home

the_alan_parsons_project_-_diskografiya_studiynye_albomy_1976-2004_mp3.exe

WinRAR

IKO-PROF

The application the_alan_parsons_project_-_diskografiya_studiynye_albomy_1976-2004_mp3.exe, “32 bit rarext.dll loader” by IKO-PROF has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from docs.google.com.
Publisher:
Alexander Roshal  (signed by IKO-PROF)

Product:
WinRAR

Description:
32 bit rarext.dll loader

Version:
3.92.0

MD5:
35859bcc4bc943b7f14b01a871a5d728

SHA-1:
8b92319eae6c61077433dcb8a5910a0353ae3a4c

SHA-256:
2ab781ae45cb782d38e3f62d9a9bcb23924a6293a752345f21dd05fde9fef9fb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/23/2024 7:03:56 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Somoto.IKOPROF (M)
16.1.22.10

File size:
975 KB (998,400 bytes)

Copyright:
Copyright © Alexander Roshal 1993-2010

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
IKO-PROF

Authority:
COMODO CA Limited

Valid from:
8/26/2015 6:00:00 AM

Valid to:
8/26/2016 5:59:59 AM

Subject:
CN="""IKO-PROF"", OOO", O="""IKO-PROF"", OOO", STREET="2-y Luch, 16 Ofis, 45", L=Saint-Petersburg, S=Saint-Petersburg, PostalCode=192019, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BC2915F4441B9D8AC34D01058C89EAE7

File PE Metadata
Compilation timestamp:
6/20/1992 4:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:PTdulH/M5GwqHfIEe4Yl9Kn8bu0TZA/rLYKi0biszUQEC/4GUY4EPG0c:PBIjwUIQYl9KnyusZAfYKdudQECw6nc

Entry address:
0x64904

Entry point:
C7, 05, 34, D0, 46, 00, 4A, 53, 43, 52, C7, 05, 38, D0, 46, 00, 49, 50, 54, 2E, C7, 05, 3C, D0, 46, 00, 44, 4C, 4C, 20, 6A, 01, 6A, 00, 68, 34, D0, 46, 00, E8, 2C, 0C, 00, 00, 85, C0, 75, 05, E9, 5F, 00, 00, 00, 68, 8C, 49, 46, 00, E9, 49, 00, 00, 00, 8B, 4C, 25, 00, 8B, 44, 25, 04, 85, DF, F8, 8D, AD, 08, 00, 00, 00, 36, 89, 01, C0, E0, AE, 8B, 06, F7, C1, 7C, 54, C4, 57, 66, 81, FA, 1B, 5E, F8, 81, C6, 04, 00, 00, 00, F8, 33, C3, 40, F5, D1, C0, 80, FC, F2, F7, D8, 40, 33, D8, F9, 03, F8, FF, E7, 8B, 6E...
 
[+]

Code size:
873.5 KB (894,464 bytes)

The file the_alan_parsons_project_-_diskografiya_studiynye_albomy_1976-2004_mp3.exe has been seen being distributed by the following URL.

https://docs.google.com/uc?id=0B5gkU5u0LUmxN3JlYVBUdkR6Q0k&export=download

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.