home

ic-0.6f2dfcbfb1b9b.exe

Xin Zhou

The executable ic-0.6f2dfcbfb1b9b.exe has been detected as malware by 1 anti-virus scanner. While running, it connects to the Internet address server-54-230-141-138.sfo5.r.cloudfront.net on port 80 using the HTTP protocol.
Publisher:
Xin Zhou  (signed and verified)

MD5:
fe0e32a69b26bdd1de16f21d8936c82f

SHA-1:
b8d2a60c84c989f634a399288f79afcfc4874ccc

SHA-256:
26cf5915c7e0c313a6253b24d033dd87c61256c7ca1097c56fa3382979c861d1

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
4/25/2024 8:34:09 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
17.2.21.20

File size:
406.9 KB (416,704 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\ic-0.6f2dfcbfb1b9b.exe

Digital Signature
Signed by:
Xin Zhou

Authority:
thawte, Inc.

Valid from:
1/21/2017 2:00:00 AM

Valid to:
3/23/2017 1:59:59 AM

Subject:
CN=Xin Zhou, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
768A2EEB06A8CDA3CEE8C1ECA9C9A324

File PE Metadata
Compilation timestamp:
2/13/2017 1:59:08 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

Entry address:
0x21D9

Entry point:
E8, 4F, F0, FF, FF, E9, BC, 7F, 00, 00, 55, 8B, EC, 51, 9B, D9, 7D, FC, 8B, 4D, 0C, 8B, 45, 08, F7, D1, 23, 45, 0C, 66, 23, 4D, FC, 66, 0B, C8, 0F, B7, C1, 89, 45, 0C, D9, 6D, 0C, 0F, BF, 45, FC, 8B, E5, 5D, C3, 55, 8B, EC, 8B, 45, 14, 83, F8, 65, 74, 5F, 83, F8, 45, 74, 5A, 83, F8, 66, 75, 19, FF, 75, 20, FF, 75, 18, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 0E, 20, 00, 00, 83, C4, 14, 5D, C3, 83, F8, 61, 74, 1E, 83, F8, 41, 74, 19, FF, 75, 20, FF, 75, 1C, FF, 75, 18, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8...
 
[+]

Entropy:
7.8490  (probably packed)

Code size:
366.5 KB (375,296 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-141-66.sfo5.r.cloudfront.net  (54.230.141.66:80)

TCP (HTTP):
Connects to server-54-230-141-173.sfo5.r.cloudfront.net  (54.230.141.173:80)

TCP (HTTP):
Connects to server-54-230-141-138.sfo5.r.cloudfront.net  (54.230.141.138:80)

TCP (HTTP):
Connects to server-54-230-163-227.jax1.r.cloudfront.net  (54.230.163.227:80)

TCP (HTTP):
Connects to server-54-230-163-184.jax1.r.cloudfront.net  (54.230.163.184:80)

TCP (HTTP):
Connects to server-54-230-163-174.jax1.r.cloudfront.net  (54.230.163.174:80)

TCP (HTTP):
Connects to server-54-230-163-120.jax1.r.cloudfront.net  (54.230.163.120:80)

TCP (HTTP):
Connects to server-54-230-216-57.mrs50.r.cloudfront.net  (54.230.216.57:80)

TCP (HTTP):
Connects to server-54-230-141-78.sfo5.r.cloudfront.net  (54.230.141.78:80)

TCP (HTTP):
Connects to server-54-230-141-34.sfo5.r.cloudfront.net  (54.230.141.34:80)

TCP (HTTP):
Connects to server-54-192-29-204.dub2.r.cloudfront.net  (54.192.29.204:80)

TCP (HTTP):
Connects to server-54-192-203-34.fra50.r.cloudfront.net  (54.192.203.34:80)

TCP (HTTP):
Connects to server-52-84-230-35.sfo9.r.cloudfront.net  (52.84.230.35:80)

TCP (HTTP):
Connects to server-54-230-81-78.mia50.r.cloudfront.net  (54.230.81.78:80)

TCP (HTTP):
Connects to server-54-192-14-9.ams1.r.cloudfront.net  (54.192.14.9:80)

TCP (HTTP):
Connects to server-54-230-216-242.mrs50.r.cloudfront.net  (54.230.216.242:80)

TCP (HTTP):
Connects to server-54-230-216-106.mrs50.r.cloudfront.net  (54.230.216.106:80)

TCP (HTTP):
Connects to server-54-192-203-53.fra50.r.cloudfront.net  (54.192.203.53:80)

TCP (HTTP):
Connects to server-52-85-83-132.lax1.r.cloudfront.net  (52.85.83.132:80)

TCP (HTTP):
Connects to server-52-84-230-23.sfo9.r.cloudfront.net  (52.84.230.23:80)

Remove ic-0.6f2dfcbfb1b9b.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.