home

setup_product_8477.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from doc-0g-64-docs.googleusercontent.com and multiple other hosts.
MD5:
5f93f1575c80569d655ec98da03c730d

SHA-1:
f623b176eef774ee5066351c663e2f5fc2df1ad0

SHA-256:
bba43cfe5b7c0b1a1ebffedbdd2dd14e1c9aaf3ecb82f3b9203f5441b2d339d4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 10:49:06 AM UTC  (today)

File size:
452.5 KB (463,360 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup_product_8477.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:4i7j6XPX5Ar8vsuW1d3ID7FU8HGzv/pMhkGPAD4kzdCWxySdq0rEPvJU29a0aSwa:r6XPeUsu1vFU8sPBzdgHkEnS2Zap

Entry address:
0x626D8

Entry point:
55, 8B, EC, 83, C4, F0, B8, 08, 14, 46, 00, E8, 20, 3E, FA, FF, A1, 64, 4A, 46, 00, 8B, 00, E8, 9C, C6, FF, FF, 8B, 0D, 54, 4B, 46, 00, A1, 64, 4A, 46, 00, 8B, 00, 8B, 15, 30, 07, 46, 00, E8, 9C, C6, FF, FF, A1, 64, 4A, 46, 00, 8B, 00, E8, 10, C7, FF, FF, E8, CB, 1E, FA, FF, 8D, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
387.5 KB (396,800 bytes)

The file setup_product_8477.exe has been seen being distributed by the following 8 URLs.

https://doc-0g-64-docs.googleusercontent.com/docs/securesc/itocmuu9koiu3j97igd588bmhv8e6l87/musrio1ksqf4s1qih85gcbg7khvvblp1/1368360000000/.../14169541722926878108/0B2ei_F98M_dDNG92Um1KUEN5Y2s?e=download&nonce=boqb23c8i1dle&user=14169541722926878108&hash=ri3rhvq6oil16jon5h3qdimdsip09blu

https://docs.google.com/nonceSigner?nonce=boqb23c8i1dle&continue=https://doc-0g-64-docs.googleusercontent.com/docs/securesc/itocmuu9koiu3j97igd588bmhv8e6l87/musrio1ksqf4s1qih85gcbg7khvvblp1/1368360000000/.../14169541722926878108/0B2ei_F98M_dDNG92Um1KUEN5Y2s?e=download&hash=hltqaepm0hntroitvgja48q1lc2k6m9t

https://doc-0g-64-docs.googleusercontent.com/docs/securesc/itocmuu9koiu3j97igd588bmhv8e6l87/musrio1ksqf4s1qih85gcbg7khvvblp1/1368360000000/.../14169541722926878108/0B2ei_F98M_dDNG92Um1KUEN5Y2s?e=download

https://docs.google.com/uc?id=0B2ei_F98M_dDNG92Um1KUEN5Y2s&export=download&pli=1

https://docs.google.com/uc?authuser=0&id=0B2ei_F98M_dDNG92Um1KUEN5Y2s&export=download&pli=1&auth=DQAAAI4AAADfu9UmcIOlILgkZjIfaJBHqE3aV6vxPEr5lYWlYkSVwJ4AaNPkexTN2P_ntnBuNT-Zw9leX35KIleaH6ZAx0-d2SfZ-KuPM0rXVYmConpQs8Zf0JBBz1c4-KpNvMtgnGY1W9EtTQRznGVWwoRUJWgwgHRS_BbNSEUDQr8dYSMBx_JNFZ-jaHOpfDx4AbJFoLQ

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://.../uc?authuser=0&id=0B2ei_F98M_dDNG92Um1KUEN5Y2s&export=download&followup=https://.../uc?authuser=0&id=0B2ei_F98M_dDNG92Um1KUEN5Y2s&export=download&ltmpl=homepage

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://.../uc?authuser=0&id=0B2ei_F98M_dDNG92Um1KUEN5Y2s&export=download&followup=https://.../uc?authuser=0&id=0B2ei_F98M_dDNG92Um1KUEN5Y2s&export=download&ltmpl=homepage

https://docs.google.com/uc?authuser=0&id=0B2ei_F98M_dDNG92Um1KUEN5Y2s&export=download

Scan setup_product_8477.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.