home

papers, please pl v1.1.exe

Papers, Please PL

GameSub

The executable papers, please pl v1.1.exe, “Polonizacja gry Papers, Please” has been detected as malware by 1 anti-virus scanner. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from s6588.chomikuj.pl and multiple other hosts.
Publisher:
GameSub

Product:
Papers, Please PL

Description:
Polonizacja gry Papers, Please

Version:
1.1

MD5:
b5a5aec6064f2ceec458338a78e93416

SHA-1:
deabe7a8d2918202deae8c5c5c5072b4a4acd27f

SHA-256:
130c72e954ddbf7127e64133f23f50adb88b8eca172d6c09dea22725daa5b67a

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/16/2024 3:26:34 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
15.12.13.15

File size:
1.6 MB (1,727,936 bytes)

Product version:
1.1

Copyright:
© GameSub

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Polish (Poland)

Common path:
C:\users\{user}\downloads\papers, please pl v1.1.exe

File PE Metadata
Compilation timestamp:
7/14/2013 10:09:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:qIVoZbhU0pLIHB9DPIi4X7aSn04akYNFTO6S:vkbO6LmB9DAi4raYjKFo

Entry address:
0x31B1

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 14, C7, 44, 24, 10, D8, 92, 40, 00, 89, 6C, 24, 1C, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, 34, 71, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 58, 92, 42, 00, E8, 95, 2E, 00, 00, A3, A4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 58, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, C0, 92, 40, 00, 68, A0, 81, 42, 00, E8, 00, 2B, 00, 00, FF, 15, 38, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, EE, 2A, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file papers, please pl v1.1.exe has been seen being distributed by the following 6 URLs.

http://s6588.chomikuj.pl/File.aspx?e=hEE2ZUWAmdOc93MCI827JehEmEnUuAKIUKfv8zyi7pYnZJZuVPoHjZTOoL0MrsLsCNciBDM70Y6l2yDzHIdKLiw-UqCIPA940eq81u_Xyh0cCIqwn35XjcFKSTLgA8nDA8Kwt3cOtsz84MYHUV1A1akH9o4Jx6NfZfEhr-uFqAc&pv=2

http://s6588.chomikuj.pl/File.aspx?e=hEE2ZUWAmdOc93MCI827JehEmEnUuAKIUKfv8zyi7pbL1SwrJKAJhx2xeovcubGlUiUnKLRKoc0p3CrwOTtZnRb8KKE-UV7mr223qghztdhZJjQf6asFjbqfpok--xQogW0jgbYj4Wj33LvTmmSG8lQD5z1Sz4d5uuDz3UycDRM&pv=2

http://s6588.chomikuj.pl/File.aspx?e=hEE2ZUWAmdOc93MCI827JUg1QzZ1LYp7lGcUO19lf_cvr1Crxri9iAWVS8FBUjpDEKQEOKlLddz04lMnnatcGDUXgMR4L7wh41s8qd7fa9GIyyhtCQPQvM-h-a2S78N6c7aj8Y7oqJdb5FPqUZxD-XJ3YW5AHVRieAQgKiCBN18&pv=2

http://s6588.chomikuj.pl/File.aspx?e=hEE2ZUWAmdOc93MCI827JdAeBpGnZraeiMuG5iTcoVCFIoMaQtTsP9IKlzkfl-H80MUTDHMfarK1HVh_CqdDPYMK9ZbwZwZMYV17gPMPXTnEwua2RhgCq_2gPAwbLgilqvY82HcSwW-4PaCTQqWlvnSjQxi4wMflUsd2XnPbhLk&pv=2

http://s6588.chomikuj.pl/File.aspx?e=hEE2ZUWAmdOc93MCI827JdAeBpGnZraeiMuG5iTcoVClHs3g-o-MWZJIQFREmtBvTg828H-1Y_R10Ek9iNQfL-zGmf1mUzlerPaMKYrsrGE3_IHFs0s8iY0GILBHxYFbkT7L2ySNmDfPpuZT_ifcPOqHORFP9-jXq5TAojhQwIE&pv=2

http://s6588.chomikuj.pl/File.aspx?e=hEE2ZUWAmdOc93MCI827JdAeBpGnZraeiMuG5iTcoVC8v8Of_DbRqBqJ4GF5Y4uxOguC8hlnpxCSGlSLxydbRMO5SOfhnvaulhC7HOYA5QVSD-lJ-DD73ti_xLHYtA27OKD3Jd7dqnMtFx6n3PkYvJuC-hQH1GOCf0j9tampVhc&pv=2

Remove papers, please pl v1.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.