home

cleanup312.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from stevengould.org and multiple other hosts.
MD5:
cbf1400c4c7d4dc0e7c0ed9b58266bf9

SHA-1:
6b860da440032bb7e4f80d53126d113f3a67f38d

SHA-256:
b03b29d17ded93602010515fe61360206e50e2df8be444d248c770a2c27ef051

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 6:58:29 AM UTC  (today)

File size:
269.9 KB (276,408 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\cleanup312.exe

File PE Metadata
Compilation timestamp:
10/6/1999 6:33:39 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
6144:IAjIV8jWj6CTl6x4bkVXhIw0ykXO9shFKUxTxUYiUFjUF3P:BMV8jWj9TQ0kVX2wPkmsrKemdYUFf

Entry address:
0x1020

Entry point:
55, 8B, EC, 81, EC, 14, 04, 00, 00, 53, 56, 57, 6A, 00, FF, 15, 08, 41, 40, 00, 68, 00, 50, 40, 00, FF, 15, 04, 41, 40, 00, 85, C0, 74, 29, 6A, 00, A1, 00, 20, 40, 00, 50, FF, 15, 20, 41, 40, 00, 8B, F0, 6A, 06, 56, FF, 15, 1C, 41, 40, 00, 6A, 03, 56, FF, 15, 1C, 41, 40, 00, 33, C0, E9, 0C, 03, 00, 00, 68, 02, 7F, 00, 00, 33, F6, 56, FF, 15, 14, 41, 40, 00, 50, FF, 15, 10, 41, 40, 00, 68, 00, 02, 00, 00, 8D, 85, EC, FD, FF, FF, 50, 56, FF, 15, 00, 41, 40, 00, 56, B8, 00, 00, 00, 80, 50, 8D, 8D, EC, FD, FF...
 
[+]

Entropy:
7.9797

Developed / compiled with:
Microsoft Visual C++

Code size:
2.5 KB (2,560 bytes)

The file cleanup312.exe has been seen being distributed by the following 9 URLs.

http://stevengould.org/downloads/.../CleanUp312.exe

https://gq1-attach.ymail.com/us.f1645.mail.yahoo.com/.../securedownload?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-0165-09000c010000&cred=Dr8IGd_NP5oM7gyAA0GlO6iLnsUAQKsYGtSizhr6TMkJZ_VyqTZVUfVk&ts=1425770747&partner=ymail&sig=kv21qLOK9WTUwxTXKL.t0Q--

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-0165-09000c010000

https://gq1-attach.ymail.com/us.f1645.mail.yahoo.com/.../securedownload?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-01b7-da000e010000&cred=GxE6sRcTP5r.C49lCgqbyZiO7_FU8tdTCDgiicjhkUmoeacR0L2FruiR&ts=1425770533&partner=ymail&sig=SeMMJ0RogC.rnER5YguP6w--

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-01b7-da000e010000

https://gq1-attach.ymail.com/us.f1645.mail.yahoo.com/.../securedownload?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-01b7-da000c010000&cred=DuXgdg0WP5o_lH149dN82Jp_KoubHcfJ_5HNfzSu.Z8.AbbBhPAqhNUA&ts=1425770528&partner=ymail&sig=pIo_Cm7Go1SKOIi79SV9vA--

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-01b7-da000c010000

https://gq1-attach.ymail.com/us.f1645.mail.yahoo.com/.../securedownload?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-01b7-da000a010000&cred=bXbZijYkP5r3CH8KRT0rQ1VQwrEpmUf2oei7DcpVBhWZCFS4JjWdDEbQ&ts=1425770514&partner=ymail&sig=PdQs7GA9iTD13HckACmGxw--

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_61456_AGZ2w0MAABlzVPuHdw7oaGSdAMo&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=8eb66d60-39b8-b909-01b7-da000a010000

Scan cleanup312.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.