metin2mod_pl_15022016.exe

The application metin2mod_pl_15022016.exe has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the Self-extracting archive installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from am4-r1f6-stor07.uploaded.net and multiple other hosts.
MD5:
8bf35fa019e0a4d687522a5dfa9d7b3a

SHA-1:
1c027f2b1c6d1547cff1160d9ee7b416c09a7855

SHA-256:
b146a3266c036b84ead6a07c9b4e38de7276df251cd9fa9608d4475b3ef49609

Scanner detections:
6 / 68

Status:
Potentially unwanted

Analysis date:
6/1/2024 10:16:18 AM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
Skodna.Gamehack.Ryx!c
2.1.4+

AVG
Skodna.GameHack
2017.0.2827

ESET NOD32
Win32/GameHack.UU potentially unsafe (variant)
10.13058

K7 AntiVirus
Unwanted-Program
13.213.18805

McAfee
Artemis!8BF35FA019E0
5600.6483

Qihoo 360 Security
HEUR/QVM41.1.Malware.Gen
1.0.0.1120

File size:
11.1 MB (11,683,247 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Self-extracting archive

Common path:
C:\users\{user}\downloads\metin2mod_pl_15022016.exe

File PE Metadata
Compilation timestamp:
12/2/2014 11:07:30 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
196608:5dG+Mu02aN/wRz/eueMFkMdzatmDj8564SAK92psRMClXTP6+h7GN+ftea9:DGu6Ny2uLli64SAcMCtC+hiN+ga9

Entry address:
0x1D5DB

Entry point:
E8, 85, 63, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 82, FC, FF, FF, C7, 06, 20, B2, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 20, B2, 42, 00, E9, 37, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 20, B2, 42, 00, E8, 24, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 4E, CA, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Code size:
161.5 KB (165,376 bytes)

The file metin2mod_pl_15022016.exe has been seen being distributed by the following 50 URLs.

http://am4-r1f6-stor07.uploaded.net/.../673451c7-8d39-47b7-b7aa-a0a66e1bdcc5

http://am4-r1f6-stor07.uploaded.net/.../1e84e567-fe4e-4ec0-95d7-bdf5fe85f91c

http://am4-r1f6-stor07.uploaded.net/.../cc4724b3-472e-4fac-a937-c9773a45d5c6

http://am4-r1f6-stor07.uploaded.net/.../b4430f24-861d-4512-9502-23e54cb2cdf8

http://am4-r1f6-stor07.uploaded.net/.../a1aced97-7265-415c-82b8-0638037f495e

http://am4-r1f6-stor07.uploaded.net/.../c5f7a81f-3b06-41ee-afa0-aea4c4ba45a5

Latest 30 of 61 download URLs

Remove metin2mod_pl_15022016.exe - Powered by Reason Core Security