home

pidgin-otr-4.0.0-1.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from w307184.blob2.ge.tt and multiple other hosts.
MD5:
6359b19fb9d49c9e00bb6bc516a870ef

SHA-1:
04ec073d35f6f37615fecde6c56caf80a95b9e71

SHA-256:
818885bdbc51bb1023c11a9a1b8432ca93203fa99b308697f8ce8cfe5f2f8a8c

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/26/2024 12:20:51 AM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
TROJ_GE.6934BEEC
7.2.358

File size:
1.5 MB (1,623,752 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\pidgin-otr-4.0.0-1.exe

File PE Metadata
Compilation timestamp:
1/5/2010 10:27:24 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
49152:Wb+NbchsajQTBYPKhsg8fMZKjK58cSpsRB:D5wsCQ2SsgsjG8vEB

Entry address:
0x3E3F

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, E8, 30, 59, 00, 00, C7, 04, 24, 01, 80, 00, 00, E8, D4, 55, 00, 00, 53, C7, 04, 24, 00, 00, 00, 00, E8, 3F, 59, 00, 00, A3, 28, 09, 43, 00, 51, C7, 04, 24, 08, 00, 00, 00, E8, 27, 32, 00, 00, A3, D8, 09, 43, 00, 8D, 85, 84, FE, FF, FF, 52, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 4C, B2, 40, 00, E8, 69, 58, 00, 00, 83, EC, 14, C7, 44, 24, 04, 4D, B2, 40, 00, C7, 04, 24, 08, 0A...
 
[+]

Entropy:
7.9737  (probably packed)

Code size:
34 KB (34,816 bytes)

The file pidgin-otr-4.0.0-1.exe has been seen being distributed by the following 6 URLs.

http://w307184.blob2.ge.tt/streams/.../pidgin-otr-4.0.0-1.exe

http://w283242.open.ge.tt/1/files/5bXa8sY/.../blob?download

http://ge.tt/api/1/files/5bXa8sY/.../blob?download

http://dl.cdn.chip.de/downloads/.../pidgin-otr-4.0.0-1.exe

https://otr.cypherpunks.ca/binaries/.../pidgin-otr-4.0.0-1.exe

http://www.cypherpunks.ca/otr/binaries/.../pidgin-otr-4.0.0-1.exe

Scan pidgin-otr-4.0.0-1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.