home

win8_zawgyi_installer.exe

This is a self-extracting archive and installer. The file has been seen being downloaded from p-def6.pcloud.com and multiple other hosts.
MD5:
6cb71caa8c31b161db629fbc225a22f8

SHA-1:
941a72d187a2697e70290f3e868842533f9301a6

SHA-256:
cfce4d07065b320180c267f033e3447a6271b7f1e5ebb7403dbe55f1c7fb8c56

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/23/2024 2:14:47 PM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
Suspicious_GEN.F47V0219
7.2.115

File size:
2.8 MB (2,968,789 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\win8_zawgyi_installer.exe

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:ZsSVJEy+c+KCllcr5Hsf/ncLng3IQlrao6HhHKZEYQiMTOV4TDIRRKz:ZNgfa1HjuIQ1wwSOBW

Entry address:
0x8A5C

Entry point:
55, 8B, EC, 81, C4, EC, FE, FF, FF, 33, C0, 89, 85, EC, FE, FF, FF, B8, E4, 89, 40, 00, E8, 31, B3, FF, FF, 33, C0, 55, 68, B4, 8B, 40, 00, 64, FF, 30, 64, 89, 20, E8, 4A, B4, FF, FF, 33, D2, 52, 50, 8D, 85, F0, FE, FF, FF, E8, 8B, AF, FF, FF, 8D, 95, F0, FE, FF, FF, B8, E0, AE, 40, 00, E8, 8F, AA, FF, FF, A1, E0, AE, 40, 00, E8, 1D, AC, FF, FF, 50, 68, C0, 8B, 40, 00, E8, 36, B4, FF, FF, E8, ED, B5, FF, FF, 68, 05, 01, 00, 00, 68, D8, AD, 40, 00, 6A, 00, E8, F0, B3, FF, FF, 8B, C8, BA, D8, AD, 40, 00, A1...
 
[+]

Entropy:
7.9941

Developed / compiled with:
Microsoft Visual C++

Code size:
31 KB (31,744 bytes)

The file win8_zawgyi_installer.exe has been seen being distributed by the following 9 URLs.

https://p-def6.pcloud.com/.../Win7-8-8.1--10Zawgyi_Installer.exe

https://s02.solidfilesusercontent.com/MDRmZTlhM2I5Y2MxODJlZDhiZDBhMjRhZWFkYWEyMTkyNzA2ZmRjNToxYzVXUjI6c1E4bzg4NUVxaE5MUDRFZjRPTThpQU4xT2pZ/.../Win8_Zawgyi_Installer.exe

https://s02.solidfilesusercontent.com/M2I3M2FjZTQ0NGQzMWI2NmExMWYyMDQwMDc4ZjMwYTI0MWE3ZGVjNjoxYzJ5MHc6NEVsUEhpOFh5eWcxQ0tOM1RUUkxlV2RDTGxr/.../Win8_Zawgyi_Installer.exe

https://s04.solidfilesusercontent.com/ZThkNDc1NzM4ZTFmZjc4YzkwMTIzZmJiYTU3NDMzZTViZWJhMjE2MToxYkNTS1k6aWVCdnFJZEtNZW1BVGM0OUQyM0xBOE1zZVJn/.../Win8_Zawgyi_Installer.exe

http://www80.zippyshare.com/d/afgqQ12V/.../[WKK] _ Window 8,10_Zawgyi Font Keyboard_Installer.exe

temp:[WKK] _ Window 8,10_Zawgyi Font Keyboard_Installer.exe

https://s04.solidfilesusercontent.com/NjBjMTk4ZWUzM2QyNzE0MDNhNmZhZTE1OTIzYTdjN2M0NmViZmVlMzoxWlJpbUg6RmFWT0h1SWV1cGZfd3gxWlJ0SXM4Ylo3OVNZ/.../Win8_Zawgyi_Installer.exe

https://s02.solidfilesusercontent.com/Nzc5YmVlNTY1NzdlZmZhOTFkYmY2YmVmMGIzNjA5ODY0YzY2Njk4MDoxYVJlUWQ6YWhzNEpoV25CdHhMNDVWQnlGa3FsT3ZLTUhZ/.../Win8_Zawgyi_Installer.exe

https://s02.solidfilesusercontent.com/MzcxZTc3YjkxNGYxNmY1ZjE0NTBiMjQxZGRmMGE0MzVjYmEyNDkwZToxYUV2a2g6MnhtbkJObjIwb1ZKNGNiWkdqOFRDX2JlWDhR/.../Win8_Zawgyi_Installer.exe

Scan win8_zawgyi_installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.