home

windows__8a59f69a-4f99-40fe-b598-1d855d8bb38c__.exe

AT&T

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from pattsmpii.att.motive.com and multiple other hosts.
Publisher:
AT&T  (signed and verified)

MD5:
361df5214709b32b10253c5dd18e89d7

SHA-1:
f164ae35cbd2f0e6caed44f7168a9f2f6a6ede44

SHA-256:
bf95bc5b6fb49089a4ac084d4df9c3cb46c05ee7e78b62b6b909c78654f8bca4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 2:04:01 PM UTC  (today)

File size:
92.9 KB (95,176 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\windows__8a59f69a-4f99-40fe-b598-1d855d8bb38c__.exe

Digital Signature
Signed by:
AT&T

Authority:
VeriSign, Inc.

Valid from:
10/10/2011 7:00:00 PM

Valid to:
10/10/2014 6:59:59 PM

Subject:
CN=AT&T, OU=AT&T Mass Market Care Application, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=AT&T, L=Austin, S=Texas, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450BA65F1A924BBA80F3ADFB4024A31A

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:rpgpHzb9dZVX9fHMvG0D3XJIGOMbdpSOEoJEdGUZWBfndotuf2FcrspFIY:VgXdZt9P6D3XJ62dAOEo4/ZWBfi0OCrG

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.0182

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file windows__8a59f69a-4f99-40fe-b598-1d855d8bb38c__.exe has been seen being distributed by the following 29 URLs.

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__0a52598d-9bf7-4b92-8580-a0f24b11e0a2__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__d0c9adce-8533-4ad3-acca-f40ac7d048c7__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__540baa8b-e650-441d-bdbe-71947ce58ef5__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__fa2f6f1c-2309-4df7-872e-68a77e8cdb29__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__c4e5afa2-6a9e-471f-8641-0d71f0799e07__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__b3d63949-c88b-4efc-9fed-5a4792d0feb6__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__a99dc94a-b1f7-4cb9-bc32-1f5d607d2ac1__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__5edfe093-c5a6-47c8-8fba-df48cad9e59c__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__06b8ecf1-f3c1-4233-86a0-fc9e54f36e04__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__abb71a7f-3837-42a3-8bb7-1e66e3e9111c__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__4b648553-67e2-4491-bc3d-b2839726bd1c__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__61b516d8-d553-4907-955d-4c2426d45188__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__2ddd7fad-1232-435e-bade-84130554dc53__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__48f49e8c-e004-415c-ad31-cefe979f5531__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__f30ca887-9ccb-4168-bba7-db11d93dd734__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__77c8897e-648e-42fa-9c6e-e5724fcc92b0__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__fcb1c190-830c-4743-92dc-29399cc89576__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__1688f8b3-bdaf-4234-9506-55036b3410ed__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__f66f3a07-2e60-4db6-b9a1-5753307a6c4b__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__1e3213e2-1b22-4c9d-8ac8-95fd31403b72__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__07d03d24-2573-4ad6-9bf3-28bea661f664__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__18e74c0d-4df6-4954-9aa1-300746720a19__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__b5d389a3-d2c0-4760-bd17-5b560e2c7324__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__c1c87f8e-77e8-4fb0-825f-99b5db76c3f0__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__64624880-7420-46f4-a128-8c8efec83edc__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__97954e26-1e7c-444c-bf58-a15da156fe4c__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__aca3ad31-fa62-48ca-bedc-1a3df2afe8d5__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__e7f050b9-f580-489b-ae7d-10c1f5831389__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__8a59f69a-4f99-40fe-b598-1d855d8bb38c__.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.