home

wecpsetup.exe

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
MD5:
657a3505fd61cf405f39e707b50b3b32

SHA-1:
fb6dbe81a5085c56cdc8e9504dca47a6b6c6e0f3

SHA-256:
b1efb19b1246455df2b0946b60fe8e2c32c03c13e1fe08e09fd84f2c5452e92c

Scanner detections:
3 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/25/2024 4:44:42 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.CU (variant)
8.9252

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
23.00.65.14104

Trend Micro House Call
TROJ_GEN.F47V0927
7.2.6

File size:
611 KB (625,664 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\temp\wecpsetup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:Q/yMJfsGCh9S9TU8ze9oohUSAQY8pPrvDYh8dRLJPQhIg3AJ:WyMJfsph9qT3zAjhUS68pPrvDYKH9Ih6

Entry address:
0x98CC

Entry point:
55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36 KB (36,864 bytes)

The file wecpsetup.exe has been seen being distributed by the following 18 URLs.

https://dw.uptodown.com/dwn/BXAV1kEG_yVx2-JW2Aox2m23_-AiC0o4EA94QzXo15-7Cu92QIkCrpfHZKiAD4fkZ_alFUlR2NdoyRA4xJ9GHa4EmcIUUlw05QAw4iJDpDIyaWiC03OL0mgrLVrN_4ND/Yl0Lhf-2I5BuHtaTvnrk4fap__FXCXZmaUxewO4vKFFqMgow1BT5cGRtXIR5ki1w5nrsrlshiOEihAao1TExmBB62WUVPfCELJnkcdU9L74eBm1esDYR8dP_M6t49Xjm/wLyYwlbF1PU6iDAjWcrG5FvIofao3W9EC_4pur_D9ErYVVYvjP8-CMvZpoHG9LtlB04Grl7wA5gBRJ-QyFSUYm1s5ypppOPjiBNxko-xeJ7xdbNKxVvEEwGhsZpLevlr/.../

http://dw.uptodown.com/dwn/XVh6Ozo85HkSRElYtR5ugpe57TVQewMn_l0GRo-yzJci8zTEEVb93PvO3ZuBCUhZqZFDgA-w1YpUhmoQemWK8hJelME-DKn_sLS8dJ6k45bbQQ_q1hqz74zIWi540qp4/EhZa3S6P_x7y0gpe_8TM5KYIaXsL0oEbnzvWZGVFvpTm9DvIhtwS9wZCpdo5EtILRU7FovehaBZ2nCMFZwcKeAIW_AhV4l-xgwxOyEo0IZI2wj0YDvva4pYpo6JogGIZ/40-AxOkX3H7pqBAbhr7oqjEVZ2IJ4g8WiowyQCtVhRkz6ge2nmXkWUsUUn0iBIrg5BfH_LupXRhbjlQnxgGvJgfA3ewqZrb_lKKrO5KZVJuNg3q9lpK3RbVdqq1TK_OE/.../

https://dw.uptodown.com/dwn/-tuTCKGCTTY6ChhJso1KwWV-RHaiIYHpsMwYswSwkomz1VWdvALACR2pk8pwdzn8p15tRaM0nwZ_neK1ABqHHnvHnS6HZ4AEpA2Vt6fqORHsqZv6A0GyWsF-A0eM2xWM/8f8V_aWcd8j2Ohx4DZ5wjdYoOG80r4Z1mG9gon7YjuAQ0hcD1YKQdRsxSbIGGvGu-z9C4N5jREV_Ppyoqlf5FMsidW6GkiRZAxI2JDGkJjYWn_6EXi5gEnBo_pBrelm2/Son_ve_UyKLUlKsWKNMHtoRDQiCDHSosa5Vd35mPNru-XLp0v4sYTFt4xl7Sip8qVy0h5-3YSM8oaODPbYZAJSQtPis1wO5ZIRaaR0qXxx5fjkGzC-ad1xvzbyNZxru9/.../

