home

mailcracker.exe

Sanmao SMTP Mail Cracker

www.sanmaosoft.com

The application mailcracker.exe, “Made by Sanmao Mail:suruiqiang@msn.com Y!M:suruiqiang” has been detected as a potentially unwanted program by 12 anti-malware scanners. While running, it connects to the Internet address h-64-105-122-181.nycm.ny.globalcapacity.com on port 25.
Publisher:
www.sanmaosoft.com

Product:
Sanmao SMTP Mail Cracker

Description:
Made by Sanmao Mail:suruiqiang@msn.com Y!M:suruiqiang

Version:
1, 4, 4, 0

MD5:
a20480639e3c57d5cff0c9528b7f62b9

SHA-1:
670d71727c0f3b187403c49f15750d7a89a34780

SHA-256:
f7b438e386ee0403ad89060cade36e91cff54c0a7e3cbb38b838e85ca57df19e

Scanner detections:
12 / 68

Status:
Potentially unwanted

Analysis date:
4/27/2024 10:47:42 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.NoobyProtect
7.1.1

Avira AntiVirus
TR/Rogue.11640797
8.3.1.6

avast!
Win32:Malware-gen
2014.9-160101

Baidu Antivirus
Hacktool.Win32.NoobyProtect
4.0.3.1611

Bkav FE
HW32.Packed
1.3.0.6979

Comodo Security
TrojWare.Win32.Amtar.KNB
22695

ESET NOD32
Win32/Packed.NoobyProtect.Q suspicious (variant)
10.11903

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.882

McAfee
Artemis!A20480639E3C
5600.6533

Qihoo 360 Security
HEUR/Malware.QVM18.Gen
1.0.0.1015

Rising Antivirus
PE:Trojan.Win32.Generic.1762D7CB!392353739
23.00.65.151230

VIPRE Antivirus
Trojan.Win32.Generic
41794

File size:
1.1 MB (1,134,592 bytes)

Product version:
1, 4, 4, 0

Copyright:
Copyrigth (C) 2013

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
6/4/2014 5:19:20 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:ozD/w0T0yHEGEcGDIJABZ6MR6Ma9YL5lMToc6wtwmz:OyMJABZtrjlM0kz

Entry address:
0x1330F9

Entry point:
E8, 1C, 00, 00, 00, 53, 61, 66, 65, 6E, 67, 69, 6E, 65, 20, 53, 68, 69, 65, 6C, 64, 65, 6E, 20, 76, 32, 2E, 33, 2E, 30, 2E, 30, 00, 9C, 83, EC, 12, E9, 77, FE, FF, FF, 66, 55, F7, D7, BF, 59, 4A, E8, C6, 89, 64, 24, 1F, 88, 4C, 24, 15, EB, 4C, F3, EA, 05, B4, A7, CE, 49, 50, 48, 4C, 50, 41, 50, 49, 2E, 44, 4C, 4C, 00, 86, 4C, 24, 05, 66, C1, E1, 0B, E8, 57, 00, 00, 00, 4B, D9, 49, 28, DB, 7E, B8, 9B, F2, 66, BE, 62, BA, 66, 8B, 6C, 24, 08, 66, 87, 5C, 24, 28, 66, BD, 19, 31, 87, D7, 66, 8F, 44, 24, 10, EB...
 
[+]

Entropy:
7.8760  (probably packed)

The executing file has been seen to make the following network communications in live environments.

TCP (SMTP):
Connects to ir2.fp.vip.bf1.yahoo.com  (98.139.183.24:25)

TCP (SMTP):
Connects to ir1.fp.vip.gq1.yahoo.com  (206.190.36.45:25)

TCP (SMTP):
Connects to u19175770.onlinehome-server.com  (74.208.184.222:25)

TCP (SMTP):
Connects to suddenlink.net  (66.76.47.150:25)

TCP (SMTP):
Connects to orcasonline.com  (50.28.105.173:25)

TCP (SMTP):
Connects to ir1.fp.vip.ne1.yahoo.com  (98.138.253.109:25)

TCP (SMTP):
Connects to ip-160-153-136-3.ip.secureserver.net  (160.153.136.3:25)

TCP (SMTP):
Connects to aolplatforms.com  (149.174.107.97:25)

TCP (SMTP):
Connects to actionamerica.com  (149.174.110.102:25)

TCP (SMTP):
Connects to 184-106-184-142.static.cloud-ips.com  (184.106.184.142:25)

TCP (SMTP):
Connects to www-redirect.aux.ets.org  (144.81.30.67:25)

TCP (SMTP):
Connects to www.wolfram.com  (206.123.112.238:25)

TCP (SMTP):
Connects to www.webhelp.com  (64.37.197.70:25)

TCP (SMTP):
Connects to www.wcupa.edu  (144.26.2.9:25)

TCP (SMTP):
Connects to www.tranzon.com  (216.213.96.20:25)

TCP (SMTP):
Connects to www.pacbell.net  (151.164.129.3:25)

TCP (SMTP):
Connects to www.mtroyal.ca  (142.109.1.79:25)

TCP (SMTP):
Connects to www.eiu.edu  (139.67.8.125:25)

TCP (SMTP):
Connects to www.ahn.org  (198.203.131.32:25)

TCP (SMTP):
Connects to wisc.edu  (144.92.9.70:25)

Remove mailcracker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.