home

prorrbox.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from qfs.mobi.
MD5:
80507f89f0147a5eb3b3243579d32741

SHA-1:
4b5824e474a3ce0fd199c9c55577d454b57790a1

SHA-256:
1280e14c453fa2f3c55b046aea2bad8859688390e3da15a038b695eb31e16f20

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/15/2024 3:34:48 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.MulDrop1.46416
9.0.1.05190

File size:
413.3 KB (423,180 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\Local settings\temporary internet files\content.ie5\{random}\prorrbox.exe

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:/77bkLloSN/ywUGOofledZmC1L0xTje4W9bzNyQaRx:/776loSN/ywUGjdedoCdWjSlzNyQaRx

Entry address:
0x15EF

Entry point:
55, 8B, EC, 83, E4, F8, 81, EC, 44, 04, 00, 00, 53, 56, 8B, 35, 00, 30, 41, 00, 57, 68, AC, 10, 40, 00, FF, D6, 68, C8, 10, 40, 00, FF, D6, E8, D1, FC, FF, FF, 8D, 44, 24, 10, 50, 33, DB, 53, FF, 15, 04, 30, 41, 00, 8B, C8, E8, D9, FC, FF, FF, 59, 8D, 44, 24, 14, 50, 6A, 18, 8D, 44, 24, 20, 50, 53, 89, 9C, 24, 4C, 02, 00, 00, 66, 89, 5C, 24, 40, FF, 15, 08, 30, 41, 00, 50, FF, 15, 00, 20, 40, 00, BF, 00, 00, 00, 80, 23, C7, 3B, C7, 75, 1B, BE, 10, 20, 40, 00, 68, E0, 10, 40, 00, 8B, C6, E8, 8E, 02, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
4 KB (4,096 bytes)

The file prorrbox.exe has been seen being distributed by the following URL.

http://qfs.mobi/downloadCached.ashx?k=e1a8b780f9d04520bcdc32b61f652025&f=3273687

Scan prorrbox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.