http://dw.uptodown.com/dwn/loseybapE3b9iWMWNbTV-AtQEe7VHRtnKPfXQDfPCAmy6kAJEkfmH_lRizoPhiQEDm4tnNXEMAz6iVntMyZXxdBjmn9pwBt7u-QfvJwlz3Kgn4SWvr3PNskbPLfejp6W/fYKKodIVXN9i1YgW_alZGrAjEv30TdfQBXwLqYKZm0D7XOqnU9VNlrcMqrRnqlTmPr_6Eb2G1T4fIvqzP1W39CdeVsPUout7e4LzjCe_DjL0Ift-2yt8SUOMpqN3Bq1-/YcV0VGzBEzuwE6GX_k2Z7izJ1_QBUQkk71FyDNVkhZysXZ0eGRXkl2gH4GTbrbWkyWnxU73g5kBG_9xkWae05QKs8qUikB4IVH1ur9FkXGHFjI048dSGhGgoKT7rHgH7/.../

https://dw.uptodown.com/dwn/FCCK7qqpCEb3yC_SOBvdISah2qr8-ExXGuwvBLnkPZWk73fTVyA-O-wmFKcM9Y7MdGhqop9cqjaH2QOSEsdwIctmmOidOZMhtVHOAFhyvh9R0xUs6bYa7VUfZnRBOvm2/9sEzi5VUJ5S-uO-ZnzpMEhc5QY5TtmsL2mxY4CuSY_8U2ie7QMybVsNeZSfksVHE-gUjSYGPc22IM-wt79LR_cV26-HjS4Db_Y1cCMVU0NyZJz6hX41G9F_QC_GwbXCG/MY24IBL6zpg6sj1oYXuLt1GqAYrNrkQzyyu8yV3R0YsKf_8P-DKrSNgotwNP29fqcQsKkA2s4Nfdjg0z6NQginn20G46LRIaKvCiLtRQHM0FMxR_eRsgrFtT5fpl-i8t/.../

http://dw.uptodown.com/dwn/huFKQLE896MUtYhDUg738X6Wb1drD5M3q154jntEYQw6cU3sUgUzsvdipQb3giT3c-a9oJhsEGn2H4HF-HtpXEBC7QNbKyyD1o4o-SAWvVUE-0UjnJz0-L5PHXyAZP_X/p-Uqtd-JDo6zIy6l62_aM0AaYd0_h6nqO3z8Ih1hZFpD_5IIV-X34hiaouWm26XweuXzM5_6IhPy4xN27FlnZDxRNSKD4QltGiiulF4OdQZl11kNbb-PcMf9ObFnFW9k/3Bb6IzeM931nrj5EcBvyttBlJCQHrd6s5GpD9j2PugR_Q3cY5Nz8Kd6CR19jB6PIQBkR8BI5f3gg8DwNWWTGw_C4HhlnGySHStsQJHAjzebyeU5o95vWhJao9hr_nwst/.../

https://dw.uptodown.com/dwn/rySAK3dbNq9u31VdxL90hLTVfliwBDzuthsxF_hMlsVw-hhVSmgwwtBXotsORt-bmP8MuK9d4c062WP_mps42NFZSzZYGNiEJjdEzfWvbIUMV7Sx-CkGSCXuSkhYhbN6/XmXnyhkPmnIn7GScrw9VAdJB8S__mzHckWd4hm8-FDNARTPIbNk88WNMy-r15Fg9trMN5KHtCn0_LD-QI85LKz9Mkl57zZV19-WvoUukIkNL5lK3JEE7asgqELM-h_DM/GqgS2tZD9dB50M90dQ4ViUpZBN2bQcKoj4GHob79j_71fg8GgzS3Fn-K-Jfs0fYNcCLkkb4GGQDFyE65NN2hueacRWQX2BnrkXHBco6LRIPwdkuqQjazZRFK48Yk-Obg/.../

http://dw.uptodown.com/dwn/8-StEhq-Wu7QUxiO33Ya-6YWRs8dPHElQufkUXTN9t5WXxhBEAGlw669UFA20Nf0vIZQJMIqv-RrTwFkwhw6UZ-co9kvulp15pbtL59DkyxXvjsN5kH2OWCkiUiiX-QE/xvwF_4MM3FvJNmbRWEGXWISkEJTXvYSjGIfkpN1kMcWpUUyC-c-ihzI6yxGZCqObsgRqQSLPGdrDbBGCyEYo2JRQZdUFgwxXDdJgN-fz1Zfm5PbrJy_BQ_o_GMearhA2/hxFZLGhTmLQ1-T5zKIdsHOKy_Pfxy6I3SViVjwr6LKR_u4zSgvruIlXKcKhVC8IVSz1GQPxXbYujkqO0O917DAyokJb2rNCIc9Zrwlp5RWj7AW6bxxGzwMPDugpx7caq/.../

