home

stub4_install.exe

The application stub4_install.exe has been detected as a potentially unwanted program by 2 anti-malware scanners.
MD5:
551fb13534821fe932fb8a2fd4e45852

SHA-1:
7fea85f9d0aa7a1f87a795573f3e4a3f4513eab4

SHA-256:
7587c715eafa73e930c5b72aaa249613fbbcbd95e80199cf38a71d14c8f9047c

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
12/24/2024 5:21:21 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.17430
9.0.1.0280

Reason Heuristics
PUP.Downloader.SB4
16.10.17.22

File size:
214.5 KB (219,648 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\stub4_install.exe

File PE Metadata
Compilation timestamp:
9/21/2016 6:07:54 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:y2FHWr39UKYWUXRsKEyN7WuEtO5LSsalvvQPfHQQ/Nz:HF2ra1WUXRbEyN7TEtO5L1ahi

Entry address:
0xFE26

Entry point:
E8, ED, 90, 00, 00, E9, 79, FE, FF, FF, 6A, 0C, 68, 00, B5, 42, 00, E8, 50, 0F, 00, 00, 83, 65, E4, 00, 8B, 75, 08, 3B, 35, 58, 2C, 43, 00, 77, 22, 6A, 04, E8, DA, 92, 00, 00, 59, 83, 65, FC, 00, 56, E8, E1, 9A, 00, 00, 59, 89, 45, E4, C7, 45, FC, FE, FF, FF, FF, E8, 09, 00, 00, 00, 8B, 45, E4, E8, 5C, 0F, 00, 00, C3, 6A, 04, E8, D5, 91, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, 75, 08, 83, FE, E0, 0F, 87, A1, 00, 00, 00, 53, 57, 8B, 3D, 18, 51, 42, 00, 83, 3D, 24, 26, 43, 00, 00, 75, 18, E8, 88, 88, 00...
 
[+]

Entropy:
6.1005

Code size:
142 KB (145,408 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-51-117.jfk5.r.cloudfront.net  (54.230.51.117:80)

TCP (HTTP):
Connects to ec2-54-208-23-129.compute-1.amazonaws.com  (54.208.23.129:80)

TCP (HTTP):
Connects to server-54-239-132-112.sfo9.r.cloudfront.net  (54.239.132.112:80)

TCP (HTTP):
Connects to server-54-230-5-11.dfw3.r.cloudfront.net  (54.230.5.11:80)

TCP (HTTP):
Connects to server-52-85-74-182.lhr3.r.cloudfront.net  (52.85.74.182:80)

TCP (HTTP):
Connects to server-54-230-5-43.dfw3.r.cloudfront.net  (54.230.5.43:80)

TCP (HTTP):
Connects to server-54-230-206-76.atl50.r.cloudfront.net  (54.230.206.76:80)

TCP (HTTP):
Connects to server-54-230-122-176.dfw50.r.cloudfront.net  (54.230.122.176:80)

TCP (HTTP):
Connects to server-54-230-122-173.dfw50.r.cloudfront.net  (54.230.122.173:80)

TCP (HTTP):
Connects to server-54-192-19-36.iad12.r.cloudfront.net  (54.192.19.36:80)

TCP (HTTP):
Connects to server-54-192-130-244.ams50.r.cloudfront.net  (54.192.130.244:80)

TCP (HTTP):
Connects to server-52-85-63-230.lhr50.r.cloudfront.net  (52.85.63.230:80)

Remove stub4_install.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.