home

agar.io.exe

The program is a setup application that uses the Self-extracting archive installer. The file has been seen being downloaded from www.senddeliveryshare.com and multiple other hosts.
MD5:
d366ba1d0f1bce860834217614407f84

SHA-1:
478b15d8757c78ac210dbd210be6417a3a83cfc4

SHA-256:
b51f394eb7546cd3896710521d0d946d6a8b58c9b3fbce2c1afe22d66c38dfd4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/25/2024 3:00:11 PM UTC  (today)

File size:
192.3 KB (196,937 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Self-extracting archive

Common path:
C:\users\{user}\downloads\agar.io.exe

File PE Metadata
Compilation timestamp:
8/22/2013 8:00:50 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:K5S0VvIH4lindUJXw58BkgnyNMIoVtmvVg4gdYbnybcapz/0Ic6o+FcLH8/SkP4:Ka4InuJg58BkgqPoDH49n8Bb/cQ/m

Entry address:
0x1D348

Entry point:
E8, F0, 57, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 05, FD, FF, FF, C7, 06, F4, 81, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, F4, 81, 42, 00, E9, BA, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, F4, 81, 42, 00, E8, A7, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, CD, C9, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Entropy:
6.4960

Code size:
148.5 KB (152,064 bytes)

The file agar.io.exe has been seen being distributed by the following 6 URLs.

http://www.senddeliveryshare.com/uoCfsLCs0lfL uBo77HlALQ8kr9JMXf04bCAPd4f GKHtQiWFICSUfCqNud_zirrFYkJQZJV0 VpuUivd2lS3VfDWZZkG1mx1c00CeToj467la3BLeBISIo4 kPpHCs5wrCXrHFbzLjWFpqLVYVGnyJvB9P6 bnO6A5GsmIzjjsRDKM64OpkMFfK9U893SVzVrm7wLl7k1t8eDb27vualSix6O11zcO7omnjk3Ge5rD0W n2sgXptRMyCIxpc_gtiQzldnUbsSUN4VK0cZ7_hv_4o9Ri7IACLvqq6Alt a9_WgCD21d9GtrfvCISJZlxq2Gz_Ap8dGhjU22WuaA1LvksUQyarVBphg0nVv7xgIlUzr2Jt qLZUADukLNnS9HTBV1_gMyfcGqFYbErw6wBPQDlK0TlPKrSHrnBsAojy7oseFfNJIJb6fQgtjttlzZDgTh1Xy-Gz0AAEQ3F5MzZNNL3mGI4QhaDg45YL0UpC1gCTbG8DyRRnpji7Ywx1KgVzPfh0_rTE61R3JQDX0B

http://www.giftvaultbinaries.com/fzCDOk EHhmqPPxbYZY9bVR0AjFiCF4eTbx87xwEqp5 E 0imlpB7EA08Ligkzg4MXi5pZKzgY8xTMNL5Rh_UL7qX HsPu2KzpRZHXrXoNKQMBsayfMbAX8FefUZbUIU z2YAh1S9Qr_VaU4kP1w1 SyBB0aGmn8AM30O7LoFcbLbSsEX3g5ZpVVZeYaEHHAN00EN1Y5FtAY9cS4O3Sx0KfBvS3gx0pqLglSihOw7ezjgggZCjB INu5gkIrIyAT_pAIeLsRNeW r11papAUqa8Hj3GlJRjnJB0tAAtZj_wgDbWPSW_jzVLqjrxgOH5Z8IIlM4abdVobj7MAAZxbOUsyGefEhmo_nIiseO6MUJxOt8cI1bcGxB8ZS6XQxssbyQ3KxPAeOSu8AF2k6Fwb6k4_yuSi8y1y4OvEEfMraQ_5sb70F9tXKXnSuX0Jw7a7E11iFPv8-Gz8AAETdFtP3kK2WNmEM0 FH0DEOWO9a1sEGH0QHj2E7XpdE0Rtz5GGbA2dHFJCjms9 ck0us3FLF_oC