http://dw.uptodown.com/dwn/XKBh9nrVffN_mQ1Izt2xm_WjOxpr5SDJiKuiUNiH3RJ3ck20Jibk6DdELxWiCpr0_ZspbX1MagVzOzXLxP9gPI56bNKh89E9El-dSUsv3z4hLaolR1Dq_-vMM3bL8knI/BgJH7SgVO6yky1TQJosc5_zP3o-hCTvH7fM6ywCovu-PGbXkNaAb6LI8fB9-WOGrm3xxelTVp6hXKxRrgD-leOHAVZZ4PuYiOHcpntUJ0ONWweoRP1GotchrMeSpj4Ep/iq_YOUQSWw15aveaCKxM_cPm_9UmLJdUOLGPVA_v5zjv_bKTgqdJk1L5mLUgojvipAzDRGPzkThQXcs0dHWGE_lGLdYy7G6XnkcRSWDeWOgtZpwgpTO7pV9XsU0Fg97q/.../

https://dw.uptodown.com/dwn/zBdc4UaEfTlSaqLCLPxT7Gbaaua6BMrcXJGorn3G1Ia2rSE_AfzO8INIKDemRykGSgVgaO1uo81VLN7G_vTegSaTUeHHYFZYz5u-2kt2d2tFf2xToPCekZRG-cGlXRnG/WqRWXeaKMQR2v2UNsNQ71uy7vQRBJgsic2EXUzrHd1jzF50BqHA3s4t5aQdOjeMNSS3bNHWpjkciMZU6O0TUBHOJTv7JbNrKljxef_A0TYKZtTEGFkiElMtnqiDqpomb/7vidYh4qqkjFRabjyzUXTIJJzyMSr0-6gA7mmbCM2Va7Afzg4dfTbTJXqVjMwLYUnHVKd34MR4PmzHQAYJEJDnJF24gIfkUAjzWYVlteHUpq0F7Lca-NF1ox68WGZfbw/.../

https://dw.uptodown.com/dwn/Vp_zYWzP-D3FL6QuZIJmFnScOshoI3fHFmp2DcRWtEgxDWDiKIanwEBaK08B-dVDIEOMMC9MpKBwmFrBBCUZrRSrDU21KLcObeaNB3ce6y5wX9CZHqjDDndtUW5S8E8q/EoKycm0w-rYiL2jBUZ-xsMkAqizLa_Ta1RhqeEqUpJ864DkCfXp2YPItUkF8CuO70ZY6sv_H0MC1_GCaNzDy-A0p76CaU06S2w0epFg1rz-3KUhzymY7RpzXaGqMEKcF/DsEL4mnt4JL2nubJT3tYzIBTdipN3nxv7QKoFKAFkGg5ICww419krSF8yLDSxwa0MNqEypKFXD9FuK5AznNN_uyFvqXz96F4O8tRHLM7eHd1bOxpi2pfNVxYI9gzur-M/.../

http://dw.uptodown.com/dwn/Uz_dMKiIgwxvDw-dsmoI1bfyytBVMrUdIVqU-cwpUekKzp7ai62bYvk1nfeBT6Qch687wZ0HT93ayokabZuwGrp7T2I8C_-rHQEZz-pbGLM2q0jKurGldVM3ya9VeLI-/9x2ADaGiMjzcTCUJYNbzP6eoLnA5vsOuhtxQ_7fmJ4w7LPwMUTPdjj1qVfxlhE4ZcMP6CGf2emY5mSik-pf9_7l47OfBKyb1j23Mlo8zQ9rlc7Hu0It-Rj0ZJ3BQuttZ/v26Z0lXv0iTGvs511aQ38z7vpdNJcqSr7GRmsTn5oiLI6V1IG040BfAjPv2_KbbiN7ZEFqEg3KyyMDvEdsMRTDdn2ibiLqCJusGdJ8mLTgn4MZdOuqjAA7kB1s7AvFGZ/.../

