home

l2phoenix.ru.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from downloader.disk.yandex.ua.
MD5:
120c8e5b9a9f2b11bd129f32f0a979f4

SHA-1:
9c4d01be6b30677abb11cca385fb5c5f70bf7cc1

SHA-256:
fd4b339c85ef4e045a33945a623afca6a275d3fab5f72ab922d3fb91ab0dbc19

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/16/2024 6:00:17 PM UTC  (today)

File size:
1.7 MB (1,821,184 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\l2phoenix.ru.exe

File PE Metadata
Compilation timestamp:
9/20/2010 4:18:12 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:zkUQIF2AaHTVbh5ISCIuTPCuV8FAu9Z/o/ip:zkUj8o/y

Entry address:
0xCDD08

Entry point:
55, 8B, EC, 83, C4, F0, 53, 56, 57, B8, 4C, BE, 4C, 00, E8, 65, 95, F3, FF, 33, C0, 55, 68, EA, DD, 4C, 00, 64, FF, 30, 64, 89, 20, 33, C0, 55, 68, BB, DD, 4C, 00, 64, FF, 30, 64, 89, 20, A1, 70, 50, 4D, 00, 8B, 00, E8, E1, A6, F9, FF, A1, 70, 50, 4D, 00, 8B, 00, BA, 04, DE, 4C, 00, E8, 88, A1, F9, FF, A1, 70, 50, 4D, 00, 8B, 00, BA, 04, DE, 4C, 00, E8, C7, B2, F9, FF, E8, 66, B2, FA, FF, 84, C0, 75, 43, E8, FD, AF, FA, FF, 83, 78, 08, 00, 74, 14, E8, F2, AF, FA, FF, 8B, 50, 08, A1, 70, 50, 4D, 00, 8B, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
817 KB (836,608 bytes)

The file l2phoenix.ru.exe has been seen being distributed by the following URL.

https://downloader.disk.yandex.ua/disk/41dd32e6cadf181cf6a8db178e45f25051235ea37f4961badb05efed3bc04233/579a95f3/t9Us9j4ELXD2qvh47057X4_dyZqr0zFc69n7GU1EdfXUjQib2TCJlOwmxXiPQHn3uxqdtTIoS-rY4S5gHaoj8w==?uid=0&filename=L2Phoenix.ru.exe&disposition=attachment&hash=Agq6mboH276Gj072ewzt577j0SodDOUCSJmcgpd/.../x-msdownload&fsize=1821184&hid=c196142ea66e9d4dc3e2d8178c210f1b&media_type=executable&tknv=v2

Scan l2phoenix.ru.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.