home

226535-671351-painttool-sai.exe

The executable 226535-671351-painttool-sai.exe has been detected as malware by 2 anti-virus scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from w6.getpedia.net and multiple other hosts.
MD5:
1133542ccb7526cf0134e0986e62bb96

SHA-1:
fb1876e370d431f21df06428ca6ccf35de727000

SHA-256:
72d604cae6e3a9b29862772c03bd237db190dc9a7fc42f6447a0291283fc3f90

Scanner detections:
2 / 68

Status:
Malware

Analysis date:
11/15/2024 10:33:01 AM UTC  (today)

Scan engine
Detection
Engine version

Microsoft Security Essentials
Trojan:Win32/Vigorf.A
1.237.1006.0

Reason Heuristics
(M)
16.6.6.1

File size:
2.2 MB (2,339,714 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\226535-671351-painttool-sai.exe

File PE Metadata
Compilation timestamp:
9/13/2008 6:30:44 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:NjrTlTjM1rQG652Y3wqjvOS4SDewjBZQSbHH3naSbHH3BTCCNcp/fzhEVJ:NjrTS10r3xz74SDxB+q3aq3OXz2VJ

Entry address:
0x4486

Entry point:
55, 8B, EC, 6A, FF, 68, 40, 72, 40, 00, 68, 06, 46, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, B8, 70, 40, 00, 59, 83, 0D, 68, BA, 40, 00, FF, 83, 0D, 6C, BA, 40, 00, FF, FF, 15, AC, 70, 40, 00, 8B, 0D, 44, B6, 40, 00, 89, 08, FF, 15, A8, 70, 40, 00, 8B, 0D, 40, B6, 40, 00, 89, 08, A1, 88, 70, 40, 00, 8B, 00, A3, 70, BA, 40, 00, E8, 10, 01, 00, 00, 39, 1D, F0, B3, 40, 00, 75, 0C, 68, 02, 46, 40, 00, FF, 15, 8C, 70...
 
[+]

Entropy:
7.9887  (probably packed)

Code size:
24 KB (24,576 bytes)

The file 226535-671351-painttool-sai.exe has been seen being distributed by the following 50 URLs.

http://w6.getpedia.net/Data/Soft/Free/.../sai-1.1.0-ful-en.exe

&onid=2191&oid=3001-2191_4-75724135&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=design/illustration&topicbrcrm=&pid=12582697&mfgid=10227369&merid=10227369&ctype=dm&cval=NONE&devicetype=<!--esidesktop&pguid=6fdffa0bf0282017354ce6f0&viewguid=hqo@HuuHPaLAZH37SGTbYnpbnM@8N8bT3tg6&destUrl=http://files.downloadnow.com/s/software/12/58/26/.../sai-1.1.0-ful-en.exe

&onid=2191&oid=3001-2191_4-75724135&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=design/illustration&topicbrcrm=&pid=12582697&mfgid=10227369&merid=10227369&ctype=dm&cval=NONE&devicetype=<!--esidesktop&pguid=233284b26400da2c57be3013&viewguid=hpTEbFi31JzVRz1QYu8aVAs3Hz@hi7VJp81i&destUrl=http://files.downloadnow.com/s/software/12/58/26/.../sai-1.1.0-ful-en.exe

&onid=2191&oid=3001-2191_4-75724135&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=design/illustration&topicbrcrm=&pid=12582697&mfgid=10227369&merid=10227369&ctype=dm&cval=NONE&devicetype=desktop&pguid=de37da9736b6696f171606f5&viewguid=cxkLKfhfgszyziH1sJV2mev9do10WtlsnDQT&destUrl=http://files.downloadnow.com/s/software/12/58/26/.../sai-1.1.0-ful-en.exe

http://www.vaultflashapplication.com/4WZ0pCeMWGZXT5CAeIvW3NZ FwFSwStiknfr73xXt1pDVj28krlqA9xaTCUE6 dXxqLCMFdYw4JxPQqjdUzvq0V8h 5qOTgzvfJGrQUtVYEV_JPGFfKnGRgEh2Uc99nHc9y3Q6w1Rx37niKOudbQB_MAyXygb_ulIg0ep1XN8aM5elHv_7wIQnwlYD xl vTMpInoK5e-Ow==

http://s6015.chomikuj.pl/File.aspx?e=-HsSKkXCMKL5RqhDp5FNgUVXhSFfQgWN9XSnJgBVU-qaPVEsvHmGcpK0kyOt9_TniPoWQcad0k5jewfZTRKXXQLyty-7AIQYOmvmXUnSqUN0uQcfJyy8pVIuA7jO8if-8GaH6TJQnHjUxlILBrocY-1DMHeG_kzJpDcc9IEl9843FSZ6kVzJT0Ok4-Wjzey0&pv=2

&onid=2191&oid=3001-2191_4-75724135&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=design/illustration&topicbrcrm=&pid=12582697&mfgid=10227369&merid=10227369&ctype=dm&cval=NONE&devicetype=<!--esidesktop&pguid=e87f8b908cfc1a3fecfb8777&viewguid=hwjYIuEhXhPLIoULgvurWk8DKIOk3rFyZpZ@&destUrl=http://files.downloadnow.com/s/software/12/58/26/.../sai-1.1.0-ful-en.exe