http://dw.uptodown.com/dwn/TABkj6pALLICg_-S32WWK5mHD4EKn35MEnvB6XK3tjWaG_w341ciiWW6M4__QkdqAXOsUhlbHndcMS_7juwvoEPZFfivTwE9Z5mRXDkBStQ4YG95L-aymlxu45x2Fvso/6g9LAiq_ovHZXSjC1dkXD3lkGGfl7cxUEsDZmTTzEyNV2eF5ycNbuNZz8D2b-u4je8Xsn-D4k_jUW72dX1X09ikt9EROZN82ICGd-5Db3vpuEM-D5wMRzLFvpwOJERhL/8tv-j50v7O7UA3367UkRKR6_BV0246K5B_YxeDfKmWB__B5c47SGD5oeRz3B6KeN7mgdMWapi7cX1NLf6ZUFeGf69V7xnqGNN_j-zu_lAfv9FuctwZpqLjoyA_--EFRz/.../

http://dw.uptodown.com/dwn/0wte8vw0FYmJN5k6PgcF6lX0_sHJA76FjEln_ghiPXz31nKqu9zNoLmgrrCio_DZbVlVIh5QkcUOebfnt4E5-9IIRZ-55JWBZ9vB3cnvdBGgHaRQEW6dyzIh8ixUjLGy/39yEiHqO4An_jYBUYPkdjE6PE_r41JBKynxTHNj44fO_ye66N55tbBOcSsMd57UBrPekcXLM8ciE0U_Yy3UwK4108ZG5EoRm8xuIBYBILhkRj0uEuvhllRoNFTawZCtw/P_nf7tFa7hwvjggj2SFtgAGmjEE1KDNAJIMzD5MqQhm3DC0hA93sjMbeM0kWPrHLYasIdxzROyRkweIXUzMlfCbeOXoc86GBzQk9bn-pnKa8hfmoGGVhaxAjyIta2vY4/.../

http://dw.uptodown.com/dwn/22_KX1FqyJjuZcS7L0TW3_y_w75DoyQlvz14_BxtdD6aLi62WvCA-jdndL8tdE5DwGZXP2ecc6o7ZlRRYc4fhHCAY8Lh0GAnCPSw8N3OPq_3gykdabB6TKbShzk1iTFK/2LmdKoqUkllLtZ1K9QhHMl-kprPtZH-Ko2soZ0up23VMecBrpcMHs7EgpOWgt2_nOMSjDgjIhlwJrKxVI1NKLnFrhHcehqr-rJUCh8vvQX_49zpHcTxt-uS5fbwEOG_2/PenGZ0mYvAosLyRd5SNZLXFgMUzr4oKKHiLV9m9K0OjRyfxsMZudEsXypMY6_J5_bbD1C-HynBUz5FI-M-J4-fOZCqbhxh1f76tV0aChjOVy3YY2_Cr6ws2Xg7l7D5NE/.../

http://dw.uptodown.com/dl/1447541703/.../windows-essentials-codec-pack-4-5-en-win.exe

http://www.mediacodec.org/WECPSetup.exe

http://software-files-a.cnet.com/s/software/13/36/82/.../WECPSetup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-232-222-104.sa-east-1.compute.amazonaws.com  (54.232.222.104:80)

TCP (HTTP):
Connects to 92b91b2d.rdns.100tb.com  (146.185.27.45:80)

TCP (HTTP):
Connects to 50.115.122.45.static.westdc.net  (50.115.122.45:80)

TCP (HTTP):
Connects to ec2-52-67-76-234.sa-east-1.compute.amazonaws.com  (52.67.76.234:80)

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (199.58.87.151:80)

TCP (HTTP):
Connects to ec2-52-50-196-247.eu-west-1.compute.amazonaws.com  (52.50.196.247:80)

TCP (HTTP):
Connects to 92b91b35.rdns.100tb.com  (146.185.27.53:80)

Scan wecpsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.