home

cure.exe

The executable cure.exe has been detected as malware by 7 anti-virus scanners. The file has been seen being downloaded from blogattach.naver.net and multiple other hosts.
MD5:
e161d6f5f440c2a03a9459f2edad66e5

SHA-1:
e814224b0f00b76a3abafa1d6fb6062847f5bc5f

SHA-256:
92914013abfd071b0513d366bcaead978dce2f552c9d2853f4ce775604fb841f

Scanner detections:
7 / 68

Status:
Malware

Analysis date:
8/15/2025 5:38:14 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Crypt2
2015.0.3373

F-Secure
Trojan.Generic.11454421
11.2014-24-08_1

IKARUS anti.virus
Trojan.Crypt2
t3scan.1.7.5.0

K7 AntiVirus
Riskware
13.183.13139

NANO AntiVirus
Trojan.Win32.Agent.cxsaiz
0.28.2.61721

nProtect
Trojan.Generic.11454421
14.08.22.01

VIPRE Antivirus
Trojan.Win32.Generic
32454

File size:
64 KB (65,536 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\cure.exe

File PE Metadata
Compilation timestamp:
3/19/2008 11:47:45 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
6.0

CTPH (ssdeep):
1536:ki0HF97X7IsmZ1VfSkB1VsCydxJEfeoY1OR:kiwjdmZtcCyPmGoY1Y

Entry address:
0x4F71

Entry point:
55, 8B, EC, 6A, FF, 68, 40, C3, 40, 00, 68, 60, 84, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 10, 53, 56, 57, 89, 65, E8, FF, 15, 20, C0, 40, 00, 33, D2, 8A, D4, 89, 15, 6C, F6, 40, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 68, F6, 40, 00, C1, E1, 08, 03, CA, 89, 0D, 64, F6, 40, 00, C1, E8, 10, A3, 60, F6, 40, 00, 6A, 00, E8, 4A, 34, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, 9A, 00, 00, 00, 59, 83, 65, FC, 00, E8, 89, 32, 00, 00, FF, 15, 1C, C0, 40, 00, A3, A4, 0B, 41, 00, E8...
 
[+]

Entropy:
5.7681

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
44 KB (45,056 bytes)

The file cure.exe has been seen being distributed by the following 5 URLs.

http://blogattach.naver.net/29bc358691c5cd113fddbd8ab4542b57f4a757b96c/20140616_74_blogfile/.../cure.exe

http://cocosoft.kr/.../cfile21.uf@2448594B52E0802E37D3F7.exe

http://blogattach.naver.net/cd58d162722b29f5db3b586950b1cabe144dbc5aea/20150521_238_blogfile/.../cure.exe

http://itgroovy.tistory.com/.../cfile21.uf@2420A24E51BEE7F6102639.exe

http://blogattach.naver.net/cd58d162722b29f5db3c576752b2c8b01240ba5aca/20150521_238_blogfile/.../cure.exe

Remove cure.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.