home

vkaraoke.exe

The executable vkaraoke.exe has been detected as malware by 2 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from dl-mail.ymail.com and multiple other hosts.
MD5:
0cc496a096d15026963530815f5e3978

SHA-1:
4caae25bb3bde8e8a2fc8fead03ef47d0a431186

SHA-256:
778456132f30427a034208d86ab66efaef5583e2a9d88961c5678c8481dceda8

Scanner detections:
2 / 68

Status:
Malware

Analysis date:
4/25/2024 7:03:13 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.Winlock.9260
9.0.1.072

Reason Heuristics
Trojan.Downloader.Meta (M)
16.6.27.9

File size:
864 KB (884,736 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\vkaraoke\vkaraoke.exe

File PE Metadata
Compilation timestamp:
11/13/2005 1:09:53 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
12288:LoI7NucUNM9u+vbyVEPj4qY56lYAWVhCYwFKUJZAQbLqLJ0n6hApI412rKxFi:LoI7McUK9Dv2ExhWVGKyhbLqnW6EOK

Entry address:
0xB062

Entry point:
6A, 60, 68, E0, 32, 41, 00, E8, 4E, 22, 00, 00, BF, 94, 00, 00, 00, 8B, C7, E8, A6, 23, 00, 00, 89, 65, E8, 8B, F4, 89, 3E, 56, FF, 15, F0, 20, 41, 00, 8B, 4E, 10, 89, 0D, 24, 95, 41, 00, 8B, 46, 04, A3, 30, 95, 41, 00, 8B, 56, 08, 89, 15, 34, 95, 41, 00, 8B, 76, 0C, 81, E6, FF, 7F, 00, 00, 89, 35, 28, 95, 41, 00, 83, F9, 02, 74, 0C, 81, CE, 00, 80, 00, 00, 89, 35, 28, 95, 41, 00, C1, E0, 08, 03, C2, A3, 2C, 95, 41, 00, 33, F6, 56, 8B, 3D, 3C, 21, 41, 00, FF, D7, 66, 81, 38, 4D, 5A, 75, 1F, 8B, 48, 3C, 03...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v7.0

Code size:
68 KB (69,632 bytes)

The file vkaraoke.exe has been seen being distributed by the following 50 URLs.

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-ts17eHQlbMk69R-lCDMrYHX2icPWG5_Fvlrn8di4o3YiIIz7yvBGC3kvJD4xSmoh/messages/@.id==AEdFv9EAAJC-RWZ1tw6Z1AbR5H4/content/parts/@.id==3/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBZgWgEs1LrPtsXOulATpTjE7mKE2f-G7luMamFynTAuH70YAkjy-pe-KjZS_2yQTfwGYHG5zZROOYeWZBW-NzAx&error=https://mg.mail.yahoo.com/.../iframemsg?id=3a31b057-c0e6-5c43-bcd6-b4373a40084e&ymreqid=8b1fcafc-c390-b3d4-01b0-620123010000

http://dw.it.uptodown.com/dl/1446369825/.../vanbasco-2.53.exe

http://dw.uptodown.com/dwn/XvDtR2B8BqZaWNtQdWrcySnBbpZTUptUifQl5u0Lrv2FN_Sv4vticr-Dm6DEByvNBq1FRsNefs4nD5v_2w2Wv2ANIdpntWWWg4qsOXboUyx0Q-ojZzHRxl_algohnxpY/3T6ud3OhREMcheu47DuDTxRLMgJeoIelXATj_-M0uTuH0Qv0CFbIJoVMm6FeAxFGtUgNgi45FqvXILBaoU8VrkcCpMCpnGzWg6OIJMxsVj29D0syCF7mFpGOknonAwIW/ptrgXvKPEF6mWttWPQRbFyKIakAbddrGsCJPsPSJT1uDr1-3bXRdmbFsb_91DF_vqqJr4w_5Lemo2yc90p-EWnixImzszes_8BJCy4SsNhzXoJV29KBxLNh_7z9lW8lO/.../

http://gsf-cf.softonic.com/dc3/3b6/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_it&type=PROGRAM&Expires=1452921844&Signature=aYCWjPj19IUhieUq0IY~0FCpPAYV-uM6D3hThlZHvIWusVERtu~xqMlZbKqgzeBMvoYlfeiEcz-XbVOY3hJ8Hl9oE2ZKnTyqSGYy4gdyEomwzJQ9rnVqpUQ69aw~PvruZb8kIZhMzPFos4icdipArclTMAMQyob4HI0qX-SiRho_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke.exe

