warface-launcher.exe

Crytek GmbH

This is a setup program which is used to install the application. The file has been seen being downloaded from mandrillapp.com and multiple other hosts.
Publisher:
Crytek GmbH  (signed and verified)

MD5:
bb817ef38724f06222e867d9f5cc5c70

SHA-1:
56f9192a6d28cdec1b13ee8c71a659bdf4647de4

SHA-256:
bfb3072f3c2482320b517fd8f4650e002b9d80d978701999f64e0c2cf80ffc82

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
1/13/2025 10:40:16 AM UTC  (today)

File size:
28 MB (29,350,504 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\warface-launcher.exe

Digital Signature
Signed by:

Authority:
Symantec Corporation

Valid from:
3/6/2014 12:00:00 AM

Valid to:
3/5/2016 11:59:59 PM

Subject:
CN=Crytek GmbH, O=Crytek GmbH, L=Frankfurt am Main, S=Hessen, C=DE, SERIALNUMBER=HRB 77322, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=Frankfurt am Main, OID.1.3.6.1.4.1.311.60.2.1.3=DE

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
0AEBA8669460A2A96F4D6F3A2E13E864

File PE Metadata
Compilation timestamp:
12/11/2014 10:27:43 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
786432:5N/Ttm9o8ecji2TKgoeEl44T9TnfWuIwUA:/tao87BXEl44BnfVIM

Entry address:
0x4345

Entry point:
E8, 2B, 60, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, F8, 40, 41, 00, 89, 0D, F4, 40, 41, 00, 89, 15, F0, 40, 41, 00, 89, 1D, EC, 40, 41, 00, 89, 35, E8, 40, 41, 00, 89, 3D, E4, 40, 41, 00, 66, 8C, 15, 10, 41, 41, 00, 66, 8C, 0D, 04, 41, 41, 00, 66, 8C, 1D, E0, 40, 41, 00, 66, 8C, 05, DC, 40, 41, 00, 66, 8C, 25, D8, 40, 41, 00, 66, 8C, 2D, D4, 40, 41, 00, 9C, 8F, 05, 08, 41, 41, 00, 8B, 45, 00, A3, FC, 40, 41, 00, 8B, 45, 04, A3, 00, 41, 41, 00, 8D, 45, 08, A3, 0C, 41, 41...
 
[+]

Code size:
55 KB (56,320 bytes)

The file warface-launcher.exe has been seen being distributed by the following 48 URLs.

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiRGtsX2F1OFA1VnJvMkVZVDRRYnNPVGd5LXU4IiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcIjQzNGJmYjAzZTU4OTQxM2M5NWQ2NjJhZDBlM2QxNjkwXCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

https://www.warface.com/.../download

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiOTBKaDZMM2RVTW52X28xeDNuRm1YRWJSQWlvIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcImJmNWUzMjU4NTYzZDQ3NDE4NjNiYmEwYzU4Y2IzNmRhXCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiQ3Y2Q3psY1htRk1rd0M1MU0wU2tMX2JkMUMwIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcIjIwMWIxYjcyZGEzYzQzMzE5M2MwNDZkNjFkNzZlZjgzXCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://kolayurl.net/a513ok

http://s7852.chomikuj.pl/File.aspx?e=Oopsto-IA3OSLjrrunRw2bYrkAciVoINcwfhHxvgq3niEiVXjMO9Xbc91uJSZqm1DWtONvjGAkW8gA-Yt1JQn-DbQMBFqYiaRIUqqZKarI-FPcpL410JayxDt5tAM0Xm7p_-Ntbmo1p1IHBmhcd6OQ&pv=2

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiMDJCMU9KVG5yY3ktLVlheEY0RHBCNGozeERrIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcImU4ZThkMDc4NTU3YTQyN2Q5MzI2MGE0YTYzZDBhMDAxXCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://r2.computerbild.de/exec/r2r.pl?m=w-cobi;u=http://d.computerbild.de/downloads/.../warface-launcher.exe

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiYzNNSTB3SVFCakg1LXQxTEtkY01pSkNyVVlNIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcImEzMDZkMTkyYmJkYzQxZGI4N2U1ZjBmMzk4MGZlNjA3XCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiZVpWamVveDhvV1MtN0VHQW55MUxvV1FGZHlvIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcIjlkMDE0ZmE3Y2Q3MzQxYzViMzUxN2Q0Mzc4NTRjNzMzXCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiU3F6VjdIenhTMHh1T05lUG5ybXg1SnRLdHNFIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcIjY2MTc4Zjc4NmFlYzQyMTVhYzI3MWI2ZDY0MTI4OTQyXCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiVEpERXhiSVo0OUFoQlhiN1JrZ0Q4TXU5dXBZIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcIjllNTgzYjA0ZTM4NDRjMTI4ZmM5YjgzZDNkNDhiNGEwXCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoiUmVrWnJXdUZ2THNVM2NsajRVclBCSDgzMUprIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcIjJmZDkwMTZmNjdiYTQ1ZjFiODM5MGI1YmZiMmEyMGI4XCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

http://mandrillapp.com/track/click/.../gs.crytek.com?p=eyJzIjoibWt1QWhVbzVFd3plWXV0a2k5WEdOTU5pUVAwIiwidiI6MSwicCI6IntcInVcIjozMDM0NTI3NSxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvZ3MuY3J5dGVrLmNvbVxcXC9sYXVuY2hlclxcXC93YXJmYWNlLWxhdW5jaGVyLmV4ZVwiLFwiaWRcIjpcImE5MjQ0YmYxZTZmNjRlODY5OTk0ZGY5M2YyODc5NmM1XCIsXCJ1cmxfaWRzXCI6W1wiMDA5YzNjNDU5MGExMjNiMmIxYTg3YjNhMDkyZTQwZWJmMjE0ZDNmNlwiXX0ifQ

Latest 30 of 48 download URLs

Scan warface-launcher.exe - Powered by Reason Core Security