home

stockwood.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from schachblog.vsud.de.
MD5:
a540fc75f74d439a16f4c08d12adbaf9

SHA-1:
2ad41aceb8646011dfe28e8109567b2facc21370

SHA-256:
2359e142ec018671b2d80fbfdd7740902764b0ff15128e4532a2d528b464d3d9

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 9:42:45 AM UTC  (today)

File size:
944.5 KB (967,168 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\stockwood.exe

File PE Metadata
Compilation timestamp:
1/4/2014 11:00:34 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows Console

Linker version:
2.23

CTPH (ssdeep):
12288:WYtZG7EpmXIR22wlU9rLaz+SyVb/avHnZ4PzMJ0lFar855a4f87VdmwjbV:WiZG7Ejs2wR+Smb/avmPzM2f5E4+h9

Entry address:
0x14E0

Entry point:
48, 83, EC, 28, C7, 05, 42, FB, 21, 00, 00, 00, 00, 00, E8, DD, 38, 01, 00, E8, 88, FC, FF, FF, 90, 90, 48, 83, C4, 28, C3, 90, 48, 8D, 0D, 29, BB, 0E, 00, E9, 54, 5D, 09, 00, 0F, 1F, 40, 00, 41, 57, 41, 56, 41, 55, 41, 54, 55, 57, 56, 53, 48, 81, EC, 88, 0B, 00, 00, 4C, 8D, AC, 24, 30, 01, 00, 00, 48, 89, CB, 48, 89, D6, 48, 8D, 4C, 24, 70, 4C, 89, EF, E8, E2, 40, 06, 00, 31, C0, B9, 0B, 00, 00, 00, F3, AB, 48, 89, F1, 48, C7, 84, 24, F0, 00, 00, 00, 00, 00, 00, 00, 48, 8D, 54, 24, 70, 48, C7, 84, 24, F8...
 
[+]

Code size:
775 KB (793,600 bytes)

The file stockwood.exe has been seen being distributed by the following URL.

http://schachblog.vsud.de/?wpdmact=process&did=NDAuaG90bGluaw==

Scan stockwood.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.