home

photoshop-cs6-mariolast.exe

Inter Ai-Ti, OOO

The application photoshop-cs6-mariolast.exe by Inter Ai-Ti, OOO has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from cloclo26.datacloudmail.ru and multiple other hosts.
Publisher:
Inter Ai-Ti, OOO  (signed and verified)

MD5:
b48fe8a569b7487f6627a3da5642b905

SHA-1:
f32745578f4a8cc8d873b1fad9a04213c48c21c7

SHA-256:
13f7c9c7b29f97306be9450d9b93bf923d0f53f8bca859801bdefa0089bacde7

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/29/2024 3:47:50 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InterAiTi.Installer (M)
16.2.2.9

File size:
230.5 MB (241,712,712 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\photoshop-cs6-mariolast.exe

Digital Signature
Signed by:
Inter Ai-Ti, OOO

Authority:
COMODO CA Limited

Valid from:
8/13/2015 5:00:00 PM

Valid to:
8/13/2016 4:59:59 PM

Subject:
CN="Inter Ai-Ti, OOO", O="Inter Ai-Ti, OOO", STREET="22 Liter A Pom 1n, ul.13 Krasnoarmeiskaya", L=Saint-Petersburg, S=Saint-Petersburg, PostalCode=190005, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
2A2DCB6250C2FA8A228D0A7DF37523E7

File PE Metadata
Compilation timestamp:
2/17/2012 6:55:21 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6291456:/Bo7gPeNdzzjM2QsBBtQmeOzaOuvolp6OlSz+5PUe:a7g2NBzgsuOzKQH6Oz

Entry address:
0xB583

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, F2, 2D, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, EE, 9F, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 1C, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 1C, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, 17, A5, FF, FF, C3, 55, 8B, EC, 83, EC, 1C, 56, 33, F6, 56, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 40, 32, 41, 00, 85, C0, 74, 21, 56, 56, 56, 8D, 45, E4, 50, FF, 15, 44, 32, 41, 00, 8D, 45, E4...
 
[+]

Entropy:
7.9999  (probably packed)

Code size:
71.5 KB (73,216 bytes)

The file photoshop-cs6-mariolast.exe has been seen being distributed by the following 26 URLs.

https://cloclo26.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=d6c414c64a0fc64edd0217587bb760046d7c66d4

https://cloclo118.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=ef10ea5bcc5d8927aa46fff6f51d4c56652e63f2

https://cloclo13.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=73b7c5b98641decbbce40e9bcd0006017bcc6360

https://cloclo24.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=c633f5bdf05c0d44de0580364954182810c440e5

https://cloclo12.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=bad821fa109413d234fbe01ffe6fb099ecfa6a66

https://cloclo20.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=83c2074591ed5a886e60885473eb5bac79dedd45

https://cloclo24.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=53665f7239dbb5e856f359d4e84ea484d9acb987

https://cloclo26.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=6db4b47d7ebeaf35885a076ccc2940be8481bcf7

https://cloclo11.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=8bb891ee297fd7d63322aa297e06adea080dc91a

https://cloclo27.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=4179b3b2c973728c60f20fb1af833c7fd2fc0815

https://cloclo17.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=0b957db6411538d00f8c589b411f617b81d33cbe

https://cloclo28.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=1ac0f8c9dd541686d50e1e93548acd36ea2ae4e1

https://cloclo128.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=7dc7a2d2d4745a2502d80e7e56b26ed10efa74fb

https://cloclo108.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=cfd3be10802c9b633d0068dc96c2f409bf737ee0

https://cloclo126.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=53dc0c70a7fab71336ba710c13248af9890f352d

https://cloclo103.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=55e352f6ba8b4d2f19b2f2d351ded91f893b51a5

https://cloclo127.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=812fec3fe3f5a4a392c00a1c4fbc0759e3b77831

https://cloclo20.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=965de72e520f2a25052989512b0ed5b3722f0be7

https://cloclo2.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=5803e8321661681f38b02eca3052c0e8280d74fd

https://cloclo128.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=524361c81ea87667226ef4eb970f67d3b9ba121c

https://cloclo13.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=40ff6bd85015b14891433055e91a954d99752641

https://cloclo12.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=1494fb6ca1355ea76257f8f0974852cb9aa99c53

https://cloclo126.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=42c4304da5749e9000a1a8826a9d73631161611e

https://cloclo111.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=4e3519243180ca7c4cd9636e4d65db63ee02db0d

https://cloclo28.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=837e4b9bf0f7fd6fa0cb48f3cbd7ce311d93d3d6

https://cloclo11.datacloudmail.ru/weblink/get/.../xpRc6UXcS?key=8b1f76bd7646b3629b07f76e9b27aa7fec683db8

Remove photoshop-cs6-mariolast.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.