home

optical.exe

MD5:
a077e2caa44bc6e44addd31f5a9fa551

SHA-1:
1bcb5544d0e88292ea1d6c0f9ddc6a5a037fcff9

SHA-256:
b34f39a47cba2b634aa68418efedcbef9eabe0849c2440fcd1b2c18ed5baddbd

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/25/2024 8:23:45 AM UTC  (today)

File size:
21.5 KB (22,016 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\optical.exe

File PE Metadata
OS version:
4.11914

OS bitness:
Win64

Subsystem:
Native (none required)

Linker version:
2.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
192:GPbq+rltJLKhj8hXYUa0qTMhM2C+6OR0tbkY76li3s8/fLVK9BheGv9rBP7INWD1:GPe+3Jjd3a00MWfI0tRqUVAHSMoieY

Entry address:
0xB500AD

Entry point:
4D, 5A, C2, 00, 03, 00, 00, 00, 20, 00, 00, 00, FF, FF, 07, 00, 00, 01, 65, 40, 00, 00, 00, 00, 40, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.8813

Code size:
256 KB (262,146 bytes)

The file optical.exe has been seen being distributed by the following 9 URLs.

http://darkmolive.free.fr/optical.exe

http://www.saack.dk/.../pinwheel.exe

http://www.hypnose-therapie.at/optical.exe

http://www.grand-illusions.com/images/articles/opticalillusions/.../Optical.exe

https://files.itslearning.com/File/Download/GetFile.aspx?FileName=Optical.exe&Path=HEetr/rFGc2PWP7NVEbESdqi85Ns8AkvNhpVDzyTZ2eDG7ibpT62eN qBP6PvojigFmNl3ikuzAsdeU2S7jiBN8X V1WNtCtjrd myXsjLizIFL1lvh hEVUA2gQgsoQ0gq0Zm2lVEhoQxiXBHGBRGrFJGdxfn4lekvVC7UR17g=&MimeType=application/octet-stream&Domain=www.itslearning.com&TimeStamp=635466582246790191&Unicode=True&Signature=mMronGdNX9IDVddu9wHOCu0u472nk LYMvZ2wzJVxkUdU5Pnv1A0AORy8 rHvrIpw5XLqUWl4l1SE4kKO7QU1FCYr3fpdZwamFQq9jglMMnXO/.../U8U9GedDu41Rfos5dQ0958u9QxlDTXtqNU2sbn7tgq1giK8kCSJOyB8iivE=

https://www.itslearning.com/.../download.aspx?FileID=623605&FileVersionID=-1

https://cygnus.cc.kuleuven.be/bbcswebdav/pid-9468873-dt-content-rid-5069220_2/courses/a-F0SY7a-1213/Course Documents/.../Optical_1.exe

https://cygnus.cc.kuleuven.be/bbcswebdav/.../xid-5069220_2

http://www.matthewroddy.com/.../optical.exe

Scan optical.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.