http://gsf-cf.softonic.com/4ca/ae2/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_it&type=PROGRAM&Expires=1427772306&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=RDVRI0V~RWrRgnB58~ZWzXLQjQ4XwdFB0Uxjec2G0FkENi4gF8v9BNznKfuxYTNEFjPiZMEfJZOYAR811P7fTD~TFzhOrGs86puDojwXUXC2NqgbOz7HkBBovB5KLj2QX9pVmJDrZUoNFxxh56A1nkOsPposFZ9Esxod7QglgxI_&filename=vkaraoke-2.53.exe

http://www.compszerviz.hu/.../vkaraoke.exe

http://cdn.portalprogramas-download.com/d/.../vanBasco

http://gsf-cf.softonic.com/4ca/ae2/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_it&type=PROGRAM&Expires=1423535318&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=AUeOuNdoiZXN0bp~RuRYVD35zJtnqqhYsuDynjcvyuFq0FyY-XjZVWsp2k6w2OTPRdW5Ynf3-HdKrnXw2OFf8D2ooqPYhoI-XjdygdrwLVRNrOdyMTezYqDuuyLMvLcF~V7rrVvyD92td6O0j2ILMFCDK1pnWSdgy-~skVnewfI_&filename=vkaraoke-2.53.exe

http://gsf-cf.softonic.com/dc3/3b6/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_it&type=PROGRAM&Expires=1453684771&Signature=e7c~etCYVtYgrXuHYdihWhg7MSBPaPZN4Wk~2GG~UJ~uAg6371dP4C71PXsZZ5CkKjkF5hyjjEUaQuqXuqbvqAzsl6Qufg6ZyWG5xJQBIEVAPtyhT1kaiCUzfieZPxPcdPgIx~UjoIAuAoqOEzSfcUuGe97ERJCa6WmQnkH9IA8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke.exe

http://www.parrocchiaredentore.it/musica/.../vkaraoke.exe

http://gsf-cf.softonic.com/4ca/ae2/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_pl&type=PROGRAM&Expires=1470464202&Signature=A~TmCRih2wHvIA8gUSvIt34nY~7ZxMIOTIA28rp0cX8rbtkiyDPLTv~Dw0mCaC80MvFHxo23dJWPTIthfyQ0WbuEkPiiOZPR4JojZP6lnBBd-z5rMHmWumNXpxr4mIz6knXrc5apsbcElZX-CVb6WkG9CKUzTjkMZl9G-FvimXA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke-2.53.exe

http://gsf-cf.softonic.com/dc3/3b6/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_fr&type=PROGRAM&Expires=1479079944&Signature=Q9pP9MIzGtpjH4ll6n91~c4siIkUZPO7eSPiijryHG1YH1d3T3oBnlaGCSSu-8lJZHEN0sKNJCx3aFef1K1hICoKY1pcwm3V4MlmWNxkiX7BrD4XICjVPPtzrNycY8Pk3PVKbN2Ok~a4i3KXw7Ag79tgHsOpvMl-HLZEBmf6sSM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke.exe

http://dc401.4shared.com/download/.../vkaraoke.exe

http://gsf-cf.softonic.com/dc3/3b6/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_es&type=PROGRAM&Expires=1482891684&Signature=iBjoZMp2qPEkA9kRlXJQ8clFEqPvIexjcNZ2vc~0C5J1B4xrpmyPpT2Vetp~AIheX8NRDlOXfrIGxXlSySxnHLqMm94cgN4WJDZzbeqApMDnRGolWDOfI8LDy9hyVktBKM-gRUy4BbtrAlsWxL6QzSCL5bRUNfJIohdHMjG-5KU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke.exe

http://filehippo.com/it/download/file/.../

http://gsf-cf.softonic.com/4ca/ae2/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_it&type=PROGRAM&Expires=1425770215&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=KlhMk2UX63nfetVRrrY18tOdOxIwXLwDMFb~J6dpBeFC1n66pLvuVuu4ngnA5-5Kgo8BlcfURZZKIgKHjQg9ghd2TYD6Bn2cnvBfoN1cxV3qkMWz8ObZO3ait991ZE6PNGHJQF~uAb1Z1ZbPeXtp-f9ulrOeqVkA0UyW4Fa0Gzg_&filename=vkaraoke-2.53.exe

http://es.kioskea.net/download/.../descargar-2072-vanbasco-s-karaoke-player

http://gsf-cf.softonic.com/dc3/3b6/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_it&type=PROGRAM&Expires=1471140003&Signature=Ma3Gmo7smCAfFnScsPP6uHzznJE689z8~Z8mest3B2TYh~TTFsIMnukXR4pJ0Ghtajg98GpqVFYSVo1jLiu3gXvNs8jOeJ74a3bG5L-hdx2rqQLwBPe6RMS~F-a65qN9OuKnZkIxxwt378b6nxJhTs8ckHEvQtL7smMe5g34bSc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke.exe

