home

last_stand_christmas.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from download1588.mediafire.com and multiple other hosts.
MD5:
0266f89f810b46594b1071dd6237dd75

SHA-1:
b90afeb1001f02a43081688ad85e75b21bd463f6

SHA-256:
b17ee4a20c511ec920092f6c7865ade519ac0484ba8a2ae24563d8b6a81da58c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 7:27:24 AM UTC  (today)

File size:
376.7 MB (394,971,538 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\last_stand_christmas.exe

File PE Metadata
Compilation timestamp:
12/5/2009 3:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6291456:1vK13N8m1McMSEGB/j0X/Zs5iHo32ryS/8PmOzw6OPSUyi4uM5gsWJ/3YSO6JAzx:k17lZ7BA/Zsco3sM9dO6Uyi4x5vWlT54

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9868

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file last_stand_christmas.exe has been discovered within the following program.

Call of Duty: World at War  by TreyArch
www.treyarch.com
About 4% of users remove it
 
Powered by Should I Remove It?

The file last_stand_christmas.exe has been seen being distributed by the following 16 URLs.

http://download1588.mediafire.com/ap2e32xm884g/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/7ccjpatemkfg/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/f546frixqvzg/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/qjh3gls104mg/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/93a7c3ytf13g/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/yjaya6aywj9g/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/oixcyc6lbbyg/.../Last_Stand_Christmas.exe

https://mega.nz/temporary/.../mIEESAZK

http://download1588.mediafire.com/p5z9rbq7rmdg/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/5h96svmzapwg/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/f974u4424cyg/.../Last_Stand_Christmas.exe

http://media1.gamefront.com/guploads/201212/24/.../Last_Stand_Christmas.exe

https://mega.nz/temporary/.../55RVSI4I

http://download1394.mediafire.com/xmivg0l3b4sg/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/r8f2e6dbbghg/.../Last_Stand_Christmas.exe

http://download1588.mediafire.com/n9fhbcvxtxxg/.../Last_Stand_Christmas.exe

Scan last_stand_christmas.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.