http://www.senddeliveryshare.com/WVl6OTRQVUpEYkZKSE1EaExUVWRVZERGc1dWQjBRMVZ2WmtGR1FtTndhRWQ2YmxGR2FXRXhNMmxqV0c5S2MzY2xNMFFtWXoxc1ZYQXdVbEZvVGpaVVdsRm5XakY1T0RKUU1WVjRPRTFvSlRKQ2VqVXlkRVpaSlRKQ1VWUlljVFpPU2tsWU4yODFabkZvVHpremRFVmpVRFpMVUZWR01HaExUSGxQVFZNeVdrcHVRMFJDVVRWaFdrSmlRa1pQTlVKNmNWRlNZbEJ6Ykc5d1VqaHBZMmw1YlRWNVdYWlVORmwxWm5GbmNUTk5TR0pRTW10NWEwUm9kREltWkc5M2JteHZZV1JCY3oxQloyRnlMbWx2TFRFdU1DNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1pwYm5SMllUSXVkMkZ5Wld4cFluSmhjbmt1YVc1bWJ5VXlSbVJzSlROR1ltTWxNMFF4TWpBeE16RTVKVEkyWXlVelJGSnZZMnQ1UW5sMFpYTWxNalptYVd4bGJtRnRaU1V6UkVGbllYSXVhVzh0TVM0d0xtVjRaU1V5Tm5OdmRYSmpaU1V6UkhOdmRYSmpaU1V5Tm1GcFpDVXpSRUZuWVhJdWFXOGxNalp3Y205a2RXTjBTMlY1SlRORWFXZGtaR2szZDI5MmVYcGxlRzUwZHpaaWRYSmllV2RpYVRKaGRHdHROak1sTWpaNlZHMXdKVE5FTVE9PQ==

http://cdn.parsecmediafiles.com/c?x=vk6GVUoMHXay3h55Xh0grd1GhkxYtF8hxYDZQrWjk/8=&c= PzogUprxOxQvjxJl89tpzrm0AVh lt5cPOPft4TOj ffqRIaFCXS/uqMn4IUpc7pYH0fgsp5xucOrOOPMcF/A==&downloadAs=Agar.io.exe&fallback_url=http://.../rockybytes?rockybytes_id=885&brand=programwardrobe.com

http://www.senddeliveryshare.com/WVl6OTRQWFF3VW5aMFRYQTFSSEIwZW1oeFRFcElSV1Z0WlhCNGJqY2xNa0paZUhKTWNteGhaMnhuZGpWdFZtbzFheVV6UkNaalBWaFVOSEJIU0dVelRXRndPWGRpTUZOTlluQkViVXhtWnlVeVFraG9OM0J4VFdsWmRUbDNSSGQyTTNNMGQzaHVUV0ZvUXlVeVJsUnFhelFsTWtaSlRTVXlSbVYwVWtGMFkxRk5NbTFaWkdoWlRTVXlRa1pRTkVNMmRFOXJXbWRZZEZWa1NrWnllbHBhTUhsMFZqWkNTMHh4TjFaalZHbzNOR0ZyV1hCd2NuSTJTM1lsTWtKQlJqQkJjVmgySm1SdmQyNXNiMkZrUVhNOVFXZGhjaTVwYnkweExqQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHYVc1MGRtRXlMbmRoY21Wc2FXSnlZWEo1TG1sdVptOGxNa1prYkNVelJtSmpKVE5FTVRJd01UTXhPU1V5Tm1NbE0wUlNiMk5yZVVKNWRHVnpKVEkyWm1sc1pXNWhiV1VsTTBSQloyRnlMbWx2TFRFdU1DNWxlR1VsTWpaemIzVnlZMlVsTTBSemIzVnlZMlVsTWpaaGFXUWxNMFJCWjJGeUxtbHZKVEkyY0hKdlpIVmpkRXRsZVNVelJHbG5aR1JwTjNkdmRubDZaWGh1ZEhjMlluVnlZbmxuWW1reVlYUnJiVFl6SlRJMmVsUnRjQ1V6UkRFPQ==

https://mega.nz/temporary/.../a5cViSLZ

Scan agar.io.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.