home

cryea.dll

The library cryea.dll has been detected as malware by 15 anti-virus scanners. The file has been seen being downloaded from doc-0k-20-docs.googleusercontent.com and multiple other hosts.
MD5:
ec16c187145613f1f595987824f2b922

SHA-1:
e282f7d33cb7daa9aab18040c693fbb4613be0fb

SHA-256:
f9cb109d9aa98975ce86bdbafc390645b5896fba281b97308f61c8b0c2eca027

Scanner detections:
15 / 68

Status:
Malware

Analysis date:
4/24/2024 4:39:40 PM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
Troj.W32.Mepaow
2.1.4+

AhnLab V3 Security
Win-Trojan/Obfuscator.M.204800
2014.10.04

Baidu Antivirus
Hacktool.Win32.Obfuscator
4.0.3.141011

Comodo Security
UnclassifiedMalware
19699

IKARUS anti.virus
Trojan.SuspectCRC
t3scan.1.7.8.0

K7 AntiVirus
Riskware
13.183.13584

McAfee
Generic Packed
5600.6980

Microsoft Security Essentials
VirTool:Win32/Obfuscator.XZ
1.11005

Norman
Suspicious_Gen4.DMYOJ
11.20141011

Panda Antivirus
Trj/Thed.W
14.10.11.06

Rising Antivirus
PE:Trojan.Win32.Generic.15A07E8C!362839692
23.00.65.141009

Trend Micro House Call
TROJ_SPNR.03EJ13
7.2.284

Trend Micro
TROJ_SPNR.03EJ13
10.465.11

VIPRE Antivirus
Trojan.Win32.Generic
33650

ViRobot
JS.A.Iframe.204800
2011.4.7.4223

File size:
200 KB (204,800 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\users\{user}\downloads\cryea.dll

File PE Metadata
Compilation timestamp:
3/11/2013 1:55:42 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:872wxXn9/ngRxRCckbxFO3qxBJ0fcthOqhlE:87jxX9/gR659Y3qL+eOU

Entry address:
0x2BC0

Entry point:
55, 8B, EC, 8B, 45, 08, A3, 68, 8D, 00, 10, B8, 01, 00, 00, 00, 5D, C2, 0C, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 33, C9, 33, D2, 33, FF, 39, 4D, 0C, 76, 2F, 53, FE, C1, 0F, B6, C9, 8A, 1C, 31, 47, 8D, 04, 1A, 0F, B6, D0, 8A, 04, 32, 88, 04, 31, 02, C3, 0F, B6, C0, 88, 1C, 32, 0F, B6, 1C, 30, 8B, 45, 08, 30, 5C, 07, FF, 3B, 7D, 0C, 72, D3, 5B, 5F, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, E9, C6, B8, 02, 00, 89, 54, 24, 28, C6, 44, 24, 1C, 75, FF, 74...
 
[+]

Entropy:
7.2675

Developed / compiled with:
Microsoft Visual C++

Code size:
12 KB (12,288 bytes)

The file cryea.dll has been seen being distributed by the following 9 URLs.

https://doc-0k-20-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/o2fu7afanciqju1hgk2pgcb226hdavjh/1392235200000/16731400093431672645/.../0B6u1O0DZtb51RDlpZERHdnplRkU?h=16653014193614665626&e=download

https://docs.google.com/uc?authuser=0&id=0B6u1O0DZtb51RDlpZERHdnplRkU&export=download

http://freecache5-free.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=1037801270;up=0;uip=118.208.237.165;tm=1404026769;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=6ecfb1dbad7226acabe3713f937ecfc0;Pe/.../cryea.dll?bD&c=1910171434&De&redirs=1

http://dla.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=1037801270;up=0;uip=118.208.237.165;tm=1404026769;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=6ecfb1dbad7226acabe3713f937ecfc0;Pe/.../cryea.dll?bD&c=1910171434&De

http://freecache5-free.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=906925217;up=0;uip=118.208.237.165;tm=1404026581;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=48d1530cc01bc429927871e7f5525a59;Pe/.../cryea.dll?bD&c=1910171434&De&redirs=2

http://freecache8-free.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=906925217;up=0;uip=118.208.237.165;tm=1404026581;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=48d1530cc01bc429927871e7f5525a59;Pe/.../cryea.dll?bD&c=1910171434&De&redirs=1

http://dla.uloz.to/Ps;Hs;fid=41972328;cid=1910171434;rid=906925217;up=0;uip=118.208.237.165;tm=1404026581;ut=f;aff=ulozto.net;did=ulozto-net;He;ch=48d1530cc01bc429927871e7f5525a59;Pe/.../cryea.dll?bD&c=1910171434&De

https://doc-0k-20-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/khtmjvhtbrer4cid8m3hjlgfpefn2q3t/1391652000000/16731400093431672645/.../0B6u1O0DZtb51RDlpZERHdnplRkU?h=16653014193614665626&e=download

https://docs.google.com/uc?id=0B6u1O0DZtb51RDlpZERHdnplRkU&export=download

Remove cryea.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.