&checksum=168037861&cb=-352932681&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203701/.../?bc=1203701&checksum=162418735&cb=-913124462&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1202915/.../?bc=1202915&checksum=167814199&cb=-363398824&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203705/.../?bc=1203705&checksum=162416645&cb=1346536267&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1200273/.../?bc=1200273&checksum=168388053&cb=-146715806&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203705/.../?bc=1203705&checksum=162476139&cb=1157911572&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203705/.../?bc=1203705&checksum=167345011&cb=-309549726&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.medianotebook.info/dl-pure/1200319/.../?bc=1200319&checksum=121727823&cb=-672271078&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1202915/.../?bc=1202915&checksum=167753887&cb=-1685321239&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203705/.../?bc=1203705&checksum=167347143&cb=2097431481&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.medianotebook.info/dl-pure/1200319/.../?bc=1200319&checksum=66454399&cb=195722201&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.medianotebook.info/dl-pure/1200319/.../?bc=1200319&checksum=167770115&cb=-257464927&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1200273/.../?bc=1200273&checksum=167754815&cb=-4232691&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.medianotebook.info/dl-pure/1200319/.../?bc=1200319&checksum=162030105&cb=-615566647&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1202915/.../?bc=1202915&checksum=167753887&cb=-10014849&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1202915/.../?bc=1202915&checksum=133511987&cb=-574792436&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203703/.../?bc=1203703&checksum=162417517&cb=-1041170218&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.strategylabs.info/dl-pure/1202175/.../?bc=1202175&checksum=125469313&cb=-171647994&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1202915/.../?bc=1202915&checksum=133514301&cb=1922447980&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203701/.../?bc=1203701&checksum=162495017&cb=722635553&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1200279/.../?bc=1200279&checksum=157963783&cb=-1007293412&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1202915/.../?bc=1202915&checksum=133514301&cb=-1125230776&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.medianotebook.info/dl-pure/1200319/.../?bc=1200319&checksum=66454399&cb=265005538&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203701/.../?bc=1203701&checksum=162489531&cb=-1675559075&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

http://int.cdn.hw.designcontroller.com/dl-pure/1203703/.../?bc=1203703&checksum=162417253&cb=1379351546&hashstring=jbmay2016&usefilename=true&executableroutePath=1203599&stub=true

Latest 30 of 39 download URLs

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ec2-52-70-152-90.compute-1.amazonaws.com  (52.70.152.90:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.