home

dahashhecechreportszlt.exe

Yupeng Zhang

The application dahashhecechreportszlt.exe by Yupeng Zhang has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered daily at a specified time. While running, it connects to the Internet address server-54-192-130-62.ams50.r.cloudfront.net on port 80 using the HTTP protocol.
Publisher:
Yupeng Zhang  (signed and verified)

MD5:
858f78642a9eff16881496935318c4ff

SHA-1:
af4e336c186d689bc350bf96e11f42b7bd56c017

SHA-256:
1a6aaddf8727e6e8571a520a249bb05cb0d2503212966341de9bd3df169d5a78

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/21/2024 12:23:33 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Zhang (M)
16.8.12.6

File size:
311.6 KB (319,064 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\gheklerjotain\dahashhecechreportszlt.exe

Digital Signature
Signed by:
Yupeng Zhang

Authority:
thawte, Inc.

Valid from:
8/3/2016 5:00:00 PM

Valid to:
2/3/2017 3:59:59 PM

Subject:
CN=Yupeng Zhang, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
7470AE4680BCC6C779E96B99B4864FF2

File PE Metadata
Compilation timestamp:
8/11/2016 8:20:08 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
6144:smVT7BO60N8H8S6CAeOFTAo9G4jHfytlrow+ZG7d8lFi:smF7BHa8cSiQrrow0i

Entry address:
0x1C069

Entry point:
E8, 43, 41, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, FF, 15, 6C, B0, 43, 00, 6A, 01, A3, E4, B0, 44, 00, E8, 90, 46, 00, 00, FF, 75, 08, E8, 25, 46, 00, 00, 83, 3D, E4, B0, 44, 00, 00, 59, 59, 75, 08, 6A, 01, E8, 76, 46, 00, 00, 59, 68, 09, 04, 00, C0, E8, F3, 45, 00, 00, 59, 5D, C3, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 6A, 17, E8, E0, 32, 01, 00, 85, C0, 74, 05, 6A, 02, 59, CD, 29, A3, C8, AE, 44, 00, 89, 0D, C4, AE, 44, 00, 89, 15, C0, AE, 44, 00, 89, 1D, BC, AE, 44, 00, 89, 35, B8, AE, 44, 00, 89, 3D, B4...
 
[+]

Entropy:
6.5650

Code size:
231.5 KB (237,056 bytes)

Scheduled Task
Task name:
Dahashhecech Reports

Trigger:
Daily (Runs daily at 12:05 AM)

Description:
Reports the error info of Dahashhecech.


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-192-130-190.ams50.r.cloudfront.net  (54.192.130.190:80)

TCP (HTTP):
Connects to server-54-192-203-58.fra50.r.cloudfront.net  (54.192.203.58:80)

TCP (HTTP):
Connects to server-54-240-186-22.mad50.r.cloudfront.net  (54.240.186.22:80)

TCP (HTTP):
Connects to server-54-230-81-13.mia50.r.cloudfront.net  (54.230.81.13:80)

TCP (HTTP):
Connects to server-52-84-174-181.gru50.r.cloudfront.net  (52.84.174.181:80)

TCP (HTTP):
Connects to server-54-240-186-7.mad50.r.cloudfront.net  (54.240.186.7:80)

TCP (HTTP):
Connects to server-52-84-7-77.ord54.r.cloudfront.net  (52.84.7.77:80)

TCP (HTTP):
Connects to server-52-85-151-180.hkg51.r.cloudfront.net  (52.85.151.180:80)

TCP (HTTP):
Connects to server-52-84-246-73.sfo20.r.cloudfront.net  (52.84.246.73:80)

TCP (HTTP):
Connects to server-54-230-81-67.mia50.r.cloudfront.net  (54.230.81.67:80)

TCP (HTTP):
Connects to server-54-230-163-75.jax1.r.cloudfront.net  (54.230.163.75:80)

TCP (HTTP):
Connects to server-54-192-130-233.ams50.r.cloudfront.net  (54.192.130.233:80)

TCP (HTTP):
Connects to server-52-85-133-60.iad53.r.cloudfront.net  (52.85.133.60:80)

TCP (HTTP):
Connects to server-54-230-81-59.mia50.r.cloudfront.net  (54.230.81.59:80)

TCP (HTTP):
Connects to server-54-230-81-42.mia50.r.cloudfront.net  (54.230.81.42:80)

TCP (HTTP):
Connects to server-54-230-81-41.mia50.r.cloudfront.net  (54.230.81.41:80)

TCP (HTTP):
Connects to server-54-230-81-196.mia50.r.cloudfront.net  (54.230.81.196:80)

TCP (HTTP):
Connects to server-54-230-81-154.mia50.r.cloudfront.net  (54.230.81.154:80)

TCP (HTTP):
Connects to server-54-230-81-15.mia50.r.cloudfront.net  (54.230.81.15:80)

TCP (HTTP):
Connects to server-54-230-81-136.mia50.r.cloudfront.net  (54.230.81.136:80)

Remove dahashhecechreportszlt.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.