» new folder.exe
Overview
Analysis
File Details
Behaviors (1)
Downloads (1)
Network (9)

new folder.exe

The executable new folder.exe has been detected as malware by 37 anti-virus scanners. It runs as a scheduled task under the Windows Task Scheduler. While running, it connects to the Internet address ir1.fp.vip.ir2.yahoo.com on port 80 using the HTTP protocol.

File name:

new folder.exe

Version:

4, 3, 4, 6

MD5:

3cf9777081eb1c3b6bc98c8edf7e0a6d

SHA-1:

4321cec09a250e40fc7edef8cb25319e7e7b082a

Scanner detections:

37 / 68

Status:

Malware

Analysis date:

1/13/2025 8:51:37 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.6805459

1048

Agnitum Outpost

Trojan.CFI

7.1.1

AhnLab V3 Security

Worm/Win32.Sohanad

2014.03.10

Avira AntiVirus

TR/Rogue.6805459

7.11.135.204

avast!

Win32:AutoIt-BOQ [Trj]

2014.9-140324

AVG

Worm/AutoRun

2015.0.3526

Baidu Antivirus

Worm.Win32.Sohanad

4.0.3.14324

Bitdefender

Trojan.Generic.6805459

1.0.20.415

Bkav FE

W32.Ctfnom

1.3.0.4959

Comodo Security

TrojWare.Win32.Agent.~hsg

17905

Dr.Web

Win32.HLLW.Autoruner.5517

9.0.1.083

Emsisoft Anti-Malware

Trojan.Generic.6805459

8.14.03.24.02

ESET NOD32

Win32/Sohanad.NCB

8.9518

Fortinet FortiGate

W32/YahLover!worm

3/24/2014

F-Prot

W32/Trojan2.DORR

v6.4.7.1.166

F-Secure

Trojan.Generic.6805459

11.2014-24-03_2

G Data

Trojan.Generic.6805459

14.3.24

IKARUS anti.virus

Trojan.Win32.Cosmu

t3scan.2.2.29

K7 AntiVirus

Riskware

13.176.11378

Kaspersky

Trojan.Win32.Genome

14.0.0.4125

McAfee

W32/YahLover.worm

5600.7182

Microsoft Security Essentials

Worm:Win32/Sohanad.AC

1.10302

MicroWorld eScan

Trojan.Generic.6805459

15.0.0.249

NANO AntiVirus

Trojan.Win32.CFI.teavk

0.28.0.58101

Norman

Obfuscated.H5!genr

11.20140324

nProtect

Trojan/W32.Cosmu_Packed.4321280

14.03.09.01

Panda Antivirus

Trj/NOSDA.A

14.03.24.02

Qihoo 360 Security

Win32/Trojan.8e2

1.0.0.1015

Quick Heal

Trojan.Cosmu.chr.cw4

3.14.12.00

Rising Antivirus

PE:Trojan.Win32.Generic.12A8E957!313059671

23.00.65.14322

Sophos

Mal/Sohana-A

4.98

Total Defense

Win32/FakeFLDR_i

37.0.10808

Trend Micro House Call

WORM_SILLY.WC

7.2.83

Trend Micro

WORM_SILLY.WC

10.465.24

Vba32 AntiVirus

Trojan-Downloader.Autoit.gen

3.12.24.3

VIPRE Antivirus

Trojan.Win32.Generic

27228

ViRobot

Trojan.Win32.Autoit.436736

2011.4.7.4223

File size:

4.1 MB (4,321,280 bytes)

File type:

Executable application (Win32 EXE)

Language:

English (United Kingdom)

File PE Metadata

Compilation timestamp:

11/25/2007 1:21:46 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

12288:bA65XwlYgrHy6V17kr8+m73mSSdFxzm3ctHn7qBSXi:9wlBrygOW3LEywH7qBci

Entry address:

0xA5280

Entry point:

60, BE, 00, F0, 46, 00, 8D, BE, 00, 20, F9, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

1.6023

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

220 KB (225,280 bytes)

Scheduled Task

Task name:

At1

Path:

C:\WINDOWS\Tasks\At1.job

Trigger:

Weekly (Runs weekly on Sundays at 9:00 AM)

Description:

Created by NetScheduleJobAdd.

The file new folder.exe has been seen being distributed by the following URL.

temp:201309A0 .exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to ir2.fp.vip.bf1.yahoo.com (98.139.183.24:80)

TCP (HTTP):

Connects to ir1.fp.vip.gq1.yahoo.com (206.190.36.45:80)

TCP (HTTP SSL):

Connects to ir1.fp.vip.ir2.yahoo.com (46.228.47.115:443)

TCP (HTTP SSL):

Connects to ir2.fp.vip.ir2.yahoo.com (46.228.47.114:443)

TCP (HTTP):

Connects to ir1.fp.vip.ne1.yahoo.com (98.138.253.109:80)

TCP (HTTP):

Connects to a23-37-37-163.deploy.static.akamaitechnologies.com (23.37.37.163:80)

TCP (HTTP):

Connects to ir1.fp.vip.bf1.yahoo.com (98.139.180.149:80)

Remove new folder.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.