home

guilty_crown_-_22end_kurogaze.mp4.exe

Andrey Hmelnikov

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application guilty_crown_-_22end_kurogaze.mp4.exe by Andrey Hmelnikov has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from fasterol.info.
Publisher:
Andrey Hmelnikov  (signed and verified)

MD5:
3bc79f6bdecf7eee8d2cce5a5881cb41

SHA-1:
5b2cfd675394e4487178ba0b22e82902d67a73b6

SHA-256:
08f91fdbbdc1f6c6f44104c84079abb8c23fec36161d6ae9b31ae6ae8bfc0daa

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/8/2024 1:15:48 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick (M)
16.8.8.21

File size:
1.2 MB (1,261,944 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\guilty_crown_-_22end_kurogaze.mp4.exe

Digital Signature
Signed by:
Andrey Hmelnikov

Authority:
Unizeto Technologies S.A.

Valid from:
6/23/2014 2:25:04 PM

Valid to:
6/23/2015 2:25:04 PM

Subject:
E=Andrey.Hmelnikov@hotmail.com, CN=Andrey Hmelnikov, O=Andrey Hmelnikov, C=RU

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
727B500ADD12D49F610A094EBFE02E4B

File PE Metadata
Compilation timestamp:
9/20/2013 2:11:04 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:6MOetPieqMZ+vKjI//H1JcGylPd2ZoZFT39:BlPvZLInHcGUOoZFp

Entry address:
0x1906A

Entry point:
E8, 1D, 39, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 70, B4, 45, 00, E8, 50, 11, 00, 00, E8, EA, 3A, 00, 00, 0F, B7, F0, 6A, 02, E8, B0, 38, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, C2, 09, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.7215

Code size:
343.5 KB (351,744 bytes)

The file guilty_crown_-_22end_kurogaze.mp4.exe has been seen being distributed by the following URL.

http://fasterol.info/hp/?q=cZUxCLi3ytuRuKEG xnC0LYoWjVd0 E70Gu4bsTRz4GNXUH1nQQ6pHpG H/1aZ0i94IZbjnMV0S965cRA3t0PDKVLcjC4j1UW2SnMDvrv/zb945wpS tRxbzpLURDyj8eCkN2WtB3ZQPl4EItWBtVW9i3FpiA1lP/5fOPiKglDgPO4LjcgWUCNFFIjnCk9AR7xdfpv9V vAiD 6l354mtMaThEmAVCq0r2w4R0c1pHIxTMoo1NjIYLOC8niF5shFw5uT6fWpZob2Eri7lVDjQVCjOeEB4B4AcLc2K1PsHA5XRGoo5qXHTmRHgOtrkUrlT1 WBlydF/.../s1b4hrnCqFBTEzJLv5atrhEBbQm6BhxMZ0 Effi6sOkqkHtbFgH4cQc7vPMwCGSaT&external_id=1419740358103613292

Remove guilty_crown_-_22end_kurogaze.mp4.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.