home

beeaccounting-2.7.exe

The program is a setup application that uses the Self-extracting archive installer. The file has been seen being downloaded from www.beeaccounting.com and multiple other hosts.
MD5:
d283b1b83cd9534f5c9059c01ac500d4

SHA-1:
15c800c57d767cf8f150961484145158dbdc33e8

SHA-256:
925b12f9d08119d46619ae72694bfcd21dfeb256d066ff3ffd4e4ee9e74ceaa4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 5:19:15 AM UTC  (today)

File size:
172.4 MB (180,809,560 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Self-extracting archive

Common path:
C:\users\{user}\downloads\beeaccounting-2.7.exe

File PE Metadata
Compilation timestamp:
2/15/2015 3:00:31 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3145728:s37MVpL6VKxrj/H/5Ol7sxYQULM6f/I8/P2UZTUMBUWpTvksfZD+8rrd5CwQSG:s37MV16MrDH/kFscjf/dJKMnvkiZzru1

Entry address:
0x1D7CB

Entry point:
E8, 85, 63, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 82, FC, FF, FF, C7, 06, 20, B2, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 20, B2, 42, 00, E9, 37, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 20, B2, 42, 00, E8, 24, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 52, CA, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Entropy:
7.9998  (probably packed)

Code size:
162 KB (165,888 bytes)

The file beeaccounting-2.7.exe has been seen being distributed by the following 14 URLs.

http://www.beeaccounting.com/.../windowsdl

https://www.google.com/url?hl=id&q=http://www.beeaccounting.com/.../windowsdl&source=gmail&ust=1475641918663000&usg=AFQjCNHtHRPirTznGkH968P82CkoJrDC0A

http://go.sparkpostmail.com/f/a/u05u5cJjTlJ6UYMC3ORZvA~~/.../RgRZGpRPP0EIAWucpIuCYygXWAQAAAAAWQZzaGFyZWRCCgAFz2A5V6w_lkRSG2dhbWFlbmdsaXNoY291cnNlQHlhaG9vLmNvbQlRBAAAAABEKGh0dHA6Ly93d3cuYmVlYWNjb3VudGluZy5jb20vei93aW5kb3dzZGxHAnt9

https://www.google.com/url?hl=id&q=http://www.beeaccounting.com/.../windowsdl&source=gmail&ust=1480116098939000&usg=AFQjCNHc6EbTEbbBa8vW43RvGTrT0H9Nwg

http://mandrillapp.com/track/click/.../www.beeaccounting.com?p=eyJzIjoiOXR1bERXSTVFZWxDcFBKcVNRSVlaRHFseVRjIiwidiI6MSwicCI6IntcInVcIjozMDY4NDUxNCxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvd3d3LmJlZWFjY291bnRpbmcuY29tXFxcL3pcXFwvd2luZG93c2RsXCIsXCJpZFwiOlwiNWQ2ZmFjNjAxNWRlNGNjYmE1NTUwZGE3MTAyNGUwZTJcIixcInVybF9pZHNcIjpbXCJhZjBiN2FlNGJhNWNjMTkwNWFiZWNkNDJmN2Q4ZDhkODRjOTg0MGE4XCJdfSJ9

https://www.google.com/url?hl=id&q=http://www.beeaccounting.com/.../windowsdl&source=gmail&ust=1480564098873000&usg=AFQjCNHF_c9k3Cru65g9_NjI8DcRwJH52Q

http://mandrillapp.com/track/click/.../www.beeaccounting.com?p=eyJzIjoiSEVkZnRyXzEwRF9wM0U5dWZFUGNfeVh3cU9rIiwidiI6MSwicCI6IntcInVcIjozMDY4NDUxNCxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvd3d3LmJlZWFjY291bnRpbmcuY29tXFxcL3pcXFwvd2luZG93c2RsXCIsXCJpZFwiOlwiNzk5YjZlZDdlMWViNDQwN2IzN2FhZjk3MTgzYjEwYmRcIixcInVybF9pZHNcIjpbXCJhZjBiN2FlNGJhNWNjMTkwNWFiZWNkNDJmN2Q4ZDhkODRjOTg0MGE4XCJdfSJ9

