home

sovereign-vubek.exe

Fancy3D Launcher

Hongfeng Hengyu (Beijing) Tech Ltd.

This is a setup program which is used to install the application. The file has been seen being downloaded from admin-dzz.top1game.com and multiple other hosts.
Publisher:
Hongfeng Hengyu (Beijing) Tech Ltd.  (signed and verified)

Product:
Fancy3D Launcher

Version:
0,16,0216,1513

MD5:
e01c03e3c60bab83805683dc3692bead

SHA-1:
ce8f5967d80daeb023fe3d572fb3a38821207ce1

SHA-256:
a4c017ab99aeb1817843a937b196b4093238f44b3569528665bfd6048deadb06

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 10:39:44 PM UTC  (today)

File size:
2.8 MB (2,979,360 bytes)

Product version:
0,16,0216,1513

Copyright:
Copyright (C) Hongfeng Hengyu 2009 - 2015. All rights reserved.

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\sovereign-vubek.exe

Digital Signature
Signed by:
Hongfeng Hengyu (Beijing) Tech Ltd.

Authority:
Symantec Corporation

Valid from:
4/15/2015 8:00:00 AM

Valid to:
5/15/2017 7:59:59 AM

Subject:
CN=Hongfeng Hengyu (Beijing) Tech Ltd., OU=Technical Department, O=Hongfeng Hengyu (Beijing) Tech Ltd., L=Beijing, S=Beijing, C=CN

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
473F8E478165FF553417B8D75AF47788

File PE Metadata
Compilation timestamp:
2/16/2016 3:13:11 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:e/s50PBZxYsDTsEJ9pGFMQLvf/3ndNJMx3JjuufrVk8P:2DBZxYsr9/ivn703JqufrVk8P

Entry address:
0xB326B

Entry point:
E8, 1D, 76, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 57, 56, E8, FC, 77, 00, 00, 33, FF, 59, 3B, F7, 75, 1D, E8, FB, 17, 00, 00, 57, 57, 57, 57, 57, C7, 00, 16, 00, 00, 00, E8, BA, 77, 00, 00, 83, C4, 14, 83, C8, FF, EB, 34, 39, 7D, 0C, 74, DE, B9, FF, FF, FF, 7F, C7, 45, EC, 49, 00, 00, 00, 89, 75, E8, 89, 75, E0, 89, 4D, E4, 3B, C1, 77, 03, 89, 45, E4, FF, 75, 14, 8D, 45, E0, FF, 75, 10, FF, 75, 0C, 50, FF, 55, 08, 83, C4, 10, 5F, C9, C3, 8B, FF, 55, 8B, EC, 56, 8B, 75, 08, 8D, 45, 10...
 
[+]

Entropy:
7.7181  (probably packed)

Code size:
926.5 KB (948,736 bytes)

The file sovereign-vubek.exe has been seen being distributed by the following 46 URLs.

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:7486273&platform=top1game&gkey=dzz&skey=5014&time=1465912574&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=75b236612de93e76ceb3c3ed1f57607e&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:502317010&platform=top1game&gkey=dzz&skey=5023&time=1468930995&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=90e35e66943c9c02fd8550dc70b358b9&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_gtgv657564&platform=top1game&gkey=dzz&skey=5027&time=1471056869&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=59d39889cfb4d4ce4224131b84745f32&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:17361845&platform=top1game&gkey=dzz&skey=5015&time=1466309787&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=4b41ad7eb6fd03a8d48059ef020746db&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:11429803&platform=top1game&gkey=dzz&skey=5008&time=1463812325&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=3950090fb409d7afb04d1dc015eb6612&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_cfun9@yahoo.com.tw&platform=top1game&gkey=dzz&skey=5018&time=1468038274&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=7a0f28701bb221b8ffa03c335785c896&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_raid:5289144&platform=top1game&gkey=dzz&skey=5002&time=1461594392&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=d4427dbd19693a37bb4e47f937c5f9a1&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_yhtw:104787101&platform=top1game&gkey=dzz&skey=5029&time=1475076158&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=2dcfc5f67a4413a6d9fc7baf518c96ff&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_camanejia&platform=top1game&gkey=dzz&skey=5029&time=1478732032&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=4102f90de31dfa914777d8a1c1ba42ec&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:19541385&platform=top1game&gkey=dzz&skey=5028&time=1472353964&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=a640ca551728c3e01071b530e7af3dda&w=588&h=117