http://gsf-cf.softonic.com/4ca/ae2/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_pl&type=PROGRAM&Expires=1440545134&Signature=bRyITo~uloFjKFgg9dLGuN6ZIhLOKNxgkzvPv~UrlofnMyIh8ix1SWgGJk8Fu~VygqQR5XZVAX2jopvxkEinDv1sXGlpoTY8jdY12WCfo-qAHnF4IvY3V369BA-gI4Z7kTw8FXqwcg8jJOu7drq3mQavO5rHXlHGt9UqkbA913Y_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke-2.53.exe

http://gsf-cf.softonic.com/dc3/3b6/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_en&type=PROGRAM&Expires=1473730168&Signature=UaKvOg~zLhte6qJ-XQtw4jXpDav78k8YF9rt5vMA1ycBPC4TmUo-CxxFx4gQViaRzpZRg3Ad9~xe~B-PEP4fR31R0m8Q9fvOv87qUJzNcIssTQzhRDEvOBNQCKTw11Gz~cIMFL7rtpPgVfw0mHl~RfUA~TRwF7Uvn2hC8VaiZ4Q_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=vkaraoke.exe

https://dw11.uptodown.com/dwn/JCISd8V9u4cBykt9N134Lu0LaTFSwcNijZeCNzzx9B5lSocYJUmg9oVvi2MlFTPsry2Kyq-O-sxRtyYmmPwfA6VXKwCgNEdpFvoQAFvYQnHtVYP-lPzx2OWQdOEhMmoh/MayOub7AcaFGbp0A80UCGP6Gadhej1WM3TsDVva3olKTunZwC2jSaSzEBye3OqVZUOVHqPWrLrkHbOENCR_YeTxxUGZAKKTcZlPdA2_Qixui1xl4QLdBR4R2oogFujgi/iy_hOpF7iHrm18bKoi7YAojeaw4MaJa4TPGmqUYhm20ftXMmmTpfGDbKwIqDudtkRd0j_JfyLD3XnOqKs8NEwjH7SvfwlBcQ-PbZOLARd3UsanZR_fSnrhB54jWR-enC/.../vanbasco-2.53.exe

http://gsf-cf.softonic.com/4ca/ae2/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_pl&type=PROGRAM&Expires=1429077786&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=cam0wIGIDbLiuJezeDE54R26DW3svwM47JenTj1pytV8H8h2uVDVfs7eU7lhVL5l-K7B-sXAe4jszQ2FJSll18mo924rM32GlLPR-~ua743IQ0nsVEYZMZjXly32zDIJHkVP8hjsix75O~Ej2FkR5yU4qX51Pakd4NUg69Z~BXQ_&filename=vkaraoke-2.53.exe

http://dw3.uptodown.com/dwn/ztug4_TW-b88n6EgWC-WJtQ6Xp8mt1SaRhxetvNCOZJaGtp4K_mTLs8FqpSrFZe8AMT-rQnjEqaeJhXD1TR2dnUuOgalhzI5WTg5pqN3IMmYvct2_i13qNkcV3GNfhMP/QrzvPY7sPnerqiUC1wBPS-GPBb_qskBSl_wxh4yDQ60ldsTXsimf7UiNTnJbCHaptcjdkmdV5YKDp66BrY2NJ_0rYGHHGvJ6flrRLh26tGb2fjTAzP40T9Okg17y-mUV/.../vanbasco-2.53.exe

http://dw.uptodown.com/dwn/Kwz2rvXoTDZ3gET1ifuJCj2ZroJD7-WHzbaJF9lFHw3pStJybUDTtTFCsYj-zVwCNtsrYOQrLM609bkr3oOyANdQVl6YrovmhG11IhVmroNTpYiLtDXxNneTywUQwlJT/ffDtXayJjXz8f-4UCv4CMS7IUDT3Sx0NnSkmJQW8-Pjo2Pste2UQAhOYUpMmvJOTsLG3hj_rUPnBPuNov1mQN5R0M-CTknlJ0kck2yahfs7rvmkqFxzh9MrZCyqwddrw/_-Ok6NNI3h0sR1nQXXNDbH-UKrpRQFfUrAkR3OGV366HU2q08jCxDr4mNjpGH_kw7g-Y2dWtcUEH38i6vZWpSkX7yz4TF7gsymg6rm7888VXsqvF2quG3bq2h4qpMyIS/.../