http://mandrillapp.com/track/click/.../www.beeaccounting.com?p=eyJzIjoiTk4xWUp0UFZFVjBPR2JFcEF6eGdud2JHV05jIiwidiI6MSwicCI6IntcInVcIjozMDY4NDUxNCxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvd3d3LmJlZWFjY291bnRpbmcuY29tXFxcL3pcXFwvd2luZG93c2RsXCIsXCJpZFwiOlwiYzgxOTE0OWY5NjE0NDA0MWJmMDNhOWRjZTMwMzk1NGRcIixcInVybF9pZHNcIjpbXCJhZjBiN2FlNGJhNWNjMTkwNWFiZWNkNDJmN2Q4ZDhkODRjOTg0MGE4XCJdfSJ9

http://go.sparkpostmail1.com/f/a/byzF1so_qojTGyXZ6_jKlA~~/.../RgRZBB_2P0EIASuRTA-KblkXWAQAAAAAWQZzaGFyZWRCCgAEduwiVysZRApSE2RfbGlhdzlAeWFob28uY28uaWQJUQQAAAAARChodHRwOi8vd3d3LmJlZWFjY291bnRpbmcuY29tL3ovd2luZG93c2RsRwJ7fQ~~

http://mandrillapp.com/track/click/.../www.beeaccounting.com?p=eyJzIjoiV3VzYTVLeDNvTzFiNzExeEZfM0RsQXM2UjY0IiwidiI6MSwicCI6IntcInVcIjozMDY4NDUxNCxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvd3d3LmJlZWFjY291bnRpbmcuY29tXFxcL3pcXFwvd2luZG93c2RsXCIsXCJpZFwiOlwiYmY4ODJmY2I0NjJlNDRmMGIwNWU1YzJlOTJkN2RjODlcIixcInVybF9pZHNcIjpbXCJhZjBiN2FlNGJhNWNjMTkwNWFiZWNkNDJmN2Q4ZDhkODRjOTg0MGE4XCJdfSJ9

http://beeaccounting.com/.../windowsdl

http://mandrillapp.com/track/click/.../www.beeaccounting.com?p=eyJzIjoialZQcVNtdXByMVFPX0RkQTRtY1kwV3dhTUF3IiwidiI6MSwicCI6IntcInVcIjozMDY4NDUxNCxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvd3d3LmJlZWFjY291bnRpbmcuY29tXFxcL3pcXFwvd2luZG93c2RsXCIsXCJpZFwiOlwiNTRkOGUzYzgzNDc3NDRiOGEwNzRkMmVhMzc1NzNkZmFcIixcInVybF9pZHNcIjpbXCJhZjBiN2FlNGJhNWNjMTkwNWFiZWNkNDJmN2Q4ZDhkODRjOTg0MGE4XCJdfSJ9

http://mandrillapp.com/track/click/.../www.beeaccounting.com?p=eyJzIjoiMmc3VGNkZlN3ZzZESUpWY3NNYWxuMjRZOVpZIiwidiI6MSwicCI6IntcInVcIjozMDY4NDUxNCxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvd3d3LmJlZWFjY291bnRpbmcuY29tXFxcL3pcXFwvd2luZG93c2RsXCIsXCJpZFwiOlwiODI0OTA3MjQ2MjkwNDU1ZjhiYjAyMWVmMmI2MDdlNzhcIixcInVybF9pZHNcIjpbXCJhZjBiN2FlNGJhNWNjMTkwNWFiZWNkNDJmN2Q4ZDhkODRjOTg0MGE4XCJdfSJ9

http://mandrillapp.com/track/click/.../www.beeaccounting.com?p=eyJzIjoia1VWbjd6dHdLbV9ZdUJnZlRra2NheDRGQWRnIiwidiI6MSwicCI6IntcInVcIjozMDY4NDUxNCxcInZcIjoxLFwidXJsXCI6XCJodHRwOlxcXC9cXFwvd3d3LmJlZWFjY291bnRpbmcuY29tXFxcL3pcXFwvd2luZG93c2RsXCIsXCJpZFwiOlwiNmYzZTEwNzE1MTBjNGY0NzljMDI1MDkzNjdlMDRiYzhcIixcInVybF9pZHNcIjpbXCJhZjBiN2FlNGJhNWNjMTkwNWFiZWNkNDJmN2Q4ZDhkODRjOTg0MGE4XCJdfSJ9

Scan beeaccounting-2.7.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.