home

فلود شلة خراب.exe

Cobra

The executable فلود شلة خراب.exe has been detected as malware by 4 anti-virus scanners. The file has been seen being downloaded from dc379.4shared.com.
Product:
Cobra

Version:
1.00

MD5:
fd5b8f11361450a7ec341b8e8d47e81c

SHA-1:
dace2d71b8a28a77e156a0a7838bc98b22e35e09

SHA-256:
68072dc7abd6436b3138c4c211834bbc4159de056d8d56306cbb9c7dfc7904d6

Scanner detections:
4 / 68

Status:
Malware

Analysis date:
4/26/2024 10:10:04 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Agent.69632.799
8.3.2.4

Dr.Web
Trojan.MulDrop3.33736
9.0.1.0145

F-Prot
W32/Virut.AI!Generic
v6.4.7.1.166

NANO AntiVirus
Trojan.Win32.MulDrop3.dcicdt
1.0.14.5380

File size:
68 KB (69,632 bytes)

Product version:
1.00

Original file name:
Cobra.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\فلود شلة خراب.exe

File PE Metadata
Compilation timestamp:
10/8/2004 10:38:30 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
768:qlwcIFJgJEhoGk9xYjQOT62UEosrsEz2MnpYF55eJzgv73NpbcVZjhSTZUBbZDHq:qkai6M0D2J30wpmGJG73DIeTZqbd

Entry address:
0x11C8

Entry point:
68, A4, 70, 40, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 36, 20, 6E, 6F, 79, A4, EF, 43, B7, 72, 72, 70, 12, 83, 74, 61, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 50, 72, 6F, 6A, 65, 63, 74, 31, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, FF, CC, 31, 00, 08, 35, F0, 7A, A9, A5, 92, D5, 43, 9F, 71, 0F, 9D, 0F, 3D, 7C, D4, 60, 37, 5E, B2, A6, 4D, 2C, 40, B3, A1, 70, A7, E1, 94, A7, 4E, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Entropy:
5.6148

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
32 KB (32,768 bytes)

The file فلود شلة خراب.exe has been seen being distributed by the following URL.

http://dc379.4shared.com/download/.../___online.exe

Remove فلود شلة خراب.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.