» raidcall_v7.2.0.exe
Overview
Analysis
File Details
Downloads (12)

raidcall_v7.2.0.exe

KORAM GAMES LIMITED

The application raidcall_v7.2.0.exe by KORAM GAMES LIMITED has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from yandex.ru and multiple other hosts.

File name:

raidcall_v7.2.0.exe

Publisher:

KORAM GAMES LIMITED (signed and verified)

MD5:

0cd2dc2019cd3f755dc7083f74d76ff0

SHA-1:

6d9893455d8acaadabf115bb37c89f47f95884b0

SHA-256:

a43d6673970832d8a636a42a97c4aafc2f09aad6f7428fa6dc4b1aa65a7f9714

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/23/2024 9:22:06 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Optional.KORAMGAMESLIMITED.N

14.2.28.17

File size:

5.3 MB (5,519,560 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\raidcall_v7.2.0.exe

Digital Signature

Signed by:

KORAM GAMES LIMITED

Authority:

VeriSign, Inc.

Valid from:

11/7/2012 7:00:00 PM

Valid to:

1/7/2014 6:59:59 PM

Subject:

CN=KORAM GAMES LIMITED, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=KORAM GAMES LIMITED, L=HongKong, S=HongKong, C=HK

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

6DE680510AEC828B17AC57B14D7A0CE3

File PE Metadata

Compilation timestamp:

3/21/2010 8:59:12 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

98304:ab1YBbDIdeWCUlcjqDeCbFGKF74fw8JBmITXAJcFcnl963n0krC3sK:a+BQdnCB2SWF14fw8McFcly0krC3sK

Entry address:

0x114F

Entry point:

E9, EC, 56, 00, 00, E9, 27, 96, 00, 00, E9, 72, 9A, 00, 00, E9, CD, 95, 00, 00, E9, E8, AA, 00, 00, E9, C3, BA, 00, 00, E9, 5E, 9B, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC... 
[+]

Code size:

57.5 KB (58,880 bytes)

The file raidcall_v7.2.0.exe has been seen being distributed by the following 12 URLs.

http://yandex.ru/clck/.../AiuY0DBWFJ4ePaEse6rgeAjgs2pI3DW99KUdgowt9Xsh9AmfW_e8f1kZrKMHHb2DNKl5wQi_vGuLWwnftLGFzX4Uob8oIRMLdLu22kUbFNFfClnsLcd3_wDChArCG3HWRNQ7jenXVPVztAcUmWklyLBjT39YlkwIdSgVWI_acfD9TIfn91C7z8Ds_BOVpiHk?data=UlNrNmk5WktYejR0eWJFYk1Ldmtxcy1kYUpFZU5tb0JhWGhYbE9MV2V6UTZLcXlPajlVcDlWdjc5amh5ak13NXRaWXZ1SWF3ODAwODdVVzBadFZjZ2dfQXRhX0F2SGloLW1TNWctNkNLYk5rTXh2R0dFMDltcFlOSVlrbWlGNGJORFFiX255SUJ5Yw&b64e=2&sign=d430e988c5751fa4b87060dacb489793&keyno=0&l10n=ru&mc=3.9754180179138325

https://dw.uptodown.com/dwn/HjeNwjlL_2IPEN3K4XBDRwMZxU_JeqTON_fQFxH02wYuxwwSIlwDRvWjWcDLIhbJR_ffY61sOeX_h3TKHLlbfJhf9jNLTMaTasmWESxw9Te2okN-aees0WH0fskwcaNd/HKV5G5BVsjOWXCi3pUow0gMI3qkhHzm-kYoBfRs8bbfiM5CTJC9onWUih7taVkJpAymj5MKkg22k1Y5U3v0B1F56Z6HgDD3GCJLu6yPF1p2B2wOy2y9OA8tHuAK08CMX/-HjoDxHu95V3kifXGAErGUfBPidkN4XZaTxyN0RMsbr3mSMsl9nrkppFCgc4ddkNUayOwB_XDPL6NddAZmApRwz0VZZlDcY8FV8AWPBU_wOgId9-sRvrwiprVy0MUfr-/.../

http://www.raidcall.com/.../raidcall_v7.2.6.exe

http://dw.uptodown.com/dl/1444496840/.../raidcall-7-2-6-es-en-br-de-win.exe

https://doc-14-ak-docs.googleusercontent.com/docs/securesc/bg2pjbdo6ir3ggaubrfinuuq8moq45om/l6ba2cgq99lf0mlb15c3tvk6ih1vb18q/1373256000000/07319053103943896182/.../0B3v_-2NfXqXJNUo1aW96V0RVcjg?h=16653014193614665626&e=download

https://docs.google.com/uc?id=0B3v_-2NfXqXJNUo1aW96V0RVcjg&export=download

https://docs.google.com/uc?authuser=0&id=0B3v_-2NfXqXJNUo1aW96V0RVcjg&export=download

http://www.raidcall.com/adsmtdirect.php?url=http://update.raidcall.com/.../raidcall.exe

http://files.brothersoft.com/social_communication/.../raidcall_v7.2.6.exe

http://update.raidcall.com/.../raidcall.exe

http://www.raidcall.com/.../raidcall_v7.2.2.exe

http://www.raidcall.com/.../raidcall_v7.2.0.exe

Remove raidcall_v7.2.0.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.