ascentia.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from funcraft-1.as-static.fr and multiple other hosts.
MD5:
494fcd1061795018107893df77385e1a

SHA-1:
65dcadf3559fe1091676631c58fb562b12f3db32

SHA-256:
a5ff63b1ddb87d0ba405368e77e16f71b7788834c469744454297f257b6e1be5

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
2/17/2014 12:53:39 PM UTC  (eight months ago)

Scan engine
Detection
Engine version

Rising Antivirus
PE:Malware.XPACK/RDM!5.1
23.00.65.131231

Trend Micro House Call
TROJ_GEN.F47V0822
7.2.2

File size:
813.9 KB (833,424 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\user\downloads\ascentia.exe

File PE Metadata
Compilation timestamp:
6/13/2013 3:52:57 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
12288:d8qWlkHNrin7UVfuPWdgMuAuVhON1T2c75VBfU3Z1Wy8dc4iBN:dklkHNC7IyWayuVOf5PfUpWy4if

Entry address:
0x1290

Entry point:
55, 89, E5, 83, EC, 08, C7, 04, 24, 02, 00, 00, 00, FF, 15, 9C, 12, 41, 00, E8, A8, FE, FF, FF, 90, 8D, B4, 26, 00, 00, 00, 00, 55, 8B, 0D, DC, 12, 41, 00, 89, E5, 5D, FF, E1, 8D, 74, 26, 00, 55, 8B, 0D, C4, 12, 41, 00, 89, E5, 5D, FF, E1, 90, 90, 90, 90, 55, BA, 80, 00, 00, 00, 89, E5, 57, 31, C0, 8D, BD, E8, FE, FF, FF, 56, 53, 81, EC, 1C, 01, 00, 00, 89, 54, 24, 08, 89, 44, 24, 04, 89, 3C, 24, E8, 37, 40, 00, 00, 89, 7C, 24, 04, C7, 04, 24, 18, 00, 00, 00, E8, 07, 0B, 00, 00, 85, C0, 0F, 84, 7C, 00, 00...
 
[+]

Entropy:
7.7492

Packer / compiler:
MingWin32

Code size:
18.5 KB (18,944 bytes)

The file ascentia.exe has been seen being distributed by the following 3 URLs.

There are numerous known code variantions that share the same compilation structure.

0 / 68
techniclauncher.exe  3.0.0.439  (5220405ea248083bac4fdec6847e663f4b9efeec)

1 / 68
SimpleBGC_GUI.exe  2.40b7  (77a4ba54abf35ed65aa197a72b9f829932444b48)

2 / 68
liteloader-installer-1.7.10-04.exe  1.7.10-04  (84135b42d56a9eab35bab20dcd80e7f4bd1ea09b)

0 / 68
forge.exe  1.5.26.0  (3ee7da4fd6c1fcd6cc081699095239e231d04685)

0 / 68
ruzzleforpc1.exe  1.0.0.0  (cd6812cd48110ea4a7969b5dd512521504a1194b)

0 / 68
ruzzleforpc1.exe  1.0.0.0  (60233b7edea41885b10b67e64879f4acb053ea0a)

0 / 68
adventure installer windows.exe  (1ee7d9093afe4b33f1f36556b489547e9a6dcba2)

0 / 68
setup_superdeepthroat.exe  (e14b341213fc185d43bb7bb3bb48030fa4813775)

0 / 68
videosketch.exe  (80bb1a1e735f941535b6c7aeffc8e255990c8339)

0 / 68
minecraft_server.13w23b.exe  (04657066c3f03ace103fa4ef2b7308670d53d1b8)

0 / 68
craftua.exe  (9faf02ffff1d824353b053931165506537fcfd4e)

1 / 68
reader-agent.exe  (195d1a3ae379d25c0ff2e9a9d236ded54e6e2ef9)

1 / 68
reader-agent-elevated.exe  (642539a2d9a559f1844711b944c71663d5b6fc13)

1 / 68
finemine.exe  (106f8b5f73da9836a7c395d03c1d2ca5e9eeb50c)

3 / 68      (inconclusive)
pedownloader23222.exe  (28dbfc958e917aeeabe026e88f41898a045d2b2b)

Distribution by Country