home

denwer3_base_php52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe

7-Zip

Igor Pavlov

The program is a setup application that uses the 7z Setup installer. The file has been seen being downloaded from dcms.su and multiple other hosts.
Publisher:
Igor Pavlov

Product:
7-Zip

Description:
7z Setup SFX

Version:
4.42

MD5:
6aa524e3fb3971bfa4cfd83f9ce35778

SHA-1:
bc412bf63f3c307f018a93ee82bfb760eba5be25

SHA-256:
a1960750c9fa494f03a4c26e4ebc7e021d0d23d3d1197e21a305ad12f066e972

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/25/2024 10:12:08 AM UTC  (today)

Scan engine
Detection
Engine version

Norman
Suspicious_Gen2.HRFTA
11.20140702

File size:
8.9 MB (9,317,457 bytes)

Product version:
4.42

Copyright:
Copyright (c) 1999-2006 Igor Pavlov

Original file name:
7zS.sfx.exe

File type:
Executable application (Win32 EXE)

Installer:
7z Setup

Common path:
C:\users\{user}\downloads\denwer3_base_php52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe

File PE Metadata
Compilation timestamp:
5/14/2006 8:25:32 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:a82yo260ENkRtDZ6KzFzCm8bg0yc8Xj/Fmu3XvMJIOl+f:a82y36VwtV6WlT8Fyc8jFl3/cIOl6

Entry address:
0x12C8F

Entry point:
55, 8B, EC, 6A, FF, 68, 98, 99, 41, 00, 68, 64, 4D, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, 78, 91, 41, 00, 33, D2, 8A, D4, 89, 15, 30, 15, 42, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 2C, 15, 42, 00, C1, E1, 08, 03, CA, 89, 0D, 28, 15, 42, 00, C1, E8, 10, A3, 24, 15, 42, 00, 6A, 01, E8, FB, 0D, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, C3, 00, 00, 00, 59, E8, 4D, 09, 00, 00, 85, C0, 75, 08, 6A, 10, E8, B2, 00, 00, 00, 59, 33, F6, 89, 75...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
95.5 KB (97,792 bytes)

The file denwer3_base_php52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe has been seen being distributed by the following 10 URLs.

https://dcms.su/files/.forum/8756/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=31c80e0c1a6b2076731f5619922ccfc6&redir=1

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=246b9d0a6e987ae811944415e72c503c&redir=1

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=4be47b0ea083b60c68c3a5afda31a87c&redir=1

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=d21ebff6b6bbc3763ae72586ea4ce5a0&redir=1

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=64f564086f00908a95e5bac3011881a7&redir=1

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=7aaf19c5880ee2506424e44a53784033&redir=1

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=8fc1cc9e16064d5fe967ce0bb34f922b&redir=1

http://www.denwer.ru/dis/Base_PHP52/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe

http://www.denwer.ru/dis/.../Denwer3_Base_PHP52_2013-06-02_a2.2.22_p5.2.12_zendoptimizer_m5.5.25_pma3.5.1_xdebug.exe&confirm=02df3304097a9aff69fadaca9b085ff0&redir=1

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.