» val_v1.1.1_setup.exe
Overview
Analysis
File Details
Downloads (12)

val_v1.1.1_setup.exe

This is a setup and installation application. The file has been seen being downloaded from www.netzwelt.de and multiple other hosts.

File name:

MD5:

17bae3434f8829d2cba8f7ec1c9d8c70

SHA-1:

bfd034b304570c41bd886d2573832c5ff4318f18

SHA-256:

088d84d1973b85aa8d056c6e97798cabcfafc75ebc28dcd064ef707dde58a57a

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

4/24/2024 11:54:44 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Bkav FE

HW32.CDB

1.3.0.4959

File size:

711 KB (728,103 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\val_v1.1.1_setup.exe

File PE Metadata

Compilation timestamp:

3/31/2007 6:09:55 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:Qceud+hXrXHC0MmF0wC0X8EFA+626qJUPcdjJ/HToJU13ZgLvPHxm3BFZjHb:Qju8pr3wwC0BA+626qWPyivzJmRrjHb

Entry address:

0x315D

Entry point:

55, 8B, EC, 81, EC, 80, 01, 00, 00, 53, 56, 33, DB, 57, 89, 5D, F4, C7, 45, F8, 30, 92, 40, 00, 89, 5D, FC, C6, 45, EC, 20, FF, 15, 30, 70, 40, 00, 53, FF, 15, 70, 72, 40, 00, A3, D0, F0, 42, 00, 53, 8D, 85, 80, FE, FF, FF, 68, 60, 01, 00, 00, 50, 53, 68, 40, 94, 42, 00, FF, 15, 54, 71, 40, 00, 68, 24, 92, 40, 00, 68, 20, E8, 42, 00, E8, EE, 27, 00, 00, FF, 15, B0, 70, 40, 00, BE, 00, 50, 43, 00, 50, 56, E8, DC, 27, 00, 00, 53, FF, 15, 08, 71, 40, 00, 80, 3D, 00, 50, 43, 00, 22, A3, 20, F0, 42, 00, 8B, C6... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

23 KB (23,552 bytes)

The file val_v1.1.1_setup.exe has been seen being distributed by the following 12 URLs.

https://www.netzwelt.de/.../20547_2-vista-anti-lag.html?sig=a35b8d9130c95708278c84955b8227cf

https://doc-0s-8s-docs.googleusercontent.com/docs/securesc/90gsdinp70krf6tffqtls46e4cj8vg3i/smf8bsmkth81f75ig09h95fhgn2uiba1/1383508800000/08929160680399983693/.../0B6v7loYozYpgOGhPdDMzZnp5WHc?e=download&h=16653014193614665626&nonce=tfo5fug8462pc&user=15173064599177038255&hash=qm0t57ubr6u074j5ko4ra7i8dkec66ie

https://docs.google.com/nonceSigner?nonce=tfo5fug8462pc&continue=https://doc-0s-8s-docs.googleusercontent.com/docs/securesc/90gsdinp70krf6tffqtls46e4cj8vg3i/smf8bsmkth81f75ig09h95fhgn2uiba1/1383508800000/08929160680399983693/.../0B6v7loYozYpgOGhPdDMzZnp5WHc?e=download&h=16653014193614665626&hash=70sful44lqs8tm3pffnmmk8f12al7qfl

https://docs.google.com/uc?id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download&urp=https://docs.google.com/file/.../0B6v7loYozYpgOGhPdD&pli=1

https://docs.google.com/uc?id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download&urp=https://docs.google.com/file/.../0B6v7loYozYpgOGhPdD&pli=1&auth=DQAAAI8AAAANqEGyuSDKoHsxmi18yTH38Rd8aT-M6Ta3fGt0i6_-WATS2AgJsfG8uZAIGtmitIQaUDfjFmJVtlICaQg7nMA6pBqiU7jCZ25q9jkFN3onDiC2Ah9dPSZCuGOUiw0nTWCuc25dVVBt-bL5sUSFNA5hqLrpVjE66kpNvuCvv9BQCwsaCW8JT0I54YN_v_RX1dA&authuser=0

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/uc?id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download&urp=https://docs.google.com/file/.../0B6v7loYozYpgOGhPdD&followup=https://docs.google.com/uc?id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download&urp=https://docs.google.com/file/.../0B6v7loYozYpgOGhPdD&ltmpl=homepage&authuser=0

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/uc?id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download&urp=https://docs.google.com/file/.../0B6v7loYozYpgOGhPdD&followup=https://docs.google.com/uc?id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download&urp=https://docs.google.com/file/.../0B6v7loYozYpgOGhPdD&ltmpl=homepage&authuser=0

https://docs.google.com/uc?id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download

https://docs.google.com/uc?authuser=0&id=0B6v7loYozYpgOGhPdDMzZnp5WHc&export=download

http://www.modernwarfare2.mapmodnews.com/.../VAL_v1.1.1_Setup.exe

http://www.mapmodnews.com/.../visit.php?lid=122

Scan val_v1.1.1_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.