home

winzip70.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from especializacion-eva.ifdve.org and multiple other hosts.
MD5:
9e31ba8854669157cc9ad5869dca567f

SHA-1:
08fd56feb8f845726a225313d6afeb01a233616b

SHA-256:
805a0dc8f4cf4f33597a7c797fee00ec79e53ada9b94d4db1a630a88b81e9962

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 10:20:34 PM UTC  (today)

File size:
921.7 KB (943,835 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
4/20/1998 5:28:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
4.20

CTPH (ssdeep):
24576:Oysmk6zR1CoRzBae+ENxCiNjcttHlRa0eRVIfbtenzPIO:kQR1CoRnNxyC0eRKfEnrIO

Entry address:
0x3CA9

Entry point:
FF, 15, 70, 92, 40, 00, B1, 22, 38, 08, 74, 02, B1, 20, 40, 80, 38, 00, 74, 10, 38, 08, 74, 06, 40, 80, 38, 00, 75, F6, 80, 38, 00, 74, 01, 40, 33, C9, 51, 50, 51, 51, FF, 15, 74, 92, 40, 00, 50, E8, DD, F3, FF, FF, C3, 8B, 44, 24, 04, 8B, 40, 3C, 05, F8, 00, 00, 00, C3, 83, EC, 04, 33, C0, 8B, 0D, 28, 85, 40, 00, A3, EC, 84, 40, 00, A3, 24, 85, 40, 00, 89, 0D, 94, 86, 40, 00, C7, 05, D0, 83, 40, 00, FF, FF, FF, FF, 39, 05, E0, 78, 40, 00, 75, 05, E8, 99, D4, FF, FF, 83, 3D, 0E, 85, 40, 00, 00, 76, 74, 0F...
 
[+]

Entropy:
7.9915

Packer / compiler:
WinZip, 0x32-bit SFX v6.x module

Code size:
19.5 KB (19,968 bytes)

The file winzip70.exe has been seen being distributed by the following 16 URLs.

http://especializacion-eva.ifdve.org/location.cgi

http://www.astrologia.com.ar/.../winzip70.exe

http://s10150.chomikuj.pl/File.aspx?e=mC2NrdkYZbtnYLR90RiQVjvlIbkuLB5-ysEkUFvxYY0hMILvCDBJKHc4alc5QLiO3x134BS3ytsxXd7mB07ZTytDTWk_jUWVKIPLsUgS51N0_VvILnADGHHlTPcCaknqmJkQNs_39a3RARLe27Th4A&pv=2

http://www.vpmn-helpdesk.com.vn/agentloginweb/.../winzip70.exe

http://s10150.chomikuj.pl/File.aspx?e=jfeepoqMdYNpkwvawNfYn1NaX7VdJzXQ_TjRe3xxHgobIME0VlF8yMAy-PwXdVtimPoV5utB7fA4dTLn9phb7UwVMjcBL3mpgtTcBNiXqbPtsvjvh-3czJvXPKboLflh&pv=2

http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTQ3MDk3NzAzMTtzOjI6ImlkIjtpOjY3NjA7czo0OiJmaWxlIjtzOjEyOiJ3aW56aXA3MC5leGUiO3M6MzoidXJsIjtzOjQ0OiJodHRwOi8vd3d3Lm9sZHZlcnNpb24uY29tL3dpbmRvd3Mvd2luemlwLTctMCI7czo0OiJwYXNzIjtzOjMyOiIwNTRlMDliY2E3MDg3OGU2OTFjYjk1MDhkN2U4OTQxOSI7fQ==

http://fnp.cisl.it/Informat.nsf/cd8e9d07106925cdc12569d0003ec54d/85e00a9625968566c12569d000554224/.../winzip70.exe

http://www.siat.unrc.edu.ar/siat2/archivos/idAula131283/software//Winzip.exe

http://s10014.chomikuj.pl/File.aspx?e=mC2NrdkYZbtnYLR90RiQVm_JLf2rxW-y-pbZNdTun_vyCnVivLx26nO43XN4hjYN6qdpzfIPkX5XvFKV1MVpnE-9m1H0eriBYaF6Q7tKAPSuoJv1iUNd-oWlhFDyaNT37Ul2FKnwkRPOnouUcjPKzQ&pv=2

http://s10014.chomikuj.pl/File.aspx?e=jfeepoqMdYNpkwvawNfYn7yAmB_Mb3axwdWRNVp9FFivebJ0mFDdcDgk97YbhoLemoGkFf-ugmNJk9yITSpMbbmzgOxlIY8VAlgBz5TvUj9-jt8AuzFS2bkzFmi2O0by&pv=2

http://s10014.chomikuj.pl/File.aspx?e=jfeepoqMdYNpkwvawNfYn1Nx3_kJqqKLnp_85_xnj74V7WAizoTz2NB8orM_ItPI6K8ChLviiK8APGc-2xebYsdhM0A1shrbThEXyq1LrMZYRbZy6ZZI0fEFEms7EVPl&pv=2

http://www.muzyczka.pl/.../winzip70.exe

http://www2.hawaii.edu/~pager/.../winzip install.exe

http://w2.nkhs.tp.edu.tw/????/b12/a3/.../winzip70.exe

http://www.qsl.net/n0wnt/.../winzip70.exe

http://www.erma.net.pl/.../winzip70.exe

Scan winzip70.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.