home

setup-x86_64.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from 192.167.9.20 and multiple other hosts.
MD5:
c841603648d6fe6cd7c6676c9557adfc

SHA-1:
3589ad71eadbd177d836d33465ac1c9b90780cc4

SHA-256:
3b55c38796cb77d3fdab4101562bc350aa894ca7bda8dcef337c6abf0d10c4ea

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 9:38:28 PM UTC  (today)

File size:
850.5 KB (870,912 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\setup-x86_64.exe

File PE Metadata
Compilation timestamp:
9/30/2055 12:29:52 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:I/2oICGXeqGJXxhFOs3W2wYtZCNkXFCMuX94atIVd:I/DOXzOxh82bwYJXFqN4eIV

Entry address:
0x2AD8C0

Entry point:
53, 56, 57, 55, 48, 8D, 35, 5A, C7, F3, FF, 48, 8D, BE, DB, 6F, E1, FF, 48, 8D, 87, 9C, 25, 21, 00, FF, 30, C7, 00, 76, 7F, 03, 13, 50, 57, B8, D7, BC, 2A, 00, 50, 48, 89, E1, 48, 89, FA, 48, 89, F7, BE, 97, 38, 0C, 00, 55, 48, 89, E5, 44, 8B, 09, 49, 89, D0, 48, 89, F2, 48, 8D, 77, 02, 56, 8A, 07, FF, CA, 88, C1, 24, 07, C0, E9, 03, 48, C7, C3, 00, FD, FF, FF, 48, D3, E3, 88, C1, 48, 8D, 9C, 5C, 88, F1, FF, FF, 48, 83, E3, C0, 6A, 00, 48, 39, DC, 75, F9, 53, 48, 8D, 7B, 08, 8A, 4E, FF, FF, CA, 88, 47, 02...
 
[+]

Entropy:
7.9711  (probably packed)

Code size:
788 KB (806,912 bytes)

The file setup-x86_64.exe has been seen being distributed by the following 7 URLs.

http://192.167.9.20/moodle/mod/.../view.php?id=3059

http://ec.ccm2.net/ccm.net/download/.../setup-x86_64-2.0.0.exe

http://www.cygwin.com/setup-x86_64.exe

https://www.cygwin.com/setup-x86_64.exe

http://www.sourceware.org/.../setup-x86_64.exe

https://cygwin.com/setup-x86_64.exe

http://cygwin.com/setup-x86_64.exe

Scan setup-x86_64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.