home

doulci activator 2.0.exe

HabibAfghanSofts

The executable doulci activator 2.0.exe, “DoulCi Activator 2.0” has been detected as malware by 9 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from s6649.chomikuj.pl and multiple other hosts.
Publisher:
HabibAfghanSofts

Description:
DoulCi Activator 2.0

Version:
2.0

MD5:
cdbb14547b4339e3419828277276c7ca

SHA-1:
b8378a204f7864193fc8cf486c7f1bf10b7d8202

SHA-256:
61bba724860b4f2805dda56c03906196a355c3c366256bde40b83d27716b3c0f

Scanner detections:
9 / 68

Status:
Malware

Analysis date:
5/19/2024 5:07:39 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
2014.9-150124

G Data
Win32.Trojan.Agent.7GEB61
15.1.24

IKARUS anti.virus
Win32.SuspectCrc
t3scan.1.8.6.0

McAfee
Artemis!CDBB14547B43
5600.6876

Norman
Suspicious_Gen5.BBEBZ
11.20150124

Qihoo 360 Security
HEUR/QVM05.1.Malware.Gen
1.0.0.1015

Trend Micro House Call
Suspicious_GEN.F47V0108
7.2.24

VIPRE Antivirus
Trojan.Win32.Generic
36888

ViRobot
Trojan.Win32.S.Agent.1247759[h]
2014.3.20.0

File size:
1.2 MB (1,247,759 bytes)

Copyright:
HabibAfghanSofts

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\doulci activator 2.0 by seven7i\doulci activator 2.0.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:PAT8QE+kPv2o9w0k4wQnD8JTAxNVh8uHAR+I/DNSEYSP:PAI+6vU0ktQusNVZgR+I5SEz

Entry address:
0x25468

Entry point:
55, 8B, EC, 83, C4, F0, B8, 88, 53, 42, 00, E8, 24, F2, FD, FF, B8, C8, 54, 42, 00, E8, 2A, 1C, FE, FF, 8B, 15, 40, 88, 42, 00, 89, 02, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, 48, 88, 42, 00, E8, E4, D3, FF, FF, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, DC, 87, 42, 00, E8, 7A, 64, FF, FF, A1, 40, 88, 42, 00, E8, AC, 4E, FE, FF, E8, DF, E0, FD, FF, 00, 00, 00, FF, FF, FF, FF, 01, 00, 00, 00, 2A, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.8520

Developed / compiled with:
Microsoft Visual C++

Code size:
145.5 KB (148,992 bytes)

The file doulci activator 2.0.exe has been seen being distributed by the following 11 URLs.

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXYmbqt5-dMFpslDR6gu5trEpkY_gKzgQVNvN8WzA5mikFtkwLBWT5EFxYHooTIEviMhxxFITLZdPiNVmiac39JBAdjXLLAFJY66c7tUC2n7gJyTtqb3wxpEHTjoO_dYgomID_vacpFBaayGnnt8WzYY&pv=2

http://s8857.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadCTZpMCszAtJy_TCzCu3OonYBCWMsammTS2_wUwMKpfjhcY85pc4j4m_5AVlH5OaeBczdnd4-tgKIJ45nzAkMRVbpNz7agT_4F7Yye0nttxtlPCQzkm6W4GOUB5bx4Qj4E&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXYmbqt5-dMFpslDR6gu5trGS-JpJaQeru4Bh_MnOI4yVF1-_uo4hJTD8MAB43lk56O1rQ1r3gT2tuS5mvIAzVuV9bA7f1-puq-TnmBF2kmtckvuxtZNkV4yXaPlsI7Jua1OvroxNcS_fPlCuxsiRolU&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadBYvbCGj_BeT5fj4__mFe_17lojV7Ygf9dPlBh2kn1XRujIR3d_L_zWYCglDeLY5nYESoCkyPkzsbk7Mki8bvSgSZxeo1GmSFdDy8pULCa6IkNmEP5WCmleKhqjKki9itU&pv=2

http://s8857.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadA6laqn5Po7hBl53mCir4RHC1ZQSZOtko4x3V1NWI8DDQlVrCKJvn-h9fpuT78yWZzZzGSouRJhmf-V9NK41Q5-3D3y96sgweEn6sOMfAFA_tAXBinOl0ptd6YY-p8In40&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXa-GcCouOTellVOgwslhxoFnwi_EH6R10PMbHFIBtyALgP9ZCCj-YmNkf8s2U2ehwW7i6nNNIaI_7Fl9vDByrLvFk4UPyUxEqS6cv2eSu-hKo-euCuxJla2u84NEI2GvpB-PEdgSZk7nVVGYO-9s2mU&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadB0Cvq7ym_6s-BOUjEfFKuy-GEz38Mr1xy7ygT2LUPO89N6bYUJD-wjDkDphW_Fsi7jBoS5GmndJpao5S47neyiJlMFmA3NTcI1mOnHTIwSIz_OpK0P_pFZO2eopleahIw&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadDg6cyDuLoT2o6jRpdNgnuNioOGW_0VPTwIcQ1Yli8MhH_ZFX_xLC9Ddn0xCLcAYFvKY42l8EECcq0JdkP_O7ImxggS27Y4B4KZW9RMiFvSqVVnWSLCyKCitZiLdkMzXo8&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadCLi8N1Af1JDHFar-DlvociGr8RkZuDfWWb3Q5fE2ZetDXfnWkgPm0k313uy04hAKNoslAELq83Y91s5CKzOpr4R6hkwxhmcRpgaGRC2BzraU9KgnBNMadGLgBMplLKRBQ&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadAcps2riuCmC6s3SQOtGL2MWLX2mqgodIWFz_Hrcak3MMoqnIgp6NGrONuKcCWftz-7BjGvyznGOmeeqliQabaO1fF4TA_oKiNrnVLlrRk9uwaLqiadVs5bEYPoEjeHiOk&pv=2

http://s6649.chomikuj.pl/File.aspx?e=str2QTtCLIcypSWfRGzSXbV9w8kgGA-iWkeAWPzOadBIaBVdqUwcDoCfZd7Pygexx8xaitgtfmvZaJwe1TgY_iZmhTcCN4uJbpO3I3vLy_3raWdgie1QrFDLE1tFrmr2LMk7TgyjbwQZQgtF6gs3-ZAvtjGP9twduNcbkUCrWBY&pv=2

Remove doulci activator 2.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.