home

kkd_windows_7_v3_part01_rar_downloader.exe

The executable kkd_windows_7_v3_part01_rar_downloader.exe has been detected as malware by 1 anti-virus scanner. The file has been seen being downloaded from skipperking.info.
MD5:
81adafd4fa6e532e4bcbe8085557597d

SHA-1:
330f128c0c5caaa502876429881667d7a9632d82

SHA-256:
033a391f0877d6b64d42764a9ae5cff6b6ecbdfbc8715afd76f49223b3081d6e

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
5/19/2024 2:06:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.3.5.3

File size:
1.3 MB (1,345,536 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\kkd_windows_7_v3_part01_rar_downloader.exe

File PE Metadata
Compilation timestamp:
5/8/2012 6:57:56 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:9hczrNUa4JWnOqn61RwS123yrz0YCz+f3n9rUeBAN+OGKlLJTNBm7z2qufx6FKFH:9SrNq4OYehE80Y1f3BDBtgLJhZfxQ9

Entry address:
0x1B1CC

Entry point:
E8, 1B, 39, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 70, 05, 46, 00, E8, 4E, 11, 00, 00, E8, E8, 3A, 00, 00, 0F, B7, F0, 6A, 02, E8, AE, 38, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, C2, 09, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.8998

Code size:
362.5 KB (371,200 bytes)

The file kkd_windows_7_v3_part01_rar_downloader.exe has been seen being distributed by the following URL.

http://skipperking.info/hp/?q=InUxCEganZDggsurpnbZfW83 h tfb rbEuR QfAPT3p5u6ctCC00Ugpqe 37MLynLkmDbYsKl4mV9RWpAR2mSea8bzUsNqQWlAIvJOOaiXKzP39jqCsGdf2NCf30Uq31XR6p V3kgnPlnVenq9fSLeJeHEKNptD/PIOaAZlPyR7JVjyQxh7p7yFmsYlzb cjXsS8Bmm3SrZ1E2Eip2whWieG 7AiR3ToZ256f9o06OEM/QKXD HkGPuhuTklkB125FdY8HQSf1TplltOd517aOOsjrX9OMA7vUEnJvuwD7 i6NXgSPqGMDYyNRi2HVvbiWM1jgmMBLYO0LYKB T6hVi5zV/eIySH T3ThlESkrKgPD6OoJ0nxyiztiSZNQHsD6AMgtbc6pmfn17dh3PygJekaeMzNnKnx e1FBwbWIEYSzZS6aip9pUercA A5hq/uhJrP0uz3DRoIWcQVHsD1R9HZJLMQWQxnQ49V w9 rownY3zVJzQBHthKyEBarlDI4RcM8ku0SnSgiLuOATim4UTPhCeJpycKS4FQX75H5mPblbAntMlm6N3zK6SHF31efe9v4qiVJjk3brUubg5/ZesL15MiJQ2GQT0zQNi4NaGKIfeK4nGc8RmOVr eyxPlvmIZaGQiy/Opz/53viwTksTUDZ9umDgAzwKUY6YeCGMDmjiuTOt30 kWGC09tQUVg1zS11oJ43uJkt Gurv9/ZVKZy1CWT80e/dr1w d GSJaU0TyhgSLBiHAflYsJY225alygId0VaFXsSwYyEf8rXQBvJA97cFGYhqfhV9dLa676EWNyUpXd67YFMcM8SpfGVTrd5fE2/THkAn90rls/.../0PXH3xoLVteUdaMX3ZaSRApq5A&external_id=1421829413264711866

Remove kkd_windows_7_v3_part01_rar_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.