home

2107012_stp.exe

Willing Webcam

Oleg Detistov

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
Willing Software   (signed by Oleg Detistov)

Product:
Willing Webcam

Description:
Webcam tool

Version:
5.5.3

MD5:
af9cabb2c09d4ef1d3a935547546553d

SHA-1:
6be2d39819fae12411b81cd710ccba1754e0bc0f

SHA-256:
4ffc260af065ddef27c58656c8eb4489d9426b6dee545bdb29e7da7432c40fd3

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/28/2024 7:01:01 AM UTC  (today)

File size:
5.8 MB (6,055,696 bytes)

Product version:
5.5.3

Copyright:
Copyright © 2003-2013 Willing Software. All Rights Reserved.

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\2107012_stp.exe

Digital Signature
Signed by:
Oleg Detistov

Authority:
The USERTRUST Network

Valid from:
2/7/2011 1:00:00 AM

Valid to:
2/7/2014 12:59:59 AM

Subject:
CN=Oleg Detistov, O=Oleg Detistov, STREET=Bulvar 30-letia Pobedy 29-101, L=Volgograd, S=Volgograd, PostalCode=400117, C=RU

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
4DD09688C51BFFD89EA85DD27C95C2E5

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:CfY9h/yjW3CfCmqqPXANzeymm+Dx+fnriT1rg/Cp4B8C0oohP6emNgY7s8k/:Bq3fCAyyxArK1sCuSfPtmSj/

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file 2107012_stp.exe has been seen being distributed by the following 12 URLs.

http://dw.uptodown.com/dwn/XJdfIrI1IPcPLIzzWrkyoG4j7qirTFwPQPhzpKVtWE_67_0iF3K0kBgETTksR1N43LoKMcnMDDhuA6RC9q0UmDeoeA2wXWp7PtjDB2ZkmgVFZdqSe-V7OVd102uVJVB9/MqPMhoeYF3Lnt5hlbgvuWtf3vnDs0c6oxoX6qv31Fq_gHW4Rg_90eyHdepdNczmlau8BQJOrJ0Pxn0WFaMtMtP3RhuFTfEQVMVjKqxdV0gP35NfKAdoYKNh7oTxi5LyJ/oD_2WbTKFOFZnGblx7t3XPLz2PeRvUqJk5C9TqyKSMvEEjNdLdozuMsarFiHXlezUQvlXUEN0R5eJxX7njXZYaSZOrwPLFa1RstETU_09xT58ilqAn85noLDqDoU9xrJ/.../

https://dw.uptodown.com/dwn/xPjekY11eKOUU1GqVNOuy3l9yDcrhX51AJVhJz40fFTgrfRgwJtd0WUYp1BG3ZbXcpFJKMZEnGpkuMPdeBaTfxe-p7LerZyW98VrsBfQ3EgZ0_9ZDns6y98byBLRB-P8/39LocS-R9n9VR0AZGjAn5BmEUje2lJ6IIDBXw-AiQLdvM93sBUXM-5IM6TA3aYhdpR_WxIJB2cg7nsM94qq7695ON25vt-hBmHOhQhXPZboiu1AONBEceCGad2NTy2ui/_7eDMJlO4ME5KqRLr1GwBLn_Km086zfIhdrtBWXhz7WJ707bjMOXSZTRFL6b7CqkOBrff-PgcQ-ejO2cAsyJEbqd4QGXr_QbA0tIbwvRYUUioyxufmTz9QQAMhde--ct/.../

http://dw.uptodown.com/dwn/FBjOac0-RlOiZqZL021m6pbgUC6Z_qoEhZk3YEHFyzhl9SfbhkKroMnFKL7rA5aGPcsyKXXa7iz99FOz4fYN6zj2ot_tHiaFeeF4qI_kpZe2AfZTvuNhYkHlma-rY74V/GHp-7759JHdV5NuPOKSCw8xq7i_rKtxTEZHWQlaESAkcyAuFNMJlLo9-nKvQvxH7SCf4DZM2LLFxvVbQuY0-4WML3pQzZsEcdhw311SmORQXm4d3T4wa0JhQ5rCCMLEW/eua8j-r6hjRSYpXLbhhj4HtXTul-pN6_ALlXcLW8JiPwEhUhuF-vyXfUW3e_eRAaB2OVNYFI5hlinP0GZ9sBipKm2DzreBNsSjm8fXccNnW88X4u-EeaC_RO00asA2ta/.../

