home

tattoo.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from forces.green-enters.ru.
MD5:
fb08cb78eb01bff1cb1abc2659c77a31

SHA-1:
401fb1bb486152785f7af061ade7a8c21fadc17f

SHA-256:
c3bbd2461bd4affbe398a9ac47cd40a1cb572e199fac3ae5833ef1c312f4b34b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/18/2024 3:14:19 PM UTC  (today)

File size:
487.4 KB (499,104 bytes)

File type:
Executable application (Win16 EXE)

Common path:
C:\users\{user}\downloads\tattoo.exe

File PE Metadata
Compilation timestamp:
4/10/2014 12:26:42 PM

OS version:
5.0

OS bitness:
Win16

Subsystem:
Windows GUI

Linker version:
18.7

CTPH (ssdeep):
12288:2H7EmqKLoLQYC/c3l7dUeumR0EqWKMB7/ZcIxC73A5W7UGxszY0MSnzrmLNm7RCS:Sm7dUeumR0EqWKMB7/ZcIxC73A5W7UG0

Entry address:
0xAF48

Entry point:
C1, CF, 06, FD, 85, 44, 24, EC, F7, 44, 24, 08, 2D, 59, 85, 8A, 87, EA, C1, FB, 0A, 19, D2, F5, 81, D1, B7, 58, 69, 6A, C1, DB, 00, C1, DA, 1C, 43, BA, 22, EB, 9D, 18, C1, D3, 19, C1, E7, 1D, 81, C2, 5E, C6, A2, E7, C1, E9, 0B, 46, 4A, 0B, 4C, 24, 0C, 23, 1D, 4E, ED, 42, 00, 81, 3D, 92, 8F, 44, 00, C2, 46, 93, 1B, 42, 81, F7, 74, FE, 5E, 49, 90, 0F, B6, 0A, 33, 1D, A8, 1E, 41, 00, 85, 2D, 9D, 15, 45, 00, 89, FD, 81, C1, 08, 79, EC, E6, 45, C1, EF, 00, 81, C1, 78, 37, 54, 19, F7, 04, 24, 66, 23, 57, 18, 81...
 
[+]

Code size:
392.5 KB (401,920 bytes)

The file tattoo.exe has been seen being distributed by the following URL.

http://forces.green-enters.ru/NTM2NTtodHRwJTNBJTJGJTJGenZ1a29mZi5ydSUyRmRvd25sb2FkJTJGMTUxNTg4NDtuYW1lPVRhdHRvbztzaXplPTE2NjkzNjA4O3R5cGU9YXVkaW8=

Scan tattoo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.