home

winzip20_mf.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from www.winzipdownloadfiles.com.
MD5:
bd755ed3287267834f580cb033c9bab4

SHA-1:
ec3aad7b7bd6bceeec50240f1fdb9413f32f5c56

SHA-256:
58ad28b4faff8d36a99fed2538b3922f47693ed7a16e4b0cd801d2c382e9053c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 3:30:35 PM UTC  (today)

File size:
689.8 KB (706,321 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\winzip20_mf.exe

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
12288:GzvZkpxJWKe7rHkj+bF/2kS7d9PuaIYNVbrzWLjB/LaIRNNEF8yqx4vRjcU3:64e7rHjhS7TFprzWzEF8y9ZjZ3

Entry point:
46, 00, E8, C8, D2, 01, 00, CC, CC, 55, 8B, EC, 56, 8B, F1, 8B, 4D, 08, 57, 8B, 7E, 10, 3B, F9, 0F, 82, 88, 00, 00, 00, 8B, 55, 0C, 8B, C7, 2B, C1, 3B, C2, 77, 27, 83, 7E, 14, 08, 89, 4E, 10, 72, 10, 8B, 06, 33, D2, 5F, 66, 89, 14, 48, 8B, C6, 5E, 5D, C2, 08, 00, 8B, C6, 33, D2, 5F, 5E, 66, 89, 14, 48, 5D, C2, 08, 00, 85, D2, 74, 4A, 83, 7E, 14, 08, 72, 04, 8B, 06, EB, 02, 8B, C6, 2B, FA, 53, 8D, 1C, 48, 8B, C7, 2B, C1, 74, 10, 03, C0, 50, 8D, 04, 53, 50, 53, E8, E0, 3E, 03, 00, 83, C4, 0C, 83, 7E, 14, 08...
 
[+]

The file winzip20_mf.exe has been seen being distributed by the following URL.

http://www.winzipdownloadfiles.com/c?fallback_url=http://download.winzip.com/gl/oemg/winzip20_mf.exe&x=8ddECX1 pC 9Un2nhYx/.../A 5Q=&downloadAs=wz20-mf.exe&c=eg d0eFjvALbhxHV8p4gInYAb7A0CVhJ1gZUh8 jsOqs7dF0XnjkLerRzivc0pLuN3 tDyjW8Ab0TeJTDhqtcgqVv5JIBEajyqXFsLAxmdPlM 6vEcU3j41ffdWm1xrf

Scan winzip20_mf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.