home

babel.exe

Babel Obfuscator

Alberto Ferrazzoli

The executable babel.exe has been detected as malware by 9 anti-virus scanners. The file has been seen being downloaded from plasmon.rghost.ru and multiple other hosts.
Publisher:
Alberto Ferrazzoli

Product:
Babel Obfuscator

Description:
babel.exe

Version:
4.0.0.0

MD5:
cfb8b3262964bfa07c71363261c2e254

SHA-1:
ac539d2ff71f8ef55763b5cbcb862f92caa231cf

SHA-256:
9a3e6977c5dc370f8f4b7ffafa64ffedaad91dc0fa06378d5e8f870a07d3b37b

Scanner detections:
9 / 68

Status:
Malware

Analysis date:
5/10/2024 6:13:06 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
2014.9-140128

AVG
Dropper.Generic6
2015.0.3581

Baidu Antivirus
Trojan.MSIL.Packed
4.0.3.14128

Bkav FE
W32.Clod1c0.Trojan
1.3.0.4923

Comodo Security
UnclassifiedMalware
17688

G Data
Win32.Trojan.Agent.4LIW9S
14.1.24

IKARUS anti.virus
Win32.Malware
t3scan.2.2.29

Norman
Suspicious_Gen4.DDBLW
11.20140128

Reason Heuristics
Unnamed.Threat.18
14.2.27.5

File size:
1.4 MB (1,478,656 bytes)

Product version:
4.0.0.0

Copyright:
Copyright © 2010-2011 by Alberto Ferrazzoli. All rights reserved.

Original file name:
babel.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\babel\babel.exe

File PE Metadata
Compilation timestamp:
4/25/2011 10:06:35 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:nVuUpz8xRANUgLjjN1S4P6cy+tSKFZjOu1EK14wRISxFm:nVuUV8cS8jjnSoBAi1gh

Entry address:
0x162A1A

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1929

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
1.4 MB (1,444,864 bytes)

The file babel.exe has been seen being distributed by the following 2 URLs.

http://plasmon.rghost.ru/download/55837508/.../babel.exe

http://rghost.net/download/55837508/.../babel.exe

Remove babel.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.