home

MSPAINT.EXE

Paint

Microsoft Corporation

It is included with Windows XP (SP2). The file has been seen being downloaded from dl-mail.ymail.com and multiple other hosts.
Publisher:
Microsoft Corporation

Product:
Microsoft® Windows® Operating System

Description:
Paint

 
Part of the Windows XP (Service Pack 2) Operating System

Version:
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

MD5:
57adb09ed3617b042d155449490a9f76

SHA-1:
c2d4b9dba60ceabc9eed7ab2ebb38e7b18d03355

SHA-256:
111c6eac194134bb77e202f8bb489b1c56451528d45050436cb7a6d330b15054

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/25/2024 10:42:48 PM UTC  (today)

File size:
335 KB (343,040 bytes)

Product version:
5.1.2600.2180

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
MSPAINT.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\mspaint.exe

File PE Metadata
Compilation timestamp:
8/4/2004 2:06:11 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
6144:B414DREcMZ5vVCiiKrao9afJu3YYtWGaVoRiS6hxH5AgPa4:B3FuvVCiisao9Ii3aViKHy

Entry address:
0x34BBF

Entry point:
6A, 70, 68, 00, 74, 00, 01, E8, 11, 04, 00, 00, 33, FF, 57, FF, 15, B0, 11, 00, 01, 66, 81, 38, 4D, 5A, 75, 1F, 8B, 48, 3C, 03, C8, 81, 39, 50, 45, 00, 00, 75, 12, 0F, B7, 41, 18, 3D, 0B, 01, 00, 00, 74, 1F, 3D, 0B, 02, 00, 00, 74, 05, 89, 7D, E4, EB, 27, 83, B9, 84, 00, 00, 00, 0E, 76, F2, 33, C0, 39, B9, F8, 00, 00, 00, EB, 0E, 83, 79, 74, 0E, 76, E2, 33, C0, 39, B9, E8, 00, 00, 00, 0F, 95, C0, 89, 45, E4, 89, 7D, FC, 6A, 02, 5B, 53, FF, 15, 44, 1E, 00, 01, 59, 83, 0D, 7C, F4, 03, 01, FF, 83, 0D, 80, F4...
 
[+]

Entropy:
6.0349

Developed / compiled with:
Microsoft Visual C++ v7.1

Code size:
239.5 KB (245,248 bytes)

The file MSPAINT.EXE has been seen being distributed by the following 7 URLs.

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-srwdkrS8DSJy6mptRejFcJx4ViWgsb7SobvBfTFmucyeZOCiTzATs2fqnJEEiK5F/messages/@.id==AF_mjkQAADlWV_YISgr4mFKJ6lI/content/parts/@.id==2/raw?appid=YahooMailNeo&ymreqid=fada2e19-9ff9-356b-01a9-da0011010000&token=ur3jnS7e5yptf5o96KLZyBa5JogAGDYuKzJJAA6nvDQzuszCoWQdpmLTCOld4ISmVjuUXrMkIhF5WeWJwkPmcW3jzS_hblsl1-dB_TjBhLWldJA8i3vzfiNePJFcLA02&error=https://mg.mail.yahoo.com/.../iframemsg?id=330360b7-7d3b-503a-245c-2035df9c571c

http://dla.uloz.to/Ps;Hs;fid=7043071;cid=899935830;rid=697363928;up=0;uip=94.136.150.203;tm=1426411297;ut=f;aff=ulozto.sk;did=ulozto-sk;He;ch=7062af72c34f79e3f3dd5eb8173b11d3;Pe/.../skicar.exe

http://dla.uloz.to/Ps;Hs;fid=7043071;cid=1520430729;rid=1095441441;up=0;uip=217.12.49.50;tm=1426014751;ut=f;aff=ulozto.sk;did=ulozto-sk;He;ch=9860fe47fe4d844643726cb79eee28f4;Pe/.../skicar.exe

http://dla.uloz.to/Ps;Hs;fid=7043071;cid=1546960529;rid=547250001;up=0;uip=178.40.14.41;tm=1438762844;ut=f;aff=uloz.to;did=uloz-to;He;ch=094b3aa08592c0f1e335eec17679cf37;Pe/.../skicar-exe?bD&c=1546960529&De

http://freecache11-free.uloz.to/Ps;Hs;fid=7043071;cid=1200314901;rid=1749701790;up=0;uip=95.210.165.18;tm=1409739555;ut=f;aff=ulozto.sk;did=ulozto-sk;He;ch=4157c0e99401e7dacdc96d3f233e51a4;Pe/.../skicar.exe

http://dla.uloz.to/Ps;Hs;fid=7043071;cid=1200314901;rid=1749701790;up=0;uip=95.210.165.18;tm=1409739555;ut=f;aff=ulozto.sk;did=ulozto-sk;He;ch=4157c0e99401e7dacdc96d3f233e51a4;Pe/.../skicar.exe

http://www.ulozto.sk/.../skicar-exe?do=downloadDialog-freeDownloadForm-submit

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.