home

theforest_0.30b.exe

The program is a setup application that uses the Self-extracting archive installer. The file has been seen being downloaded from fileshare1100.dfiles.eu and multiple other hosts.
MD5:
465656b2259976a9a2ac24ab078e9f45

SHA-1:
3e75294f2c419bcdb09762dacc96acd9144e1205

SHA-256:
fb39d8b1863da5bd47f362fe4512a741dc44a5ac5ed90259da686a8fa52dacc1

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/5/2024 3:39:53 PM UTC  (today)

File size:
858.4 MB (900,058,042 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Self-extracting archive

Common path:
C:\users\{user}\downloads\theforest_0.30b.exe

File PE Metadata
Compilation timestamp:
12/1/2013 9:08:23 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
25165824:ziDW6J7cLsFzIvp9Xe8hRvH9p/7PpwFOFSr6:zipn2de8h9dV7xwFASO

Entry address:
0x1D728

Entry point:
E8, F0, 57, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 05, FD, FF, FF, C7, 06, E4, 81, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, E4, 81, 42, 00, E9, BA, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, E4, 81, 42, 00, E8, A7, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, D1, C9, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Code size:
149.5 KB (153,088 bytes)

The file theforest_0.30b.exe has been seen being distributed by the following 29 URLs.

http://fileshare1100.dfiles.eu/auth-14532200108fe05e2af0ad5bb82be233-217.99.253.38-2438636762-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14532299229e71efb3c93e659b25daab-5.173.24.75-2438818925-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14526270020c243176358cfee2bcf895-78.190.84.149-2430170315-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14519115657431f723945f7b81bdda55-46.77.124.124-2419378357-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14511597612256c60ed726833fdbab48-185.122.60.248-2408055676-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-145191355517b040074df9a8db7dadc0-83.31.35.206-2419413266-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1452965485908d3c7dcdc904da1e376d-46.205.241.236-2434939892-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14511440706b404c5e37e128dde1a055-83.7.51.126-2407776246-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1452798745e0cb27f9794cac37e20bd7-83.24.107.37-2432551280-165122614-guest/.../TheForest_0.30b.exe

http://download1484.mediafire.com/appq2cfua8ig/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-145098997234af3f2d30e4d0fba0dbf6-77.253.137.219-2405740261-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14531458850b551d40a96d5f3a119257-79.185.128.236-2437623960-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1452115456c4d6148a8e3895e30afeaa-89.66.43.72-2422550270-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1452271686fe451aa12f8d8b188300a5-83.26.210.110-2424763055-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1451899570d37144bac053dc7838c462-86.127.34.191-2419183762-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14518284666e26c3a5b1d4f318d7183b-83.6.31.134-2418102824-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14526035517dcaa429a7ec6e85817d67-188.146.11.249-2429748218-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14519955085af02d45a98583ce6c1e84-83.9.111.237-2420658211-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14513707248ced9670ff58cc74776b15-91.218.61.46-2411300502-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-14532274371c301c6c92ad1f75524616-94.40.46.27-2438772729-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1451060282d3866050ad7597ff46431e-217.99.254.14-2406609789-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-145209515142ac050531c30c73d61d9b-176.58.22.253-2422183717-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-145155671667dd805f5a07c537f41b44-109.241.52.83-2414184209-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1452885365b1e9f4c5d4fd61b9ec0b28-91.239.168.1-2433736126-165122614-guest/.../TheForest_0.30b.exe

http://s7483.chomikuj.pl/File.aspx?e=qO3W5HJJ5ZvrqBpPw_z-gUxRLiTYZOjWRJtouTFfPkAb_wvpAmGnGhaqAcGqjiYjKzk0ePo8iyOMCPyDh8LhUgAYAobWwqyKhKB-QhdQ0i-1DeZB7tiNUcsZq_QTA7SGovjjl7blSmwguULXcK71NA&pv=2

http://fileshare1100.dfiles.eu/auth-145249171689e9858c8d48673a02e43c-85.49.101.121-2428131427-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1452717073fce52cd8d0034d0685c62d-81.235.13.111-2431447867-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.dfiles.eu/auth-1452300033d54b89b8417e19614ec208-88.156.139.171-2425213840-165122614-guest/.../TheForest_0.30b.exe

http://fileshare1100.depositfiles.com/auth-1453058548baaeb53f172434a4d00c6f-23.233.138.71-2436387131-165122614-guest/.../TheForest_0.30b.exe

Scan theforest_0.30b.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.