http://dw.uptodown.com/dwn/-7mPs6d9hDJZoYyeZ5DifleGNFuJBYta2p-x5ytPIWmlyc9uDD6ngwKmUJgheybSZQY3MAMlLQwak8mArVJSwDO-qtlYeYPu89IvglXG9N8xFvsfIar0TSKYEBZa7d90/Z4rgByJ36qF6ZWqP63NM54Mf2BWYI3gbHS04U2h8WVbgmS3G3yYpHsgckpjHggWkDcFV6WCkGZrb26DDsD1U8tWxHG5bJNfpmRN03lf965k4FHXTU64oaGem3IHbloRo/OjlgcOzim9NfZ7jXZ1dO55IL0GS0MIt73V4i1iqCJzLY7Xexd-wcTvX95kDeUG4Pr7rJFNY7fQ7TLmzESuNxWngSqjB-8PA5NX_aKKzvB-OlVNXYKBG3sRaK6CCZAe92/.../

http://dw.uptodown.com/dl/1440897514/.../willing-webcam-5-53-es-en-win.exe

https://dw.uptodown.com/dwn/htgxUPNQ85vyKGomXLZmTGWyMiTIwLZvLlG9HvSn58ggef8RMdv8SP9ubSuW7AbVcqmA7D7sxpa_YQ4JU8AWGC6LHIsbXstIWXqI8QcpFYEYyOOMDb-HPsrBiOnNIj8l/1g2MMzTI-lStzzvJy7nPEPjdz62jnpZGEtPVmz5LV2d8VZUshbNQfs4evLZSEFTfcmkaerToEy-33PeVSmmDuE03VbY7Zj7rEFG96UPk-OftbVVWSUkQj4SFcNNCg8au/.../

http://dw.uptodown.com/dwn/yMMNjzHuuhxN1i-wVbYI0iG1aTxXAJwlFLlPcvlxlMvMvx_sr00qPKaKNbzm-d0RWzdsvmNKxUITTgXVG4khRrhPklG-MEp2Ey8LQaqohYkq6S3dc0uR5ymbNhDqu-CF/B9ZHyB1QjOMg0Ml4vs21iE2lJYmX77xXSAs9Kaccu-QCBQdKKUEpn-ouQ37urjTbgLX-ZSvJvPRxmqAa4DU1e6lq_dMs00JyR3KP0GodNBEmvR8Z_oX5mBCztK000kRj/.../

https://dw.uptodown.com/dwn/AUCMoFw4WdiSLgsGGiZP9r63q-tXyADpES6ExtxeQ_x8hVTxosZGeRP9GJ919IiF4HGOYqhrpFRiQADtdklHfFTJ7dlda24TcUXJ2xe3JhzezMta14mDUKysnZrLNZyD/Xuf5PPZdsFIpw-61if6bMc32QzxXNcqlnKuQ-DB9079neXlMsE3y-SZcIGPTFYyhc4YIyf3_SDeMcBuiTAS9SxHP23cWdnuWooMWplJ4ETYio2jrNylX4JnFEiprbOSo/.../

http://dw5.uptodown.com/dwn/vXcM7F-VgmNAhFlsmVufXSGoKZmJvGE6fjhIQj-2k9bfv78KvlAGCByYFBFC3AqnRNm49UbdfFh4MLcvmF7BExMYqmh_gSIMGLPnuU8x4P9JqNQLd2UKF0uAQ9Gz0Sm1/SbsQI37pc1mtCDbZH_xa-lNQUb_Ss0Pi8ODauIkNsU2DUMpzInAQrKE2pkwH0Hd0BQFXR-yJCMScvryiZ29l5ImQKUvLgJbTZxMvK0YtdZ-TuPdSyrPm_DjA3rk-wlRc/.../willing-webcam-5-53-es-en-win.exe

http://dw.uptodown.com/dwn/ipc1M8G6GbPQW0EEjUUla5fnGUa_dVUwVV5qj2r_itSI3SXc_emT--8QoOKwCfSrWEWK2qcLl20P4kkiUyRn9FM2oQZAZSABq3YC21Z7Mr1vLmmwr3-AG4HP7VW3l73n/T8jpQODhjEDbA8jelB3RimHbl0fTwCBi5xLsjIefq2EjWq5dP-iUdIdZp25gE_VvnzyveKf6yrbgUIBQIB5oqzzJ1MSwM7YDxFf9L9oFhZtoXv5Gj70KDHV1uRIlz3JK/.../

http://dw.uptodown.com/dwn/qZuzWAHHWvNrytAH3aGIfVQglAh7x6PQTzp4-3UUM5JHlHvErd46kG0zFT6AgE5M-W2rs_RyP4ZSwv5sX-WZ98HeazTJ4DYjbDhn5VZNVaLPfQA5WPDNM9mKtXfCSoCK/F4akSDZwY3x2ddTxL0AESA1xhbU7dT_LUwA0tEpjWNfbSCuiT1njOl9gR77B9zylIvNyg3XjyMT2AbniYtONeWu3S7L3RnQ2jlJfjeFqc3A8J0Qyicz6Dpvm8qR7jfsE/.../

http://www.willingsoftware.com/.../willingwebcam552.exe

Scan 2107012_stp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.