home

turboc++ for windows.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from docs.google.com and multiple other hosts.
MD5:
f77cb3477bfd038c8a754db27447b726

SHA-1:
3086443ccc7f915c85f332c8a03f5102cd35e32e

SHA-256:
e0e0ec8ee19fb236b8c89020c081270c7111700999925f292af9624ada5d6a53

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/24/2024 10:58:58 AM UTC  (today)

Scan engine
Detection
Engine version

ViRobot
Trojan.Win32.Agent.87672
2011.4.7.4223

File size:
4.5 MB (4,759,467 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\turboc++ for windows.exe

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:FRy4lII01+mANf77klzEQ3s6wX+xMe7bY6dKL6FgNxZQHLKN6fnm:8TTANfMwQ3Wve3ODursUm

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9885

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file turboc++ for windows.exe has been seen being distributed by the following 15 URLs.

https://docs.google.com/uc?id=0B140FDwkM9DpSHpjQWFRYXhwUTg&export=download

ftp://192.168.176.12/.../TurboC___for_Windows.exe

temp:TurboC for Windows7.exe

https://doc-14-14-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/sbc5b5tk37v8g64v9baerc0rhs6es56p/1397138400000/ZXhwbG9yZXI=/.../MEItOUNWdUJnVTdlU1MyWkVkMFpCTUdScWRVRQ==?a=dl&filename=Turbo_C _for_Windows.zip&sec=AHSqidbyArlOPJ6Wjznu3-QQzlbIkiqEE-mKQHruYQusKDJSgiYHLTgMwMBTuow9gLQBtVYzzMPT&rel=zip;z1;TurboC for Windows.exe

temp:TurboC for Windows - Copy.exe

temp:TurboC for Windows7(Indiaexam.in).exe

https://doc-14-4s-docs.googleusercontent.com/docs/securesc/e93ifhtp70hbns5etlr49oeef5bn00aq/47r1crup3bcii95mh6s7hablavc1k411/1458237600000/.../01389262791121537144/0B7qqDr2poye1LXI1MmdlcGRrX0k?e=download

http://www.ex.ua/.../34389059

temp:TurboC .exe

https://doc-04-14-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/b9fqbe8ggv0ei41sa2i7nvav9rkpu2om/1377009900000/ZXhwbG9yZXI=/.../MEI4ZjQ2bG1VRjBkY05tRlhiVll5WDNSbFR6QQ==?a=dl&filename=Turbo_C _for_Windows.zip&sec=AHSqidYsR3ZooltoGP7IuBWZTVucI6OCZrxJjw75J7BZJ1E67NTSRo5Y77K66YMFmuzUZw65Rmct&rel=zip;z1;TurboC for Windows.exe

https://doc-0k-0s-docsviewer.googleusercontent.com/viewer/securedownload/l7do7rs144hi8u2csm97c3aps3785grr/8ks3pfnueufuv27oj3dss9itakvippv8/1397273400000/ZXhwbG9yZXI=/.../MEItOUNWdUJnVTdlU1MyWkVkMFpCTUdScWRVRQ==?sec=AHSqidZjGQjqpTjtdd2oVJbRyxegDqm84SvXquwsM3Lv9v7Z3BL7NwHovANhb0c7G-Hyx2GjQoFy&a=dl&filename=Turbo_C _for_Windows.zip&rel=zip;z1;TurboC for Windows.exe&nonce=k8eurl8frfcle&user=AGZ5hq8Zd_SEXHiKpNcEraNSNk01&hash=81r0vhf690qt9dbtt9lm66l5fq0t0f3v

https://docs.google.com/viewer/noncesigner?nonce=k8eurl8frfcle&continue=https://doc-0k-0s-docsviewer.googleusercontent.com/viewer/securedownload/l7do7rs144hi8u2csm97c3aps3785grr/8ks3pfnueufuv27oj3dss9itakvippv8/1397273400000/ZXhwbG9yZXI=/.../MEItOUNWdUJnVTdlU1MyWkVkMFpCTUdScWRVRQ==?sec=AHSqidZjGQjqpTjtdd2oVJbRyxegDqm84SvXquwsM3Lv9v7Z3BL7NwHovANhb0c7G-Hyx2GjQoFy&a=dl&filename=Turbo_C _for_Windows.zip&rel=zip;z1;TurboC for Windows.exe&hash=kf12aaqt5ofofm9s3bet9s3o1b0uom4i

https://doc-0k-0s-docsviewer.googleusercontent.com/viewer/securedownload/l7do7rs144hi8u2csm97c3aps3785grr/8ks3pfnueufuv27oj3dss9itakvippv8/1397273400000/ZXhwbG9yZXI=/.../MEItOUNWdUJnVTdlU1MyWkVkMFpCTUdScWRVRQ==?a=dl&filename=Turbo_C _for_Windows.zip&sec=AHSqidZjGQjqpTjtdd2oVJbRyxegDqm84SvXquwsM3Lv9v7Z3BL7NwHovANhb0c7G-Hyx2GjQoFy&rel=zip;z1;TurboC for Windows.exe

https://docs.google.com/uc?authuser=0&id=0B7ZIyBcSsOHkQ0MwOEVnUk9wUDA&export=download

https://nimbuzz-softwares.googlecode.com/.../TurboC 3.0.7.7c(dosbox).exe

Scan turboc++ for windows.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.