home

postal.exe

The program is a setup application that uses the Wise Installer installer. The file has been seen being downloaded from s7896.chomikuj.pl and multiple other hosts.
MD5:
30b15044a50e8ff940987e4785b0cd14

SHA-1:
c5db8e1ca0353dc4fb033f6f3f51547a9aebc78a

SHA-256:
385c7907d7c254395ac52a3d09179ad2c041d91104306c00d6e27b1e7a7e99e0

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 5:24:34 PM UTC  (today)

File size:
570.6 MB (598,340,473 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Wise Installer

Language:
English (United States)

Common path:
C:\users\{user}\downloads\postal\postal.exe

File PE Metadata
Compilation timestamp:
10/25/2001 8:47:11 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12582912:z8hXSi7WAMMf+SQF7PFtVhIf7N9qfUKQK7hiHX2abQUL7k5rtQZq:w77WHPS8dhIfC8KQK1gmMRwXsq

Entry address:
0x21AF

Entry point:
55, 8B, EC, 81, EC, 2C, 05, 00, 00, 53, 56, 57, 6A, 01, 5E, 6A, 04, 89, 75, E8, FF, 15, 54, 40, 40, 00, FF, 15, 50, 40, 40, 00, 8B, F8, 89, 7D, F4, 8A, 07, 3C, 22, 0F, 85, CC, 00, 00, 00, 8A, 47, 01, 47, 89, 7D, F4, 33, DB, 3A, C3, 74, 0D, 3C, 22, 74, 09, 8A, 47, 01, 47, 89, 7D, F4, EB, EF, 80, 3F, 22, 75, 04, 47, 89, 7D, F4, 80, 3F, 20, 75, 09, 47, 80, 3F, 20, 74, FA, 89, 7D, F4, 53, FF, 15, 6C, 40, 40, 00, 80, 3F, 2F, 89, 45, F8, 75, 64, 8A, 47, 01, 3C, 53, 74, 04, 3C, 73, 75, 06, 89, 35, 58, 53, 40, 00...
 
[+]

Packer / compiler:
Wise Installer Stub

Code size:
8.5 KB (8,704 bytes)

The file postal.exe has been seen being distributed by the following 16 URLs.

http://s7896.chomikuj.pl/File.aspx?e=8TUO-dFcHbt-cIDTrdkItw2ODU9LMcYjTvbH3OosWNtaLgLYss-DHGc_jNw0dj3g99u3tek_eIrb9fC8aExhyW1663EAje2hwXfvh-LcP_vl9qrsjVMxFv5D-d_DWCOMkCuGD5dOnpX3Ay--BzVqJQ&pv=2

http://s7896.chomikuj.pl/File.aspx?e=H2Z8Y1Edysfa9ev9dtXEKLUCT83MtZOUTkNTIK_ASjLko3BIl65uGSTzM3q0HrB3vDc8l_9JpxPG4l0tKZdI5R53W2OIUa27i1S6nC6rEFMTBo0zpquGNPU0q7i7RmroLHoIKkiYzE6lmbFJyqPgMA&pv=2

http://s7896.chomikuj.pl/File.aspx?e=8TUO-dFcHbt-cIDTrdkIt18fX7yZMC19sddJzpuMcS2fgXqwn6JYpGClOzzf-Ir9L7qEnnAytLkuv_4oox9UT2W1hukR2igE5_65A5TLjQ0xeJ1Td6UMxg-ROzT0BwuCm-wZTYN3ZyftYeO86Mr6OA&pv=2

http://s7896.chomikuj.pl/File.aspx?e=H2Z8Y1Edysfa9ev9dtXEKFXUJXFdS2cmkzOGCAJnOd2CtLLCSeBHhOaQf01ia6k5ubzpNKz85Ipubb_I4UDOlDwsjaL3vWPOszPSq_3AVo5V_dTmOLwoitqP0Lsgq6PTJyn4y-odJXN4-bA9DF3wFA&pv=2

http://s7896.chomikuj.pl/File.aspx?e=8TUO-dFcHbt-cIDTrdkIt2SCN086j50Q7bzhekGec82DskOs_Xt9msRlei4rkwQEmpr74QLjqWiEflYn4QL_3Cl0Lbca75c08oN9bPDbirpJ8v78eLzqTKHsIz6NCZJt3Fp-XgRKN_axPugQKl73qA&pv=2

