» l120_x86_211ushomeexportasiaml.exe
Overview
Analysis
File Details
Downloads (1)

l120_x86_211ushomeexportasiaml.exe

File name:

MD5:

8bd90ae58d5bb8e6083c503ebcd4e1e4

SHA-1:

41a9463cf3fade257e513d0a18ebc739e84a936e

SHA-256:

f8d3d5140e78c2b1bd8b3392e9006c2c0ecd91f69e3be60ae8c287c2b8bf0b59

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/26/2024 3:34:25 PM UTC (today)

File size:

1 MB (1,076,736 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\l120_x86_211ushomeexportasiaml.exe

File PE Metadata

Compilation timestamp:

8/20/2002 7:26:43 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:UrMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V3u2My+uPYyxXBpE1B6nj1GQ:GZyCA8CBmn+RrNj9ay5I3u+LlrEG5l

Entry address:

0xF9000

Entry point:

60, E8, 00, 00, 00, 00, 5D, 8B, C5, 81, ED, 1E, A5, 01, 20, 2B, 85, 85, AC, 01, 20, 89, 85, 81, AC, 01, 20, B0, 00, 86, 85, B6, AE, 01, 20, 3C, 01, 0F, 85, BC, 01, 00, 00, 83, BD, B1, AD, 01, 20, 00, 74, 33, 83, BD, B5, AD, 01, 20, 00, 74, 2A, 8B, 85, 81, AC, 01, 20, 2B, 85, B1, AD, 01, 20, 8B, 00, 89, 85, EE, AD, 01, 20, 8B, 85, 81, AC, 01, 20, 2B, 85, B5, AD, 01, 20, 8B, 00, 89, 85, F2, AD, 01, 20, EB, 61, 83, BD, B9, AD, 01, 20, 00, 74, 58, 8B, 85, 81, AC, 01, 20, 2B, 85, B9, AD, 01, 20, FF, 30, 8D, 85... 
[+]

Entropy:

7.4210

Packer / compiler:

ASPack v1.08.04

Code size:

451 KB (461,824 bytes)

The file l120_x86_211ushomeexportasiaml.exe has been seen being distributed by the following URL.

http://www.driversepson.com/.../aHR0cHM6Ly9kb3dubG9hZDMuZWJ6LmVwc29uLm5ldC9kc2MvZi8wMy8wMC8wNC8xNy80NS8yZGRhNDY0MzdkMmFmOWQ4ODgzNjdhOTdjYjdmMGU3OTQyMDQ3NTA4L0wxMjBfeDg2XzIxMVVzSG9tZUV4cG9ydEFzaWFNTC5leGU=

Scan l120_x86_211ushomeexportasiaml.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.