home

theforest_0.27.exe

The program is a setup application that uses the Self-extracting archive installer. The file has been seen being downloaded from fileshare1270.dfiles.eu and multiple other hosts.
MD5:
95c49fb16550bccc2ee551aa7fe0f6b2

SHA-1:
fbb43fa43ed6c1f97d5b2218c940c7239f5c807a

SHA-256:
7d889924f618f318e9849aef4f17f38e4989beb0e8352a90b819e135e6f0aaae

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/6/2024 11:12:28 PM UTC  (a few moments ago)

File size:
918.9 MB (963,555,575 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Self-extracting archive

Common path:
C:\users\{user}\downloads\theforest_0.27.exe

File PE Metadata
Compilation timestamp:
12/1/2013 3:08:23 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
25165824:4ZepXIeVReeb5gWfY1/+WwXvRz6+rXCd0+Nw9GtREh51QA:6QJeedgoYFHwXvRu+rR+sGtREhl

Entry address:
0x1D728

Entry point:
E8, F0, 57, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 05, FD, FF, FF, C7, 06, E4, 81, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, E4, 81, 42, 00, E9, BA, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, E4, 81, 42, 00, E8, A7, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, D1, C9, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Code size:
149.5 KB (153,088 bytes)

The file theforest_0.27.exe has been seen being distributed by the following 17 URLs.

http://fileshare1270.dfiles.eu/auth-1481449059f1896567805f8c66bc89a6-217.31.33.27-61449295-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-1468082585bc8130f75af2ae2fe66821-83.208.174.98-2616748847-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-147004855712d7a5cabd594ff6163da0-46.231.78.126-2637639754-164485785-guest/.../TheForest_0.27.exe

https://mega.nz/temporary/.../XAhmUQaD

http://fileshare1060.depositfiles.com/auth-14641721332f8b168db02206b1790382-37.210.82.51-2573693694-164485785-guest/.../TheForest_0.27.exe

http://fileshare1270.dfiles.eu/auth-14776480495c187359c2f952d724d51f-91.219.132.107-23317559-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-14712657760732bb1f5d0e4c4aae5d37-176.222.228.254-2651716715-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-14666816134a35b6d640276a83ceaf7f-85.71.180.219-2602022719-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-14688688539a5f91cede16594cf4c6b1-88.101.227.251-2624914030-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-1448035142c5292e957ffc2bf2868401-87.204.158.8-2361799791-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-14567542672f2d6ae1a485a761f1f84f-37.77.115.95-2483453062-164485785-guest/.../TheForest_0.27.exe

http://s7543.chomikuj.pl/File.aspx?e=eboTLBguMFin2ar3FHJrNa110SBJwgMRR9MNXQqSUc_MWX5ppjXtvXHE1fOsq7mOpQjxw-XQgSKLlIS8IjEgOFFJFvHM_MOat7ZuHKRPO_9pPMfnPDwqgsRrjzM2sZGGsqLqRa-g3l42H8i-VoqiDQ&pv=2

http://fileshare1060.dfiles.eu/auth-144759764763c2c1f1d12b131a89a88e-83.0.231.122-2355230248-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-1448098182acc587d15b8195c137e1b5-83.22.209.50-2362700483-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-144761533226089764a664a5d70fe349-176.106.32.9-2355595416-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-14482876239b61d648863588628e529b-79.191.140.167-2365618484-164485785-guest/.../TheForest_0.27.exe

http://fileshare1060.dfiles.eu/auth-144838060589bf1f69f74f870637a2c8-37.249.84.81-2367010291-164485785-guest/.../TheForest_0.27.exe

Scan theforest_0.27.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.