home

pakistani-girls-mobile-data.exe

Girls Mobile Data

The executable pakistani-girls-mobile-data.exe, “Girls Mobile Data 1.5.8 Installation ” has been detected as malware by 2 anti-virus scanners. The file has been seen being downloaded from pops.ero-advertising.com and multiple other hosts.
Publisher:
Girls Mobile Data

Description:
Girls Mobile Data 1.5.8 Installation

Version:
1.5.8

MD5:
680c13b8ffe153cfcf2b66fff12fa0fa

SHA-1:
d688c1f30849e88111bcf567d3851c5bfffa347c

SHA-256:
c66c49fdc3c22e35b093ce072c70a4a08d35b21f48c22218a48bcbeab1dd4757

Scanner detections:
2 / 68

Status:
Malware

Analysis date:
12/28/2024 12:53:45 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Detection.Undefined
7.0.302.0

Reason Heuristics
(M)
16.6.7.0

File size:
195.4 KB (200,092 bytes)

Copyright:
Girls Mobile Data

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\pakistani-girls-mobile-data.exe

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:zZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6XmOwl:lANwRo+mv8QD4+0V16XVE

Entry address:
0x25468

Entry point:
55, 8B, EC, 83, C4, F0, B8, 88, 53, 42, 00, E8, 24, F2, FD, FF, B8, C8, 54, 42, 00, E8, 2A, 1C, FE, FF, 8B, 15, 40, 88, 42, 00, 89, 02, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, 48, 88, 42, 00, E8, E4, D3, FF, FF, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, DC, 87, 42, 00, E8, 7A, 64, FF, FF, A1, 40, 88, 42, 00, E8, AC, 4E, FE, FF, E8, DF, E0, FD, FF, 00, 00, 00, FF, FF, FF, FF, 01, 00, 00, 00, 2A, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.6074

Developed / compiled with:
Microsoft Visual C++

Code size:
145.5 KB (148,992 bytes)

The file pakistani-girls-mobile-data.exe has been seen being distributed by the following 8 URLs.

http://pops.ero-advertising.com/popads/logview.php?spaceid=1990126&siteid=81088&xref=TFA0UnvQFLWe6BWfOztHduapa4i5JM1XtBwRjJEIryH1a FHe0mUxsL7nRrKK/gl0S4lZRNCHGbaU2VpoZTTgW/7m6cAJRHN rCDJA/R0Bs4hmLYe12dXs4M3QVrUy7whASb olmHBECAYTl60 fLTo/veUt03G5N TXpU0UCLjNa6oY56m5FsSbpsBWpnBvs7bgeNpkxwQeTWY/IbsjRcxYL5whMFfdaq7iIh92ZIU0GTLMs9c JPVQZh2PW1wTdvoR96RRBj/.../APCwg58cYXjxDLVI9kyoKUATo9U1rEbbCags17ado8u33voJLOdlse6xRw1iHb4HlfYWSxeFtobNapUyZxak=

http://pops.ero-advertising.com/popads/logview.php?spaceid=939679&siteid=83919&xref=UAKj6ZgFDcA drlBN8AbGFzVIRW2E24NGYDFhnEAhwwuNNKfsbITBp WeNSYKuoUWyJsdPDcZplX0YhwJUAVlrCDxleRce/YFKrvSVymdmV/VCV VrMhHSxAW/yEiM9HxpA//5 ds/2TcKql2uZsxBb0qcjNUM5/ebgv7ZzgjULHGfegZJyhrrVb0Uv9DOcwDj69hqoBJIu3XcfYz cZP MiQbjoG/QPS/.../ BMC00sQdQ=

