home

wincdemu_1.1.1.exe

The program is a setup application that uses the Nullsoft Scriptable Install System installer. The file has been seen being downloaded from dld.oinst02.eu.
MD5:
49ee92b869b6ba5f7041653d1097cc62

SHA-1:
30a13644d6a34c5d7cef0d3d2a460c8d7cee1d68

SHA-256:
ff7a7b181da3a528464494fbbbdfefc0c27bd3a0378876d1cdd9c1a2882c0a01

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 7:30:38 AM UTC  (today)

File size:
232 KB (237,568 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Scriptable Install System

Common path:
C:\users\{user}\downloads\wincdemu_1.1.1.exe

File PE Metadata
Compilation timestamp:
12/6/2009 6:50:52 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:Je04g2CM8M21AgGwp0PTVJITIUza5knnJukycPlk:JQ8ltGwpsBJaIUzamJukyW+

Entry address:
0x30FA

Entry point:
F7, C0, 45, C3, 16, 89, 81, F5, E9, 56, 48, 80, 4D, 69, DE, 34, 63, FA, BD, 0F, AF, F2, 0F, AF, EF, F6, C6, 12, 8D, 1D, 9E, C9, D1, 2F, F3, 8D, 2D, 79, 30, 4B, E9, 11, D9, 81, F1, A3, 0E, F8, 33, 8D, 0D, B2, 55, F2, CF, 3D, 1B, AD, 00, 00, 8D, 05, 49, 58, 77, B0, 0F, AF, C5, 4A, 8A, EE, 19, C8, F6, C4, CA, 0F, AF, D9, 51, 53, EB, 08, 89, F2, BA, D0, B7, A0, B4, F2, E8, 44, 00, 00, 00, 41, 87, F8, EB, 09, 0F, BF, F7, 69, C3, 4A, E6, B0, 33, 4B, 89, E8, 81, F9, 65, 89, 00, 00, 70, 02, 85, DF, BD, E3, 79, 00...
 
[+]

Entropy:
7.7194  (probably packed)

Code size:
23.5 KB (24,064 bytes)

The file wincdemu_1.1.1.exe has been seen being distributed by the following URL.

http://dld.oinst02.eu/.../WinCDEmu_1.1.1.exe

Scan wincdemu_1.1.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.