home

Windows Loader.exe

The executable Windows Loader.exe has been detected as malware by 8 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from doc-0o-64-docs.googleusercontent.com and multiple other hosts.
Version:
2.0.1.0

MD5:
c4d6d3633382fe25a25aa4ee12a19560

SHA-1:
c6fd5d70f7609c589757fac45811dd7c1c63f93a

SHA-256:
27b4ea627778b5f75622daab8c736f4024778b69ca93f2ec940e3d44107902d6

Scanner detections:
8 / 68

Status:
Malware

Analysis date:
1/14/2025 11:22:18 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Bkav FE
W32.Clodf1d.Trojan
1.3.0.4613

K7 AntiVirus
Riskware
13.174.10689

McAfee
Artemis!C4D6D3633382
5600.7276

Norman
Suspicious_Gen4.FEAPH
11.20131219

Reason Heuristics
Unnamed.Threat.14
14.3.2.13

Sophos
W32/AutoRun-BSY
4.96

Trend Micro House Call
CRCK_PATCH
7.2.3

Trend Micro
CRCK_PATCH
10.465.19

File size:
3.3 MB (3,473,072 bytes)

Original file name:
Windows Loader.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\windows loader\windows loader.exe

File PE Metadata
Compilation timestamp:
10/31/2007 2:53:19 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:XEYCFEORaBmN+tfSkRZSau2SmP8IJbCh5spuWV355FXw/+6uWV355FXw/+EuWV3V:XEYzDkN+tfRRZk9RIEg

Entry address:
0x21A9A0

Entry point:
60, BE, 00, B0, 58, 00, 8D, BE, 00, 60, E7, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 77, 80, 21, 00, 57, 83, C3, 04, 53, 68, 95, F9, 08, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Code size:
580 KB (593,920 bytes)

The file Windows Loader.exe has been seen being distributed by the following 7 URLs.

https://doc-0o-64-docs.googleusercontent.com/docs/securesc/js0almfc4vpe4gemu7i0c2l9lvc3q1p2/gttdedep600lvog57vbnjur0o2o50upn/1457899200000/.../00283565449331390145/0B5ocz-_hnqr-VEVuazlSeHVNajQ?e=download

https://dl-web.meocloud.pt/dlweb/download/Manutenção_PC/Programas/.../Windows Loader.exe

ftp://10.0.0.3/!!! Must_Install_Software/Software/RemoveWAT/.../Windows Loader.exe

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_1_AMBhUtQAAZguVrpN3wa2wJVj0IU&fid=Inbox&pid=3&clean=0&appid=YahooMailNeo&ymreqid=cbacceed-a4e2-5d38-01fe-cc000b010000

http://downloads.sourceforge.net/project/.../Windows Loader.exe

https://doc-0k-9c-docs.googleusercontent.com/docs/securesc/f1iu8vpkon0cu7b09dgvmvhl750j943a/u34cpd7pi27mbsmvg9dubfn40ona10vm/1391263200000/09788114177575615782/.../0B4bjlskNuQr5MmNlbS1DbWRCekU?e=download&h=16653014193614665626&nonce=eoa9d0hd76ile&user=13055260486372456465&hash=39b2r3na0bhsk6cimucjtcmv7b0kbskb

https://doc-0k-9c-docs.googleusercontent.com/docs/securesc/f1iu8vpkon0cu7b09dgvmvhl750j943a/u34cpd7pi27mbsmvg9dubfn40ona10vm/1391263200000/09788114177575615782/.../0B4bjlskNuQr5MmNlbS1DbWRCekU?h=16653014193614665626&e=download

Remove Windows Loader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.