home

WinExitSETUP.exe

WinExit

Tomasz Haratynowicz

This is a setup and installation application. The file has been seen being downloaded from winexit.w.interia.pl.
Publisher:
Tomasz Haratynowicz

Product:
WinExit

Description:
WinExit Setup

Version:
1.5.1

MD5:
2a2eba2d0bec69589425e7d3b67e7951

SHA-1:
4b94115dad756ed9bf5514417213d105da23f5dd

SHA-256:
ea59ae8724192dfe7599570276e8d09dffe908f29e62a40160dd8548e30e90e3

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
12/26/2024 7:33:50 AM UTC  (today)

Scan engine
Detection
Engine version

Quick Heal
(Suspicious) - DNAScan
5.16.14.00

Trend Micro House Call
Suspicious_GEN.F47V0412
7.2.124

File size:
653.9 KB (669,545 bytes)

Product version:
1.5.1

Copyright:
Copyright © 1994-2001 TG Byte Software GmbH. All rights reserved.

Original file name:
WinExitSETUP.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\winexitsetup.exe

File PE Metadata
Compilation timestamp:
3/23/2039 8:47:05 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:OxsS13s36UCc830LMkY0Lx31DVIvoIzqMke2DVwbvcBGNgMKWuY3Js:1g83lV8EI1y/DVIwNMAOUGNuzY3e

Entry address:
0x1000

Entry point:
A1, FF, D0, 41, 00, C1, E0, 02, A3, 03, D1, 41, 00, 57, 51, 33, C0, BF, 70, 31, 42, 00, B9, 38, 3A, 42, 00, 3B, CF, 76, 05, 2B, CF, FC, F3, AA, 59, 5F, 6A, 00, E8, 36, F8, 00, 00, 59, 68, C8, D0, 41, 00, 6A, 00, E8, 64, B9, 01, 00, A3, 07, D1, 41, 00, 6A, 00, E9, DE, A5, 01, 00, E9, B3, F8, 00, 00, 33, C0, A0, F4, D0, 41, 00, C3, A1, 07, D1, 41, 00, C3, CC, B9, B0, 00, 00, 00, 0B, C9, 74, 39, 83, 3D, FF, D0, 41, 00, 00, 73, 0A, B8, E2, 00, 00, 00, E8, E3, FF, FF, FF, 68, B0, 00, 00, 00, 6A, 40, E8, 88, B9...
 
[+]

Code size:
112 KB (114,688 bytes)

The file WinExitSETUP.exe has been seen being distributed by the following URL.

http://winexit.w.interia.pl/WinExitSETUP.exe

Scan WinExitSETUP.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.