home

vag-com release 5041ud.exe

Ross-Tech, LLC

This is a setup program which is used to install the application. The file has been seen being downloaded from s10646.chomikuj.pl and multiple other hosts.
Publisher:
Ross-Tech, LLC  (signed and verified)

MD5:
0ca3e89a5579034839e1f8b1e834b684

SHA-1:
cff445229196ccdd06144a655a2f9dce226b4be6

SHA-256:
b69555bd77bda8c6ad2109a1a1c83b6f25d81d236b3bb3d406d759d73820e5ce

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
4/24/2024 3:23:30 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Packed/PC-Guard
7.1.1

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.141009

File size:
1.4 MB (1,486,920 bytes)

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Ross-Tech, LLC

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
3/17/2005 10:28:50 AM

Valid to:
3/17/2007 10:28:50 AM

Subject:
L=Lansdale, S=Pennsylvania, C=US, OU=Secure Application Development, O="Ross-Tech, LLC", CN="Ross-Tech, LLC"

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
20FBBC

File PE Metadata
Compilation timestamp:
12/26/2004 7:34:24 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
24576:j8P5FZORDp5qV+VNJnh9ENOQ3CeQv+PzLAaBTu//se5dL8BBQPFYribfKR1s5:ji7ORDp5WS/h9ENV3MM3AaWke/L8BBtw

Entry address:
0x21BE0

Entry point:
60, BE, 00, 70, 41, 00, 8D, BE, 00, A0, FE, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75...
 
[+]

Entropy:
7.9955

Packer / compiler:
UPX 2.90LZMA

Code size:
44 KB (45,056 bytes)

The file vag-com release 5041ud.exe has been seen being distributed by the following 12 URLs.

http://s10646.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hSP-wSXgC4Vo1mKF8S51Bs6wURxDISTOKc6edUW11SaHwpoBdtCfIdgBIbYk4zGqIAMisaasiVAJOFerU6GdW103k8rJ_E4Ba2MqR07wzwf0QeBJH7aDzK0NVKddpfRakewSJa3WvkeWEtWEO8LMRQA&pv=2

http://s10646.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hbWmt9yGeSvhppFDjcZFpVKyXIDLqw3YpyqFtcZziFng1XIwgrdxO7upeTT5pPSdu_B7DPPL0up2UQ7SZAn5Qm1_pl0iRdlb3zyF4kuXZUikocQZiqyz6SF7DCc0UMsTzMQNtvgUHJT7H9FcZvPkez8&pv=2

http://s10646.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hYKe8rPS9hY-QDRG10bgEmtDTVmTNx_4Sj2MfQyQydvrXTeNjdD7MuPsLG4FNJ8prMIkq2gKzuZ0CJowC3lf4zN6bt3TTRKnS9c0m-Cr-QUUaq9iCTuGpe7qjhSxdC5WCrKvNFKkPCrW2sdRxGKagtI&pv=2

http://s10646.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hRWFd5dIFMEYy1PdO3r1IIUwwieCfWblZ7-1eQ288yjmFXhaj85gOqbj8MekkPPWKDPqKu_ceTCS49AyGusMwAGVRl396GCT0yifAf17Y2dWFoQC91my_-0iWeAYI4PvL2tF18iewVhXfUDmuOmAqEg&pv=2

http://s10032.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hYKe8rPS9hY-QDRG10bgEmvmZVrHiCvddbzOf1DuXeiTnv2IBYSuGMsh9lWd9o-6vodEBMQxcXL45WoWnv1KYXvpBQ2XnOfIAlaoQ70wK3d4Fr1rrP7LFAngCLWs0QuKw_SoKBRm8C-ilH_lINdGKgA&pv=2

http://s10032.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hRWFd5dIFMEYy1PdO3r1IIVOq7mQSsy-r2ngiaNUaQbmACkl5YOOqv9hogM0NymYY2NS9nMRjdiwCXBP_DzjO9ZE7CFeruAERSS-y7-45KUM382g1T5br4KtgwIQhaJhyoKVuR9XDbcVP6EBnikrSv4&pv=2

http://s10646.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hbWmt9yGeSvhppFDjcZFpVLCy3Vtp8cEUtC43UI2zGSRdrXfGpOiM8mNUAO475upl81q16dhCus2pAfQx7iyd0nYlkNA7Gv0Nxd-X_RodHowTfVPfNwb5Ess0wzi1PCvLwoBlMcAfBOi3ZSHwhNLAjo&pv=2

http://s10646.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hRWFd5dIFMEYy1PdO3r1IIX8ShpF22km_wtGrnYMTLujRdIfPjUteiVw8ttM6SnZtsKED4nC2m2y11cLoeUGEwWFHNqZN4yn-_j2p9eoekBIvK8EfCLi_6Yvpy33_KtoZaD-mdjCllBGgGD-nD_D5sU&pv=2

http://s10032.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hRWFd5dIFMEYy1PdO3r1IIW0WexfHLbBoUROtd3XSdGkIXRBeRxCARFEBhL4yBCQUOrggyddVOs9FRa0zkDtQ4WeIFmq34t_IallptLCePQjMZr_US8P8nc59y0zQ8PDjEKkHJF2zeIBqxRp5PxYN54&pv=2

http://s10032.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hRWFd5dIFMEYy1PdO3r1IIUH2I2rhuftQPVthDpoxftJCL034ihbxUqAYHlgdyecQNBHYqCrzPn3-fOIfl9zTBrqS78MFXaTZrhcm6JCD5pZvr9eiSxk8r3x06m9_8CiXpiRXHYrjnyXmzNKzzDTscw&pv=2

http://s10032.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hRWFd5dIFMEYy1PdO3r1IIU4FwtjjBATepZprV5gpG2U6MjVVxo7IokoOYuaf7E7vWqztOcTRUL7MWxDVh75ed43QtGoW8cMqNQ3DkS2EVJsPSveNfx-XvsaA8L4CBwyP-ljO-IRY0LbASq4PNfXnV4&pv=2

http://s10032.chomikuj.pl/File.aspx?e=lS2CjqX_EKQjaM2wh9Z5hRWFd5dIFMEYy1PdO3r1IIWQ-aAF35IGolfZG9o86pA_U7HgOVQbyPG4lME_EbH8rYsgd6iQaKV537G73KyfgbRjRDkNi568kc4J0qJT8e_-ZZCjujTnxPsdgF20nvxwreffJcDKsTeG-BE3yf6LR1w&pv=2

Scan vag-com release 5041ud.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.