home

wud240b1299setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
MD5:
914cd0469ed4fb5c67e68612b9a432ff

SHA-1:
5ae77d57b1b4da52ee5b79353227c0a3782168a1

SHA-256:
e1cb4f4c418fb605d2258e6dfdf302649c5ff3104aae131f096ce71f3d44bc01

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 11:07:43 PM UTC  (a few moments ago)

File size:
278.1 KB (284,816 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

File PE Metadata
Compilation timestamp:
11/21/2008 4:28:16 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:KNyah0mJAbi2kD7rfEn7q82PXb8FgtoSy6M4vn1ZDd0ytYJIqQPExd8Kfpo56t9Y:KwrOEn7qrvfXytQDd0mivmiaKfq56m9

Entry address:
0x3225

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 28, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 3B, 2B, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 50, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B0, 91, 40, 00, 68, A0, 36, 42, 00, E8, F2, 27, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, E0, 27, 00, 00...
 
[+]

Entropy:
7.9116

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file wud240b1299setup.exe has been seen being distributed by the following 7 URLs.

https://dw.uptodown.com/dwn/Md4Aigk9It3FWI-xWLEGWsJo7OluNP5DgmBUzQKbFrxsLctHKq5xzEHbM8pMOS74i1epM7iwDS-m1v2BoOTCFyrkD-S3WvtmL02k76Gl4D7ldjq5ePOyH84Bf4ERzRCS/M4uBi9T79OlIE7rHrWrucCp9CIs7di3DbHyaVJ8w53f5G9LwITDdaGlkxp9m5Xd8F7LzakCSLAA_NGd4FJX_PXMoAlSJlV_T7Z_7xOe-qBzx9IzU_aYMEG252CO03A_L/inJWkDQFfOg3gu5WrBWsvMT3OPqiSxfubZmKTLO5h_tw3_6w-4W45oKmhNHSHAj03Y0GoGpAF0iku_T_qSxmVo6ReXfRHIdOfeFklpfB9po3Nbzf44TpP2jsYeVLKgca/.../

https://dw.uptodown.com/dwn/ZbGugHRHeZqvPdDvaPGhA-rSii2v85r3FAP0V2FxkOZ6CN9jFZgX16PaVNZxTBZIm8lAUAks_Iuem7gos592A6xK0bIRS8YKEza8l3EA5hbUBPlfWKmXkblYu38qZBeA/OE42n3ByqL97vm32eafimyTlCo49JDdBrPP5CSJ5thYNrq-VQmaEf25gO-U8c5xSg21E95A0z9Msut13TJ9kYAd5nsC-nuiF07q-2rvilVuB1rV3lWzPLrnHr4h-uTfE/E2qsSTnv3yH2qAIZMvFYsb05dFWg6PSA8fvD4YwM5yKYNAzXBftuHGhDqYPOmEGpsthpSfvCpMh2LuAYY6KuuWQU49c5kEQgPIl3bIwouyYRL6KEOlb1LCVel27nIovk/.../

https://dw.uptodown.com/dwn/sL9OqmMRlE3JfHkN_d-E1aT-LPU8SaJPr0W_m31SxpHGnHhUPTqHdQ2JbOSrYNUxFUlS2UNd_jNs9ESdFea0Ms2fyjcCWQ_n2a9MXGucr1SSRXYig58gKggpePuYr_7Z/PExqxZqMBw7jzJCTO1afS6-s_MFgGEu4bVUlwhZrvrAPGQ0dXx8HlD7oUOxZGUH5xhvspzodYEQ0VdiLSRx3Dv4uTX3ZdWUvoI_fvh3FU-4Uu81GDeqw__MrdKtcBNoQ/E_mt1JOPGSrO0Xk52P8tRZjN8NAhuoH5OIx5HFZHoDUbEvMcjHD6tpwd-W3i5qKtg2t4UWruNZm4-a7KIIWH1qJIszTLWQa4blfGjOrKRPt_spTPoXFAYtzJZeLrp2k0/.../

https://dw.uptodown.com/dwn/mBcgF0lqXjU7f-l9Ho0xCD45wDOBBPzShkV2ZvoF79XUm5TsLmTEUSersBT16ZWkUuFF2PgS3EtLqwJ660_tQAtGXfZ48mWV3UcW1D25NApGu0JUyh_wUGLB0BGQWWGg/-scuSke5Dm4gmPtW6X6jv19lZUkNNyNggue-m986tm81A_GUZ-5fHGbIgh0R3XLxYM5n27HUjPeAfn6eP94h7DgiB4pcrUFFpFAGP_GI-i7Lyx-jFC5BOw6nRTU61suX/RJftcwbLg0VyLpoYAOYGVvIWx_AW57fMts2b7SZYXGyTUkR_kAGPU9z8PGlJmPaRnuIFdzNXMhukke_0d1DxA57H1XC-nX2jvGrr8NO-W99gcfXF1OK3ioCNW3Ac_byb/.../

http://dw.uptodown.com/dwn/SekKLrfXtiL2hKLHN9bslt4B_cqflvasWWXuF5i2vjq0C8e2VMZ-tSb9GGNf7IrVRIDQi1SrQU6fcyOmO2v98jQYBRy7_A_nywYIkt5mCM0xADZZlhNvVQNk6FG-XGXk/C6umU98Y1gIrnCQmTtXs0GG6TYEs-DqqQK7tKtnlc6JEFEpKG-GExNaL4X2dHMsoEkbOrcNI1HBEfzxhEtXm1c_L2TfbyDgX6QvklBz_7a8zVvf1qkAXiN-z6-uX7ChC/rM5yYtczIGtC_8SHB065ej-zxlorkRvmAy7xxidiomxJWtMF4W1o39rOfYUllJRgMy06kuzuCngzisiN8uWW8Mk_nT0RjHHJtmzZ9i6_jxYdbVQB6b9OgozGv_zJEtdn/.../

http://dw.uptodown.com/dwn/-ZMo0ESmvVpHQ8rLwJtQBCEYBlXlne2055NipyAyhi201oZq4CRC4HetA4gU5Gg5iwq88ubUSg1Hwdo80StdvF93qHwqnNiGjQt3U9hftdk76htaVwxvmSBjktI5lCtK/SPStZqWOx8UoidzH18OqRtBmIK2gXnc0niwtkJH5bXz32Hf8cl4FWCpfjZcQPa0R3mQtFME-FQmZTYikNepVc04dVgaceN76eFkWfqlA4bQhXEcsYxBAjUi8hnZEfaNK/XO2Anx1DNzidA1_OTo5_zRcr9qVP7EPTS66GIuEO75J8F57oRrnmU__iVtERwETUCzEW_jgg4fKLxin-eX3wr_GxdYUTE94FDWkDOLWXihFn9uiEYr3nst-JSfmruUaD/.../

http://www.windowsupdatesdownloader.com/Download.ashx?type=prog&id=3

Scan wud240b1299setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.