home

minecraft_pcgdemo.exe

Minecraft PC Gamer Demo

Mojang

The executable minecraft_pcgdemo.exe, “Minecraft PC Gamer Demo Setup ” has been detected as malware by 5 anti-virus scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from dnbk9lbi8nhma.cloudfront.net.
Publisher:
Mojang

Product:
Minecraft PC Gamer Demo

Description:
Minecraft PC Gamer Demo Setup

MD5:
505bd0d7cd2d82bd6aaa295ea37b935c

SHA-1:
f6eeae8a87b97cce560d0c4f7d44040db1e03831

SHA-256:
3838f7b8949fbaf5b4c4b5562f7bc1012d3b01d299999f05559a4f542af31a0b

Scanner detections:
5 / 68

Status:
Malware

Analysis date:
5/5/2024 3:30:36 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Kukacka
160518-2

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.E.gen
4.6.5.141

Microsoft Security Essentials
Threat.Undefined
1.223.2495.0

Norman
Win32.Sality.3
19.05.2016 01:04:49

File size:
4.1 MB (4,268,469 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\minecraft_pcgdemo.exe

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:1jeS7IZFnk5BbDmVA/NMQ9KTJ9hfcHBf332pJ8hvYfKS2AP1GmSA93:peS7IZ+vDHW+OJ/s9GpJUvVq1Gml93

Entry address:
0x9C40

Entry point:
60, 2A, CE, 89, DA, F2, F6, C2, 62, 3B, F5, 70, 0C, 81, C9, 91, 11, 65, 23, F7, C2, AB, 4B, 94, 69, 75, 06, 8D, 3D, 20, 81, 51, EB, 1B, EA, FF, CB, 0F, BE, C4, 3B, F0, 8D, 2D, C0, A2, B9, 45, 0F, AF, C2, 69, F0, 39, E8, A0, 6B, F2, C7, C5, 05, A0, 66, A4, FE, C9, 0F, B7, D9, 68, 44, 35, 66, 00, 74, 07, 85, D8, 33, FD, F6, C6, C7, E8, 00, 00, 00, 00, 8D, 0D, F0, B8, E3, 08, 81, FF, D4, 84, 00, 00, 77, 03, 0F, AF, F1, EB, 08, 8D, 15, CE, 4F, 67, D8, 86, EE, FF, CD, 0F, AF, F2, 8B, DA, 0F, BE, EA, C7, C2, D1...
 
[+]

Code size:
37 KB (37,888 bytes)

The file minecraft_pcgdemo.exe has been seen being distributed by the following URL.

http://dnbk9lbi8nhma.cloudfront.net/.../minecraft_pcgdemo.exe

Remove minecraft_pcgdemo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.