home

f1f9.tmp

The file f1f9.tmp has been detected as malware by 23 anti-virus scanners. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from storage.googleapis.com.
MD5:
96fb973cdea0fa15902b7c24dc37228d

SHA-1:
4de4e933908e8c3bf24eda62eba792da6cdb60b9

SHA-256:
bd43b004ccd099425a4e4abb70e5d89d9c9fbdf20209a60bcc8330450ebb6e2f

Scanner detections:
23 / 68

Status:
Malware

Analysis date:
4/25/2024 10:51:55 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Agent
7.1.1

Avira AntiVirus
TR/Dldr.Banload.826
8.3.2.2

Arcabit
Trojan.Graftor.D3CD1D
1.0.0.593

avast!
Win32:Dropper-gen [Drp]
2014.9-151116

AVG
Downloader.Banload2
2016.0.2923

Baidu Antivirus
Trojan.Win32.Banload
4.0.3.151116

Bitdefender
Gen:Variant.Graftor.249117
1.0.20.1600

Comodo Security
UnclassifiedMalware
23594

Emsisoft Anti-Malware
Gen:Variant.Graftor.249117
8.15.11.16.12

ESET NOD32
Win32/TrojanDownloader.Banload.WRR (variant)
9.12568

Fortinet FortiGate
W32/Banload.WRR!tr.dldr
11/16/2015

F-Secure
Gen:Variant.Graftor.249117
11.2015-16-11_2

G Data
Gen:Variant.Graftor.249117
15.11.25

IKARUS anti.virus
Trojan-Downloader.Win32.Banload
t3scan.1.9.5.0

K7 AntiVirus
Trojan-Downloader
13.212.17856

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.1112

McAfee
Artemis!96FB973CDEA0
5600.6579

Microsoft Security Essentials
TrojanDownloader:Win32/Banload!rfn
1.1.12205.0

MicroWorld eScan
Gen:Variant.Graftor.249117
16.0.0.960

Panda Antivirus
Trj/GdSda.A
15.11.16.12

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.151114

Sophos
Mal/Generic-S
4.98

VIPRE Antivirus
Trojan.Win32.Generic
45216

File size:
1.5 MB (1,604,608 bytes)

Common path:
C:\users\{user}\appdata\local\temp\f1f9.tmp

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:/JDuSorwnWDAKAXnoHACbb/6L/6KeBkXSKUXb1ASBZiHrtLB5wYP7nh5CJ6WTU+L:RDIekACbj6TrakiJASAwMGjTPVT9

Entry address:
0x14B2B8

Entry point:
55, 8B, EC, 83, C4, F0, B8, 80, AC, 54, 00, E8, 14, B8, EB, FF, 68, 50, B3, 54, 00, 6A, 00, 6A, 00, E8, C2, BA, EB, FF, E8, 55, BC, EB, FF, 3D, B7, 00, 00, 00, 75, 0C, A1, 44, 84, 55, 00, 8B, 00, E8, CA, 9B, F1, FF, A1, 44, 84, 55, 00, 8B, 00, E8, 3A, 9A, F1, FF, 6A, EC, A1, 44, 84, 55, 00, 8B, 00, 8B, 40, 30, 50, E8, DC, C3, EB, FF, 0D, 80, 00, 00, 00, 50, 6A, EC, A1, 44, 84, 55, 00, 8B, 00, 8B, 40, 30, 50, E8, F4, C5, EB, FF, 8B, 0D, 48, 84, 55, 00, A1, 44, 84, 55, 00, 8B, 00, 8B, 15, 24, 92, 54, 00, E8...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
1.3 MB (1,352,704 bytes)

The file f1f9.tmp has been seen being distributed by the following URL.

https://storage.googleapis.com/.../AdobeFlashPlayer-2015-.exe

Remove f1f9.tmp - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.