http://s7896.chomikuj.pl/File.aspx?e=8TUO-dFcHbt-cIDTrdkIt78MTeX-emlswbN6K3WefBRYa_huan5MszUzRnXMRmkpvgLN7skBI_W0l9rrpPCpW6jkdZrYVQt1rHF5hsXcsrKrutkGXVJofI-ud1OVZ3wa5ifIVwNSEFH-WUlIFC1HEA&pv=2

http://s7896.chomikuj.pl/File.aspx?e=8TUO-dFcHbt-cIDTrdkIt1rUTghGZ7pz-22jArp01BJVdF89pcSzMFO-b1jNhexlWjSlwr7O2ipFcDwFTOvz9MjP18g_NeCpzNn-fNPwrXpKyo6vjfXv5Cdq-7ktTozySwx_8puhgoqKI2jFxn7egQ&pv=2

http://s7896.chomikuj.pl/File.aspx?e=dZKsxy16tvXOFlTFztQ8O_MYL1wkN5vW_bqeL7nKFGaqydrTDD_IMWwI8x74lGXJcs91Q-bBVeFyyfk37p-CJmXCDgNI_4_zjcQAM1dr9m1pr_LUUzrxc0yKDilsdqHNcMr0lYQ8no-kivVGeWJ5ZQ&pv=2

http://s7896.chomikuj.pl/File.aspx?e=dZKsxy16tvXOFlTFztQ8O2su12WKD54zz7fgMt7SBmyLshblNQWUlqvJGifKHCxSWRbOKSVHFx4_diOSkAG7npfWLyaODUS5_5xrqH0QqcdQPhOpNq3aaerIIQx9qxKZeCG1zcpoiSuaY6CDdtdJIw&pv=2

http://s7896.chomikuj.pl/File.aspx?e=8TUO-dFcHbt-cIDTrdkIt1PQgqBCJbHaDZOaZ1-I8q8Z7DxmQMFni45U0z6E5Jy5vtCEYuT4udSuXF8NnEfm0jIuie5it0YS9Ah-uv0Pf-hGIkPiOds-WowEDJhjkTB828s1dRcSLnYBkbO2FCFU7g&pv=2

http://dla.uloz.to/Ps;Hs;fid=35349288;cid=936796121;rid=1028244818;up=0;uip=89.69.188.225;tm=1458225597;ut=f;aff=zachowajto.pl;did=ulozto-pl;He;ch=db79c5e676227796afb84aeba97e69d5;Pe/.../postal-2-pl-exe?bD&c=936796121&De

http://s7896.chomikuj.pl/File.aspx?e=8TUO-dFcHbt-cIDTrdkIt2jF74ef0mxN1fTQ5fxWlcLOb1fVn0gxNva4pPx_5qt8FuQfETReB2wO7j1zUZZmJIRhau0xwXQhFQCIZN3QC8cMaygtyT9mXOMNYL62jyUpoJMfFmuKvMffjWvyOD12lw&pv=2

http://dc609.4shared.com/download/.../postal_2_pl.exe

http://s7896.chomikuj.pl/File.aspx?e=dZKsxy16tvXOFlTFztQ8O_343LzA-RBD2dERjmEOdztW6cukWh-se7CUfEEVNZQpM-gJklnhHmQKjf1vpn4abVMKDtXVDBUU0VZeKL6nq6gRY396cNRQez8uV97Xgum4Cs1UmC3RM79dAO3ZK-JVrg&pv=2

http://s7896.chomikuj.pl/File.aspx?e=dZKsxy16tvXOFlTFztQ8O8TqrL_pg-iUF6OGvyn9_TqqcLbMHQbD5MNXjjCNcESDlkYBqFO5CpbcjhRp043lxiik4jfVhpvkGqp_YfXk1I_MRRW0ZlJiVte6A5TVWT78AMSKDLkeZZGwqcbAqSQgOw&pv=2

http://dc488.4shared.com/download/.../postal_2_pl.exe

Scan postal.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.