http://www.ranchsendgift.com/9yvcrMrOoQHRZMnaDqJCSYwxbNdvv1ALIXVrsdamvu2_5g0ZoJMS7gcoXv7xypLzpBP35QEFb 6RvmzasO6yjUtmX9aU4fLYEuJ6wUs7Dva9jZQ87caLrB88EBWGMeqBp6vt8upYNs5NHK0hPaCMHgvdMP5taXtY0E70sdLYVgAdz1qU4fNOkEze3psdPL6Ss3mA44znIwzRVULjbzmUBc0JDBnYEQ==-GywAAERveH6c92jXiqIEJnLA3lYqd3tjGwfyxsSfQwU22yfy9xMGLRqf

http://www.towerbitscenter.com/duipYtBLPFdLVjuZYPXE1mcMjxebY8tUorn8QdQtEnSsGCEwd42T93YGVbsQCh4GtUPsfa4nT3K_1EiiL5tGgdRtbvmVMPF3rkS0QvvSoWdkCxcR4HQwBdJSGfzbOucXzmVxeTTLpKqJ2xksAvwyNTDFZ 2ceDZeidGBGvb5jBTNH1BwgKzqs4fwQh m06Qc1fIfyCkWh3Xpx2wxXcoG5DU427lfSJApd8ECN3FrwoFAjnIPxlGpPMg7Bc4pWG0DISaVi6dQZP8PNSrH kh74hcygnbsYshpp3V9u1szJrWqdPIluPDpSQCWGAfXc_3RLH3sOYtakC9rc0OhYdOIAsw1B6_HfUgRMvcfh0c3fAfYY nmrGJr101eA0RDpYJd4oHzCVa8G_v8oH kLEwW_VP3VK5ZEqu2dtlEjtqBooo_ofCuFDMRCVwkyJEKCVgBEOWiwyzPT_CodY0m6AQ18ftZlwhsnnE7OOM_e2Npt4qcaQpe0o PjX9 THhmQI9njAqVxQqXgJQfQh4gOEXvTM73ONhQCKhCkvCW CZWuP_ITgbOiSNgWSEITsPva3ZEbsAwVmpb-GywAAERveH6c92jXiqIEJnLA3lYqd3tjGwfyxsSfQwU22yfy9xMGLRqf-e

http://dw.uptodown.com/dl/1429276524/.../vanbasco-2.53.exe

https://dw.uptodown.com/dwn/2TsNio_6bIxWkeZ_iVqG1zS5SFpLQ9NDf99iFeWWcGuvbK9RaIZzsmU1-bjVymualVTx5bkgrsOLM9bImTvuIG2UqTs4y_6yAuq8zqcUS87m-QM2sSE0pqhdUVT4iI4y/ouNF3g9CiqNhAe8JeqOnHwI9nFQdlnVWORcXOtgMs8Bi6R_z8r618flveWXPilE8fg20bcB06dfq9-5lM5pYNSqDCp0faTMUDkG1PM67O7g4MIILT58m5VqHZZVnWsD-/mO_jm8gIZkVLM6jE-WJY624EG4NiienfqGSb499BeJhoWf44g7RZ1VGPVBkQZdbyAjr5VVktAjiouGo13dIH9a9gZqfblEMzq1pqJRwC7dYLPkaJ3s6fuyoY21tuhL7X/.../

http://dw.uptodown.com/dwn/19JDUFJ_LaYzlKfXbuYmlTX0fPlM6wne_vJLfKdNubeTfyw57xNN98S2iLYMepFETfTDf_EKg7TQABw9tC4-uKOn1suFj5uf4RT0DZ-oRjoLvNsmepdQFeUmfIcMNOzp/1NvmJGvXw2yqooi3zf0bR594QnK-U-d4p2wbYDCPrTpFAvsuHmQUAwOp7rcIPRgqpjYCvtUxTh3Zk3-T7q38hikB_JjjRK3Bdh1d6uiSc6OBvXsdII73C6ms6IVHcKV_/.../

http://gsf-cf.softonic.com/4ca/ae2/.../file?SD_used=0&channel=WEB&fdh=no&id_file=14316&instance=softonic_it&type=PROGRAM&Expires=1426569601&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=BSqiRL22OIqIGV9tZVP6xwG6IDNYe5cW1JbWMpsy7nixyi5C~JHPVt5d5XSyT8lurh~ZLfudRlKbIcXBiIETSpMcLyOJhqgVYw~JCrZ1gZb~RX0UxR15iwTTQ8bJ9hLcyI1wC8YcCXk1Vb1JtqYGCGZDgbRGg8~Kvl~SHT-jdOQ_&filename=vkaraoke-2.53.exe

Latest 30 of 172 download URLs

Remove vkaraoke.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.