home

windows__aef56f7d-fffe-4fc8-92f0-94ad9bef1f17__.exe

AT&T

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from pattsmpii.att.motive.com and multiple other hosts.
Publisher:
AT&T  (signed and verified)

MD5:
db3272184fd09e073bf315632cda86cf

SHA-1:
26e747bf34fdf2ac1ac5cbe1e7095168cb934817

SHA-256:
5ead3040fbb2c29e4aa8bc44edfd457495e8829ddd237077d05826c7e3cb470e

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 4:47:23 AM UTC  (today)

File size:
93 KB (95,232 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\windows__aef56f7d-fffe-4fc8-92f0-94ad9bef1f17__.exe

Digital Signature
Signed by:
AT&T

Authority:
VeriSign, Inc.

Valid from:
10/10/2011 5:00:00 PM

Valid to:
10/10/2014 4:59:59 PM

Subject:
CN=AT&T, OU=AT&T Mass Market Care Application, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=AT&T, L=Austin, S=Texas, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450BA65F1A924BBA80F3ADFB4024A31A

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:hpgpHzb9dZVX9fHMvG0D3XJIGOMbdpSOEoJEdGUZWBfndo6tf2FcrspFIe:bgXdZt9P6D3XJ62dAOEo4/ZWBfi6tOCQ

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.0202

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file windows__aef56f7d-fffe-4fc8-92f0-94ad9bef1f17__.exe has been seen being distributed by the following 19 URLs.

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__f3db57c8-a964-4edb-89cb-3913c29a9f2b__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__cc338c79-cdd5-4782-bef5-8337d03d5f89__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__32e9141d-fe97-4a63-84e8-d057c827be81__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__f0e2ccd1-aeac-49cb-a0da-5fdc73837c08__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__7d36facd-e1d5-42ff-9dee-bde7581bc9ef__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__eff5c319-9198-4d5a-8e69-d676e7939496__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__b47438cb-b6f1-4c83-a660-42aeb601d2ed__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__2fc5c329-81c0-466a-ba73-aa06c9480b78__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__86bfa0af-4d14-4562-9871-bf6bf1e92b6b__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__3bd4c853-1d69-4238-882d-bcbb1d5eb29d__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__61db2bcb-bf3e-4735-87b3-8d08238fd9ae__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__4c745ac2-af65-4bb4-9ed4-bc1d4ddc6ee9__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__67d01f41-b89b-447e-9bb4-9fde4e4d20cc__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__d13945de-3145-4c2e-8a50-db1eaebc9d50__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__dc6c4562-b1eb-421a-a786-add96c1cc5c5__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__0f3b35b2-5aff-49d9-bd27-3b38ea2b3f6f__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__14dea2c9-200d-43c2-8b40-4d7492ba82f2__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__7158a0fe-22b7-4579-b806-3f6dc1d2455f__.exe

https://pattsmpii.att.motive.com/homeview/activation/client/.../windows__344b8107-6bba-44d2-b0ae-3a756e6ace57__.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.