home

ratatouille_1.exe

7-Zip

Igor Pavlov

The program is a setup application that uses the 7z Setup installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
Igor Pavlov

Product:
7-Zip

Description:
7z SFX

Version:
4.42

MD5:
fd2dc08517458b768bb34d6a290a932a

SHA-1:
ce5fcbb2cb55e86f7b9b42fae1779e9cea2b939d

SHA-256:
b8fcd1385ef47883987df0ae3c05b2acbd83f70bede43bcf8567e6a7aa2629c0

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 10:26:53 PM UTC  (today)

File size:
160 MB (167,722,320 bytes)

Product version:
4.42

Copyright:
Copyright (c) 1999-2006 Igor Pavlov

Original file name:
7z.sfx.exe

File type:
Executable application (Win32 EXE)

Installer:
7z Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\ratatouille_1.exe

File PE Metadata
Compilation timestamp:
5/14/2006 6:24:40 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3145728:y4VtQhokwJ0dKyvP7bxGJUiS/jdTwjNyF95knPBmN7aRsJU:y6Qho1CUsP7bx2EMQF9SnIN7aaK

Entry address:
0x18136

Entry point:
55, 8B, EC, 6A, FF, 68, E0, BD, 41, 00, 68, 9A, 82, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, F0, B0, 41, 00, 59, 83, 0D, 04, 5D, 42, 00, FF, 83, 0D, 08, 5D, 42, 00, FF, FF, 15, F4, B0, 41, 00, 8B, 0D, 74, 0C, 42, 00, 89, 08, FF, 15, F8, B0, 41, 00, 8B, 0D, 70, 0C, 42, 00, 89, 08, A1, FC, B0, 41, 00, 8B, 00, A3, 00, 5D, 42, 00, E8, 1F, 01, 00, 00, 39, 1D, E0, 07, 42, 00, 75, 0C, 68, AF, 28, 40, 00, FF, 15, 00, B1...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
101.5 KB (103,936 bytes)

The file ratatouille_1.exe has been seen being distributed by the following 10 URLs.

http://dw.uptodown.com/dwn/bW8LeKZPYSjr6iZzXfACzpBvj1myl-H6P7pFfgVxf_rdcVEtJ3S0ChPu4czHUnwMafd9y3dh9Bq6a0cet2LpMaljGcimQdpdU-GUbt4vZIn4js-JBHTfAZ42pQc58fmB/vqEnLB2ooSzdn9lAGwMlVI_DUV7pmt8lhAapivw6YiaCjUj0PSXNejnFm2IUE3k3Bg59TczQh0GyB-ZuEoS4GlYVvHx8JfVV3ruPvfANAx9BuFV4OO-q2Vuz4CjoNvV5/2dIW1zlOPw0JQBEeYsqFqMOqWG7koa_0_wxmzoHpdd8tw1IQ0KTsiwVnWwU14DntjUwhHziPIUh-vhd1napPvvEQ1sufQgZocQzjwp5I2Qsp_eHh3eJ6l-VCXSw8tIN7/.../

http://ultradownloads.com.br/.../2,242156.html

http://www.techtudo.com.br/_/software/.../download

http://data2.mujsoubor.cz/downloadFile.php?n=cmF0YXRvdWlsbGVfMS5leGU=&s=s23t2iminpbbrvp49jtj9lr495&r=e33b08072f7c1461c76384069abb48e2

http://i.download.idg.pl/fannef/bf4421555df017504d07f56fcac4ddbf/57f9ec03//zx/cyberjoy/dema/r/.../Ratatouille_Demo.exe

http://dw.uptodown.com/dwn/QZXc_kwIPuWCtQl9K8-StaNdito4h7I-Fr6NBW0oY7yPEnIFxM34geZ6RbA8SD-MPRQnCgfFJbrBx066OqgiiXPVBKIcsvmm-zOoc0TuB7RfHK9m46Zfko6-hmZnvwA7/TScKevbgAtXGjy7h58nzxt1zuoifDZoDs488kAj_mKaBZxxKvbdWzpj-ZTnDBS6XpJmjsjoEvU6RVpzwE3lvqQhPl2F6QMFPA6fO3fZEdF9zRXx0zrlmBsWvit2x1rTu/s-uApBDerex-zHEiNHo8sOs8keXghTok11ncdmIqQM69AXeGNAYeezwwmJrVLC9tVB_TsOMnTqqOqlG_LrxB7Zl0g5cuZ0X7JcESqXerB5cBwsSJh66itR_yLjZYrWQS/.../

http://a.dolimg.com/media/en-US/disneyinteractivestudios/.../ratatouille_demo.exe

http://i.download.idg.pl/fannef/60afd2fef066c281e6f25119ff3c7d19/570137be//zx/cyberjoy/dema/r/.../Ratatouille_Demo.exe

http://www.gry-online.pl/.../przekieruj_ftp.asp?TOKEN=SUYrN2xqUXFHbVg5KzhybjBrRUwxZnBpYVF5SHczcDd0M0dzYjJOYlIrZTUxQjJsTGdUcEEySVhqK2R5M2VuMGM5NjV2aGtvdHRLTlZKT3EyY0FTc0tEOFU5NmtTMmU3ZWR4Z0FmQWpWeVBqd1E4NTg2SVI2VG9mY1pvSjJKalE=

http://download.fileplanet.com/ftp1/.../ratatouille_demo.exe

Scan ratatouille_1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.