home

ws0e2d4b60.dat

Tibia Player

CipSoft GmbH

Publisher:
CipSoft GmbH

Product:
Tibia Player

Version:
8.54

MD5:
331f72a2778249433f563dfd71486e74

SHA-1:
14188e10a3e5b578db15fad75041a874262c093e

SHA-256:
0a57ddc4beee418cd295e957923f9ad7455d0b5c9b76ff56d674c058ca244ca4

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/26/2024 3:04:49 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.HfsAutoB
1.3.0.7383

File size:
31.4 MB (32,893,910 bytes)

Product version:
8.54

Copyright:
Copyright (C) CipSoft GmbH 2002-2009

Trademarks:
Tibia is a registered Trademark of CipSoft GmbH.

Original file name:
Tibia.exe

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
12/8/2009 7:45:51 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
786432:xpYe7mHFhX4YT5UnWbZleoG6o3hXgupz0DqSFhQ:Val64PzoxwOz0ji

Entry address:
0x6A2B33

Entry point:
E8, 00, 00, 00, 00, 60, E8, 4F, 00, 00, 00, E3, 33, 67, 55, BD, F6, 3C, AE, C7, 18, 1B, 9B, 1B, B5, 9A, 81, C3, B7, 09, 34, 82, 9A, C2, 33, A6, F3, A1, 0B, BE, E9, DA, CC, 07, 6B, 30, 6C, 34, 31, 2C, 3F, 1C, AF, 4C, 51, AF, F9, 67, DA, F7, 4D, 2C, 42, AC, 11, D9, BD, F7, 4D, 2C, 42, AC, 11, D9, BD, E9, 1A, 6D, 00, 00, E9, 2E, 6D, 00, 00, E9, 29, 6D, 00, 00, E8, 6E, FB, FF, FF, 6E, 04, 01, 00, 82, 99, 00, 00, EF, 08, D7, 9B, CE, BA, D1, D6, 6E, 87, 74, D6, C4, E7, 91, 2F, 37, A8, D0, 3D, C9, 71, 69, E5, 8A...
 
[+]

Packer / compiler:
MoleBox v2.0

The file ws0e2d4b60.dat has been seen being distributed by the following 7 URLs.

http://download1636.mediafire.com/yp7wh294q3ag/.../NTOLost.exe

http://download1913.mediafire.com/1z8p35bny1sg/.../NTOLost.exe

http://download755.mediafire.com/qocdlqqa90wg/.../NtoLost.exe

http://download2184.mediafire.com/rb485lyn0v8g/.../NTOLost.exe

http://download2184.mediafire.com/pbt7mp4bp75g/.../NTOLost.exe

http://download1063.mediafire.com/nhab7fqu31vg/.../NTOLost.exe

http://ntolost.com/ntolost.exe

Scan ws0e2d4b60.dat - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.