home

рыбное место.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from downloader.disk.yandex.ru and multiple other hosts.
MD5:
dc40a43cd43a438e3114bcb6afe68b12

SHA-1:
cacc0574d3a1769f349c5b9a7f47a92465c69dca

SHA-256:
9fe89dafbd2d4f380d186a0849953716249a90918b0fe0856dd99fffd4b3f7b5

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/24/2024 10:14:30 PM UTC  (today)

Scan engine
Detection
Engine version

McAfee
Program.Artemis!DC40A43CD43A
18.0.204.0

File size:
793 KB (812,032 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:1//HmJCgLnWv01P/q/vP4MRBh5S7g7euZJ:Z/HMg05/qvR5S7g7euH

Entry address:
0x1883C0

Entry point:
60, BE, 00, 80, 4C, 00, 8D, BE, 00, 90, F3, FF, C7, 87, 9C, F0, 13, 00, 11, D7, 52, 83, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:
772 KB (790,528 bytes)

The file рыбное место.exe has been seen being distributed by the following 4 URLs.

https://downloader.disk.yandex.ru/disk/5ee1c3ca14f5047a96f7fdcf5ca8746b2df011917507c5fdf1a42b711544ee08/581dc46d/.../x-msdownload&fsize=1353728&hid=4be85466ad2ffe4aa5d9b29cc75a5c7c&media_type=executable&tknv=v2

https://downloader.disk.yandex.ru/disk/99f0484db907af615db102b897ee2d3b3bf0a3fedd23509bf8652bce5501eaed/5749cf46/csQz7IEFs_yaeWR-K5C4KIkz5H4cdkOEAm0-JwPVGIKCI-7rDIFpIggVVFCHyCOtwPRFDwQkp_yaL3Z0caaRcg==?uid=0&filename=?????? ?????.exe&disposition=attachment&hash=8D1VH2u 6hk2tyxbyK65d2WQo1GwoWH37/.../x-msdownload&fsize=812032&hid=7d8c296d9f3822cf9c43d7931c6112a6&media_type=executable&tknv=v2

https://zima3f.storage.yandex.net/rdisk/d98b9e861f3c9c6fb3936f617fbf0b224cc2fd3fc31f5c25e32f7322eb707b02/5676f2c8/csQz7IEFs_yaeWR-K5C4KIkz5H4cdkOEAm0-JwPVGIKCI-7rDIFpIggVVFCHyCOtwPRFDwQkp_yaL3Z0caaRcg==?uid=0&filename=?????? ?????.exe&disposition=attachment&hash=8D1VH2u 6hk2tyxbyK65d2WQo1GwoWH37/.../x-msdownload&fsize=812032&hid=7d8c296d9f3822cf9c43d7931c6112a6&media_type=executable&tknv=v2&rtoken=876553fcd08c3e4d9acc94b407c85688&force_default=no&ycrid=na-96e1e05da12c9faa814a8e35e32e4bd5-downloader8h

http://rghost.ru/download/56813782/.../?????? ?????.exe

Scan рыбное место.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.