home

ragex by double v.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from www.unknowncheats.me and multiple other hosts.
MD5:
dd54be85d92661953d75596db308ae42

SHA-1:
109815dc7aba9258a6dfe3b262ae83d4206b708d

SHA-256:
93fa9d4edb0b2dd66e91008f691b5442b43913279d892e9a7d9395ae710bdaec

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/30/2024 11:34:15 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Win32.Virus.Lamer
4.0.3.1643

File size:
208.5 KB (213,504 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
4/2/2016 8:14:03 PM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:mZs9UcgQLsX4fsJ2qxSGey1idj8UhZHomS6MaLn1:mZNcgQ4txSGey1idj8vK

Entry address:
0xEB08

Entry point:
FF, 25, 70, F1, 40, 00, CC, CC, 8D, 4D, 08, E9, 3D, DF, FF, FF, 8B, 54, 24, 08, 8D, 42, 0C, 8B, 8A, F0, FB, FF, FF, 33, C8, E8, 2A, E1, FF, FF, 8B, 4A, FC, 33, C8, E8, 20, E1, FF, FF, B8, E0, 29, 43, 00, E9, 26, E1, FF, FF, 8D, 4D, 08, E9, 0D, DF, FF, FF, 8B, 54, 24, 08, 8D, 42, 0C, 8B, 8A, F0, FB, FF, FF, 33, C8, E8, FA, E0, FF, FF, 8B, 4A, FC, 33, C8, E8, F0, E0, FF, FF, B8, 0C, 2A, 43, 00, E9, F6, E0, FF, FF, 8D, 4D, 08, E9, DD, DE, FF, FF, 8B, 54, 24, 08, 8D, 42, 0C, 8B, 8A, F0, FB, FF, FF, 33, C8, E8...
 
[+]

Code size:
56 KB (57,344 bytes)

The file ragex by double v.exe has been seen being distributed by the following 3 URLs.

http://www.unknowncheats.me/.../downloads.php?do=file&id=17075&act=down&actionhash=1459856177-52cbe31470715423a6a2f0c252c39126f8cde28b

http://www.unknowncheats.me/.../downloads.php?do=file&id=17075&act=down&actionhash=1463865976-e5511d80616fda04bd4ced09c56fb5aef9d3f57d

http://www.unknowncheats.me/.../downloads.php?do=file&id=17075&act=down&actionhash=1460239995-8bf13c92f3c1eb9a73b94a1d6c9fb43d127e62d5

Scan ragex by double v.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.