home

5fe9c.exe

Stpll

Cortez Com

The application 5fe9c.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup. The file has been seen being downloaded from www.panningmanybanded.site.
Publisher:
Cortez Com

Product:
Stpll

Description:
fast install

Version:
186.145.40.161

MD5:
b03d69be1d7dba3ec234a2a2e6e33a50

SHA-1:
522887947dc8eef7571c7ecbca57c4662c4346a6

SHA-256:
181c9fe70d1a8e3aa87372a52ae9d74ca0e6b40ba22cfa3516ec90e7ce8b7274

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallMonetizer distribution platform to bundle adware.

Analysis date:
5/12/2025 11:23:08 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.InstallMonetizer.CortezCo.Installer.Meta (M)
16.7.12.13

File size:
1.1 MB (1,161,728 bytes)

Product version:
186.145.40.161

Copyright:
CL2016

Trademarks:
US CAPS

Original file name:
file.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\5fe9c.exe

File PE Metadata
Compilation timestamp:
5/11/2016 5:17:15 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:gli/eCsJGaaKYrt2di4wtXRzl0JLVYlavAKhz:Mi/vcqIg4WBJ0JVvDz

Entry address:
0xAD69

Entry point:
E8, 09, 5C, 00, 00, E9, 39, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 5F, 00, 00, 00, C7, 06, F0, 4B, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 5F, 00, 00, 00, C7, 06, F0, 4B, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 56, FF, 75, 08, 8B...
 
[+]

Code size:
130.5 KB (133,632 bytes)

The file 5fe9c.exe has been seen being distributed by the following URL.

http://www.panningmanybanded.site/.../5fe9c.exe

Remove 5fe9c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.