http://nl2.ero-advertising.com/popads/logview.php?spaceid=2027085&siteid=101506&xref=kRaVOKD3qAnrwHdAPC0aOcnPrz7dILkfJgRoRzCrA9hPG5dFN8AWY7JzBVtTRz7P DqIJAMPOUkfjMIrcrR0PpzsriNxRjqhvm2dLmYGvx4M1AfQHgF8MIVjEFhUk9pO7tGBNYZqvvH8KtJ5VPp3YjlME9w5s902ywjRE3COLvkrM5ukcUXuhQxLhPU1V N L8rPO470m6xnLwfBA8kfxjVZ AJvEO4IjbExxPP9fpxfp02lKHah8xsU876mzJbM0lChfEgpG NgZjn/i44z6GmPp41F96KIa/.../2hOXgsYz Lw9Q==

http://nl2.ero-advertising.com/popads/logview.php?spaceid=2005875&siteid=96912&xref=yQjbWeBIzA0nAktfLxb0AxMmWkTJw4fJ6lwRYHRv 54UWG3my5OBuKHr7uYG34HoouHwMwQbVHCMVb7Rt2gksbMk3E1P/b5dOWw4dbGqbMzkJqketLyCv/U7KkjnKd5LvLxd59K9W9zcujHyb12xPQb9Su/K7vVfc3DSNvmqjEyZ1sodGmCYeESZvg4o4Awy0UCNOvlcLl5PZ6BOe78Lwq0TEQIFGZOhkCzcbDQMGFebc20i6Rq7e8uZjMpw2t1UIMZktWpFwxTITngFv680kS5vg8SvsWdiZ0bJ/.../n1wA3nRqkJWqGEs1qiCQv13PRAjbx7fGcAbZz21jAnBE4eiiHJOjyX64W7r5xQVjn7GkQ91

http://pops.ero-advertising.com/popads/logview.php?spaceid=1978999&siteid=83919&xref=ToXsh2OLEoI4jgaNGD4qDiLbs cUercd8chGZKzetTdWdzE14xxIFT64k3mDkGzmvlU8uu/lsKrBn4sGsfHbJ9xpTyJl5szezgYUXX1qeH2Y9hXE3ei3TKD/V5HVG2TCZzCY8UtpUiE4ckxTMJWy03AuI8ZAwVYBANHtt/fkSzEC3sx1AyOmxMXRn6MqguuleORtCWzstHNMB72lVDenENn66xp1fhWvM2UrPz UCcbgUiPSkgl6sliDFjVScA1GNwkt1kPWbwtC96HPY6cU4yl3f1mvrGwQlDE6W3xyIdVIrz1XU5ovm vUKFMGJ/.../E8KTiW7zveuy1QIUmnOPlRL3DFQ5KxcAAsD0f9eCXUE=

http://nl1.ero-advertising.com/popads/logview.php?spaceid=2034667&siteid=103297&xref=pVM aO65KOI9Ahy6kg4yn7pkK7DsVxnfWn7Ur7CLmYWeEvM67gHzRIhWMVPOHgUT5X7TqneE3cb3/FyHcS/T5pHmiX7lszaAuLTmghxwQi28kKa1h55l/n2nOelSD12jgJucTrjwoeJ5SB6VHuPt8g15rENlTqGH0YH92zeeBjPVFwd5fW7zxAXyIXoPh4Vyp5He6lnFRg7 1K0/wX5fz9uvnt6XBa NszoDzvrJrESVl2wRnXZowb/.../QeJbAcdY=

http://www.pakistan-dating.info/.../Pakistani-Girls-Mobile-Data.exe

http://pops.ero-advertising.com/popads/logview.php?spaceid=362978&siteid=83919&xref=AdLUGjz9ilmh7tR8K8A pIXT1g0g5SbCnkWijQ8LZf11xA0aF/p/Z2HZFLccbvSqvAkg8Td4KUoqF8OcCvArfHJxnqPCwRaNNc i4FZLPSe0Y78HLOH3Na00ikYrWnz68h/iMxsDpu4pH0dSWMxRJO N/.../4YCp8dzRsv0nEf7SUOykOIrczZup9zA0RTotjIji1nphr Gqy2sUf2J8IA6pJ31tvt7DSQ6glm9lRNUOB8=

Remove pakistani-girls-mobile-data.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.