http://res-dzz.top1game.com/mclients/.../Sovereign-tuyow.exe

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_40087031&platform=top1game&gkey=dzz&skey=5026&time=1470191049&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=3e154cbb640ec0e80e30c44f816c252d&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:101592055&platform=top1game&gkey=dzz&skey=5020&time=1467937179&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=2ee8a8449e9571f78ca3d0a098b95a39&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_zxc6553432&platform=top1game&gkey=dzz&skey=5001&time=1466107607&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=412a95e9b9b6dcbac4e9a6bc3c5e2df8&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_joya51240@yahoo.com.tw&platform=top1game&gkey=dzz&skey=5029&time=1476024600&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=ce4bc4985bd0c83c67bda4f4ff63f88d&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:500248092&platform=top1game&gkey=dzz&skey=5014&time=1466070639&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=4a53d86f08952705d4cd8576ce0957ff&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:5709497&platform=top1game&gkey=dzz&skey=5007&time=1463325150&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=0aebc96cf71a8c23eddff92f72d08921&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:17001638&platform=top1game&gkey=dzz&skey=5005&time=1474429770&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=ab8f5dc669f0a6567c75e22228b3d1e2&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:1913865&platform=top1game&gkey=dzz&skey=5022&time=1468662957&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=2be26b64fa4496e5b3c71c9ea194267a&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_s9514448&platform=top1game&gkey=dzz&skey=5021&time=1468153876&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=f427db2c8a993686e50d4820316d02f8&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_ppp49032&platform=top1game&gkey=dzz&skey=5024&time=1469110926&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=b1cddd0100286021ac1ec06db0c8dc2a&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_yhtw:13303575&platform=top1game&gkey=dzz&skey=5024&time=1469150309&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=8f25d5d31f72c417752bef8478ed0c0e&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:19460976&platform=top1game&gkey=dzz&skey=5025&time=1469879803&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=8def322c3873be520475adb392bc2188&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:11177743&platform=top1game&gkey=dzz&skey=5020&time=1468001654&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=ed634716386987e11de36a597419396c&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:1334275&platform=top1game&gkey=dzz&skey=5021&time=1469248489&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=93823931b3fba476e330cfeb3bb85119&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_yhtw:502525190&platform=top1game&gkey=dzz&skey=5026&time=1470705286&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=78dc138ae358766cbf8d34d7cc575308&w=588&h=117

https://admin-dzz.top1game.com:8887/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_fcbk:17467085&platform=top1game&gkey=dzz&skey=5007&time=1463207440&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=28cb224eecd07f946757c2972534b949&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_jade1031&platform=top1game&gkey=dzz&skey=5001&time=1461313736&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=208ec764e3fb587b480311f67d8dd43e&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_gogl:21793376&platform=top1game&gkey=dzz&skey=5002&time=1461591210&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=f4fca9371c836a2590dbffebdb37e679&w=588&h=117

http://admin-dzz.top1game.com:8807/?t=dl&pf=gm99&s=http://admin-dzz.top1game.com/.../dzz.html?pscode=&uid=gm99_coolmanx0409&platform=top1game&gkey=dzz&skey=5013&time=1465634006&is_adult=1&exts=&back_url=&type=web&bind=00&pf=7&sign=b66be5ec1da8297d06ebbc685e01240c&w=588&h=117

Latest 30 of 46 download URLs

Scan sovereign-vubek.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.