home

monster.exe

World of Warcraft

Blizzard Entertainment, Inc.

This is a setup program which is used to install the application. The file has been seen being downloaded from docviewer.yandex.com and multiple other hosts.
Publisher:
Blizzard Entertainment  (signed by Blizzard Entertainment, Inc.)

Product:
World of Warcraft

Description:
World of Warcraft Retail

Version:
5, 4, 8, 18414

MD5:
3eb4ce482f0704e949db760564b6c446

SHA-1:
a8df167a43a689cbe35b98b3f805465532dbc3bc

SHA-256:
36272495ea03ea81fc5c02d415a1aea06704f32fc2c8217f34700cbe52952103

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
1/4/2025 8:05:21 AM UTC  (today)

File size:
12.5 MB (13,154,864 bytes)

Product version:
Version 5.4

Copyright:
Copyright © 2004

Original file name:
WoW.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\monster wow 5.4.8\monster.exe

Digital Signature
Signed by:
Blizzard Entertainment, Inc.

Authority:
Thawte, Inc.

Valid from:
12/2/2013 10:00:00 PM

Valid to:
12/4/2015 9:59:59 PM

Subject:
CN="Blizzard Entertainment, Inc.", OU=TECHNICAL SUPPORT, O="Blizzard Entertainment, Inc.", L=Irvine, S=California, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
54A1AA6802EAD5F58A6A016D4D84C565

File PE Metadata
Compilation timestamp:
6/13/2014 5:48:28 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
196608:aD5yfLMKEZ/jlpoKR3Ai9k2AJ+f/ZOjUo7hLQ8wfa:aD5yY/jlPuisJ+f/6dca

Entry address:
0x1000

Entry point:
E8, 59, E3, 66, 00, E8, CF, 99, 1D, 00, E9, 45, E3, 66, 00, 55, 8B, EC, 83, 7D, 08, 00, 74, 11, 6A, 00, 6A, FF, 68, 24, 6D, D2, 00, FF, 75, 08, E8, B5, A8, 1D, 00, 5D, C3, 55, 8B, EC, 6A, 00, 6A, FF, 68, 2C, 6D, D2, 00, FF, 75, 08, E8, F1, B0, 1D, 00, 5D, C3, 55, 8B, EC, 8B, 45, 08, 8B, C8, D1, E9, 81, E1, 55, 55, 55, 55, 2B, C1, 8B, C8, C1, E9, 02, BA, 33, 33, 33, 33, 23, C2, 23, CA, 03, C8, 8B, C1, C1, E8, 04, 03, C1, 25, 0F, 0F, 0F, 0F, 69, C0, 01, 01, 01, 01, C1, E8, 18, 5D, C3, 55, 8B, EC, FF, 4D, 10...
 
[+]

Code size:
9.1 MB (9,574,912 bytes)

The file monster.exe has been seen being distributed by the following 4 URLs.

https://docviewer.yandex.com/source?id=6m0ih-czf4ljt4ffezia3nhlt6xqciyovj3pkm3camj6il8klo14voalyqhflt87xtvs9bflxzopl0e5h53brp9cugda20fwjjhuxuji0&archive-path=//Wow_OnLy.exe&ts=15892678f78&token=LMa5mkqwRRsxd51mn Vj2g==&name=wow_only-Mop.rar

https://api.asm.skype.com/v1/objects/0-eus-d2-4db332f9401b0d5126b3978cbda25074/.../original

about:internet

http://www.devapexteam.com/downloads.php?cat_id=6&file_id=9

Scan monster.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.