home

windowsmedia-kb832353-enu.exe

Self-Extracting Cabinet

Microsoft Corporation

This is a setup program which is used to install the application. The file has been seen being downloaded from securityerror.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® Windows® Operating System

Description:
Self-Extracting Cabinet

Version:
5.3.0018.4 built by: srv03_qfe(ntsebld)

MD5:
89a98e6383e0deabc415d480f3770696

SHA-1:
366e72e694126dc5a26cc97c69e2b091d08347b2

SHA-256:
612a32b5dd58fed05716824b58e22300a49838f9c4eedc47d2744837f7630219

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
12/25/2024 2:04:23 PM UTC  (today)

File size:
2.7 MB (2,861,608 bytes)

Product version:
5.3.0018.4

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
SFXCAB.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\windowsmedia-kb832353-enu.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
10/25/2003 1:59:14 AM

Valid to:
1/25/2005 1:09:14 AM

Subject:
CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, OU=Copyright (c) 2000 Microsoft Corp., O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
610E7DA7000000000048

File PE Metadata
Compilation timestamp:
6/9/2003 8:48:40 PM

OS version:
5.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
49152:30FUsZ3B0UYVAp53znmv+qXargEBWh8ZBEIkxbukjvSaOBSqf4JPIzTPnXKsxubt:3Q9B0bkznmlKrgSWh6Evxb5H8fMIzput

Entry address:
0x4D7E

Entry point:
E9, 03, FA, FF, FF, 8B, 44, 24, 04, EB, 17, 80, F9, 3B, 75, 0C, 84, C9, 74, 14, 40, 8A, 08, 80, F9, 0A, 75, F4, 80, 38, 20, 7F, 09, 40, 8A, 08, 84, C9, 75, E3, 33, C0, C2, 04, 00, 8B, 4C, 24, 04, EB, 05, 84, C0, 74, 11, 41, 8A, 01, 3C, 0A, 75, F5, 41, 51, E8, C0, FF, FF, FF, C2, 04, 00, 33, C0, EB, F9, 53, 8B, 5C, 24, 0C, 56, 8B, 74, 24, 0C, 57, C6, 03, 00, EB, 0C, 56, E8, CB, FF, FF, FF, 8B, F0, 85, F6, 74, 2D, 80, 3E, 5B, 75, EF, 8D, 46, 01, EB, 0A, 84, C9, 74, 1F, 80, F9, 20, 7E, 0A, 40, 8A, 08, 80, F9...
 
[+]

Entropy:
7.9977

Packer / compiler:
tElock 0.99 - 1.0 private

Code size:
27 KB (27,648 bytes)

The file windowsmedia-kb832353-enu.exe has been seen being distributed by the following 5 URLs.

http://securityerror.com/download.php?conversion_id=14170107404220&site_id=597&app_id=96&lp_id=375&v=icrev&stub_id=57&v_id=7f7651f194edcf757d13f01406cb164c&dist_id=350&channel=dgch350&SourceId=964&CreativeId=437427&cid=00004866dfec71f5140d2bfdc9293a43a921e

http://securityerror.com/download.php?conversion_id=14169574179928&site_id=597&app_id=96&lp_id=375&v=icrev&stub_id=57&v_id=e13f3288fbfcf14f46aa967e29c586dc&dist_id=350&channel=dgch350&SourceId=964&CreativeId=437427&cid=00004464acbe5be954d3fbab2c31536f9385f

http://checkupgrade24.freeupgradelive.com/dl.php?conversion_id=14225456825644&site_id=3344&app_id=96&lp_id=321&v=ico&stub_id=85&v_id=f50609233e1815f7483b7ac4ae8bd7f0&dist_id=611&channel=mrk_mpeg&dast=YnJzcj0zODQxJmJvPTImY2lwaWQ9MjAyMjE2MCZjaXNpZD0zRDRDQkVFRDg3MTYxNjcyNzE3MDc1MTM0ODgmY2lyaWQ9M0Q0Q0JFRUQ4NzE2MTY3Mjg0NTc4NzIyMDImc2xpZD0wJnN1YmlkPTIwMDE4NTkwNjQyMDAwMDAwMCZjaXVpZD0tNTgyMDExODQ1OTAxMjY5MjU1NCZzbz0yJmNyaWQ9MzE0NzkzOCZleGNpZD0yMiZtbXQ9LTEmb3NpZD01MzMmY250cnk9NjMmY2ljbXA9NTM3NzM4JmN1ND0xOCZwdWJpZD02MTc2Mg==

http://download.microsoft.com/download/1/8/7/.../WindowsMedia-KB832353-ENU.exe

https://download.microsoft.com/download/1/8/7/.../WindowsMedia-KB832353-ENU.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.