home

photocap600_ch_big5.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from onedrive.live.com and multiple other hosts.
MD5:
a288b1839b111263359ccb283f481395

SHA-1:
24eea2ccb6b193494cc78b4da09e83276f0888bf

SHA-256:
79cc4283f3201789c978bc7d9d0ce66ff5c06262080cfcd926a5fecf50d5c7cc

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/28/2025 6:48:44 PM UTC  (today)

File size:
14.9 MB (15,664,223 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\photocap600_ch_big5.exe

File PE Metadata
Compilation timestamp:
6/9/2012 9:19:49 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
393216:lPcWGKpfVKNi+fGQo04Z7ro9jrleiKYSCPj4KWvr9EcFn:lUfmtEUPgwiKNI4tj9Ecd

Entry address:
0xAC87

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, 9F, 30, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, 8F, AB, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 24, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 24, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, 0E, B1, FF, FF, C3, 56, 8B, F1, 8B, 06, 85, C0, 74, 07, 50, FF, 15, C4, 40, 41, 00, 83, 26, 00, 83, 66, 08, 00, 83, 66, 0C, 00, 5E, C3, 56, 8B, F1, 80, 7E, 04, 00, 75, 34, 68, F4, 44, 41, 00...
 
[+]

Entropy:
7.9986  (probably packed)

Code size:
73 KB (74,752 bytes)

The file photocap600_ch_big5.exe has been seen being distributed by the following 25 URLs.

https://onedrive.live.com/.../7RtFY0wreb5aSMSbKZmNN8WxSbcGuc6W mA=3&ithint=.exe

https://doc-0k-4o-docs.googleusercontent.com/docs/securesc/miijqerra817vo7pl4h4useit4e4f7ig/jo907k2rmhe8qd4f91616tjb4m6ki10l/1473048000000/.../07430017117525018838/0B3sqLYX-wOsEQ1B5akhJRlJ1Rmc?e=download

http://61.222.3.60/c2dfcd765ed32532e767135bf4a3d5db/softking/soft/sale/.../PhotoCap600_CH_BIG5.exe

http://file.gdaily.org/.../swvf

http://ecampus.cgust.edu.tw/ECAMPUS3P/.../common_view_standalone_file.ashx?AttachMediaId=74e34a04-c47d-43cd-95bd-bde9c2b6d024&CourseId=7d51bb9f-5776-4f2f-9250-6a3a106bf157

http://163.20.6.18/moodle/mod/.../view.php?id=209

http://140.127.56.88/nknuz1/0teachet/.../PhotoCap600_CH_BIG5.exe

http://120.104.227.200:5000/.../PhotoCap600_CH_BIG5.exe

https://fs03n1.sendspace.com/dl/61ede328ff17c0991f62eeee3e1b124e/5652d6ea62d33e14/.../PhotoCap 6.0.exe

http://192.168.1.88/PhotoCap.exe

https://mega.nz/temporary/.../jBBRDAqK

http://feam.scu.edu.tw/.../PhotoCap600_CH_BIG5.exe

http://61.222.3.60/dbafa803e562c6b3eac79c99ad89bc95/softking/soft/sale/.../PhotoCap600_CH_BIG5.exe

https://mega.nz/persistent/.../jBBRDAqK

http://61.222.3.60/29e21865ab87462167d32d6c09274125/softking/soft/sale/.../PhotoCap600_CH_BIG5.exe

http://123.briian.com/forum.php?mod=attachment&aid=MTgxMXw2OWE0NzliOXwxMzk1NDQ5ODM2fDB8NjE2

https://doc-0o-0g-docs.googleusercontent.com/docs/securesc/hgsppibai9mh25go0co07pv2ofegqvr7/2il4384d6ct509g9l3erudgl93k40b2e/1396591200000/07780992621456238464/.../0B1_STgPQEMn4SUt4MkZRSzNBQ2M?e=download&h=16653014193614665626&nonce=laqf9l3vhigh0&user=08980107217605902915&hash=rnb4goglv12jqmm9p2fd9voib68osntp

https://docs.google.com/nonceSigner?nonce=laqf9l3vhigh0&continue=https://doc-0o-0g-docs.googleusercontent.com/docs/securesc/hgsppibai9mh25go0co07pv2ofegqvr7/2il4384d6ct509g9l3erudgl93k40b2e/1396591200000/07780992621456238464/.../0B1_STgPQEMn4SUt4MkZRSzNBQ2M?e=download&h=16653014193614665626&hash=80ulnrcb5dovqmtqqdtt6406fvg6lfbt

https://doc-0o-0g-docs.googleusercontent.com/docs/securesc/hgsppibai9mh25go0co07pv2ofegqvr7/2il4384d6ct509g9l3erudgl93k40b2e/1396591200000/07780992621456238464/.../0B1_STgPQEMn4SUt4MkZRSzNBQ2M?h=16653014193614665626&e=download

https://docs.google.com/uc?id=0B1_STgPQEMn4SUt4MkZRSzNBQ2M&export=download

https://docs.google.com/uc?authuser=0&id=0B1_STgPQEMn4SUt4MkZRSzNBQ2M&export=download

http://myweb.feam.scu.edu.tw/.../PhotoCap600_CH_BIG5.exe

http://yuren88.sg1013.myweb.hinet.net/.../PhotoCap600_CH_BIG5.exe

http://fs03n1.sendspace.com/dl/7b9cb1dabf2adec1d896c138d4aea7c2/52a34d2c34b0e5db/.../PhotoCap 6.0.exe

http://yuren88.myweb.hinet.net/.../PhotoCap600_CH_BIG5.exe

Scan photocap600_ch_big5.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.