home

sokoban.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from api2.tenlua.vn and multiple other hosts.
MD5:
6cae0a0dfd4613b7ed57daa9bf18d621

SHA-1:
a8773681761273ab313b20ef160f54c43635bc0d

SHA-256:
360165e64935f3b7a3c4f293525cc93e0d3cadcf8e9095c8f5201332cb1176f2

Scanner detections:
3 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/27/2024 12:50:09 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Agent-ASVR [Trj]
2014.9-140327

Trend Micro House Call
PAK_Generic.001
7.2.86

Trend Micro
PAK_Generic.001
10.465.27

File size:
145.5 KB (148,992 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
4/17/2002 5:35:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.0

CTPH (ssdeep):
3072:beFvgTRNtAhMfi6EDM2HpsZIyEU2NQp9Sj8NDmBIXApWgPhErTA2XriTqxSx:mSNtNfGwmp4IVU6cc80BIwnhgS2Sx

Entry address:
0x65550

Entry point:
60, BE, 00, 20, 44, 00, 8D, BE, 00, F0, FB, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 19, 8B, 1E, 83, EE, FC, 11, DB, 72, 10, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 78, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11...
 
[+]

Packer / compiler:
UPX 2.90LZMA]

Code size:
144 KB (147,456 bytes)

The file sokoban.exe has been seen being distributed by the following 2 URLs.

http://api2.tenlua.vn/filemanager/builddownload/.../?hash=067dba7ca6552e464a6b6a3c6eaf6adc2a3da889b50aaa49b969c93fdf55460a622079f8e76d2fb11522f7f20d2e0c53443212dfbaf54e65765cc34ef480dd9fc691fd87d04890fefa2c3304f9108261c70a872ba4581d719c1c30cd713f0af8d539a40a1b0559a2dbc4a6431275b308a571b11c57062e21467770d883eff13ba19503222775f88f6f&url=0b3da36fa30172185e30306174fd75853636b390ad53eb4da0&down=0b3da36fa30172185e30306174fd75853636b390ad53fc55a0&jump_type=download&file=diendanbaclieu.netsoukoban.exe

http://www.vnschool.net/download/CHTH/.../Soukoban.exe

Scan sokoban.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.