&onid=2191&oid=3001-2191_4-75724135&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=design/illustration&topicbrcrm=&pid=12582697&mfgid=10227369&merid=10227369&ctype=dm&cval=NONE&devicetype=<!--esidesktop&pguid=34895dac14b919c3837e6f7e&viewguid=gzM49JXYif2o3OhwQV6UDCsOu8BIxy9nid7h&destUrl=http://files.downloadnow.com/s/software/12/58/26/.../sai-1.1.0-ful-en.exe

http://w2.getpedia.net/Data/Soft/Free/.../sai-1.1.0-ful-en.exe

http://w6.mien-phi.com/Data/Soft/Free/.../sai-1.1.0-ful-en.exe

http://download.informer.com/.../sai-1.1.0-ful-en.exe

http://w7.mien-phi.com/Data/Soft/Free/.../sai-1.1.0-ful-en.exe

http://w1.mien-phi.com/Data/Soft/Free/.../sai-1.1.0-ful-en.exe

http://www.ranchsignbundle.com/WVl6OTRQU1V5UW1JMFRucEVRMWcwUTFGcE9FeFpZek5vT0RCNUpUSkdiRUZ3ZEV0elZXTlBUV1JZVVdwamVrdElVWGhOSlRORUptTTlSa3RXZFZGa01uUkRZbXgxWVNVeVFtZFJjMVozVTJsTVIxUk1TVUZuV1U0bE1rWkVPWGR6Tm1GelRGQkdNVEZrUjFwUWNXOUtTRlZaWlZkcldFMXhiR3M1Wkc1WFlqVkdhRTUwY21Sb2RXZEZabTEwVlZaSmJVVjZaRlZRVkVkSk4xRlBNMHhQV201bVRIZHlhbTVCYmpjNFNXUnlWV0lsTWtaTk5TVXlSa2hZUVdoNVZsbEpiaVptWVd4c1ltRmphMTkxY213OWMyRm1aV1JzY3k1amIyMGxNa1kwTURRPQ==

http://s6015.chomikuj.pl/File.aspx?e=-HsSKkXCMKL5RqhDp5FNgUVXhSFfQgWN9XSnJgBVU-rD3R1hq_Mhgc2oMOCULtIgLfvW1PwTZVDHdU4lqkLYDbziI9X91QvLqfXAuiggywQsWMInw9xtiBg_06Phm598tUgNmLjvDpkZ-2NLrPlm-Q1KQ029bHoh4iiL0rIGl3566v3RpNXFWcMk6nwjmThy&pv=2

http://www.vaultsfarmhosting.com/c?x=YbQxfpIBImMzMSg1QahJCFLhqko/KVegBVQF3Q/QpwA=&e=0&c=OpNHKg Exr4z sbdW/bl4gJBQEb8zIaLGHvN9d7YPt6yQdcblXILo4WFOcn3vkuYD12LFQYZ 1ENV se6VPnTRu0Uqr/1ZuZR/ssjqrNzySBQgl/gUTQarrrlXPh5VIIFES2UvHuWE/AazBdvekKrg==&downloadAs=painttool-sai-1.1.0.exe&fallback_url=http://pf.benjaminstrahs.com/s/1468207006/es/.../2/226535-1797368-painttool-sai.exe

http://w2.mien-phi.com/Data/Soft/Free/.../sai-1.1.0-ful-en.exe

&onid=2191&oid=3001-2191_4-75724135&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=design/illustration&topicbrcrm=&pid=12582697&mfgid=10227369&merid=10227369&ctype=dm&cval=NONE&devicetype=desktop&pguid=2dd71022e2c1ddabdfe64865&viewguid=VgzCKrN8oxPuDowCXRLqhxRyoUlvs8IYfLMN&destUrl=http://software-files-a.cnet.com/s/software/12/58/26/.../sai-1.1.0-ful-en.exe

http://s6015.chomikuj.pl/File.aspx?e=-HsSKkXCMKL5RqhDp5FNgUVXhSFfQgWN9XSnJgBVU-rbjSznOFfEiz4aUCMle4p_Qeg6RJH9bASTZfUboujZWXcNfF1So9k9_1I-csygcLIFnfCet7joW2EqWQMoQzO01KxHZucDMuvhYx39K5peNXvRepob-9p_XS3LkVi14kj7vQFHqA-MJTE3iTnMWwJ_&pv=2

http://www.ranchsignbundle.com/c?x=Q3rJ5EiWO6iP3ETvEKpGvU2s7J8BcxHcSf3cb/.../404

http://www.ranchsignbundle.com/c?x=PfKk cmXyRW36Bw0n7HBCnHqOfN4yF1KHJWvSPdulVs=&c=Bw9081eyl/RPW0M8/v3qoPnYSBccP9Yvb0CXa2ta1qkXXB03RXnd71eGMaIvTFEjDa6 sXEG8WjT7cEX0Gnh4klIcNXRzjKxTWyKnOi5lody0/.../404

http://www.ranchsignbundle.com/c?x=8vCycHG33pUrD9gCiUOK852V17wTyE34cpVtkDwj66o=&c=izJG/ZhHFrAAijMG5OoKOjhf0gQgnmYIhTHe/nahSwV8nAWHylaK3rOvOTCtKUcbBUaXq1Mw1FVMMgTy4S3n3nk nWPSnm984e4FOVtAFWYlDCmBUcAPHBpG1tohOxT/CH 280FJpl pUsoBTALSD5/.../404

http://www.funbitsbundles.com/WVl6OTRQVkppYXpKeGRGbzNZVTRsTWtKTWFGcHpUSGgxU0RGa1JFb2xNa1l4ZVcxalVESXdSRUkzTUd3ek9UWkpWV3hWSlRORUptTTlkMEo2TlUxTVRFOU1lbXROT1hKdFZrcElhV05rU1VOVFJGUjNPR3hSWVRSUmFXVnBjVUZrY1VobFVWaGtXak0wVkhkVVNWTlNabFZ6YkROWVlTVXlSak5CUTFCelFVSnFObEZ1YldKVWVFcDVhbTlJUkdoSlMxUjZVMDlHVWxsamQyOUdWbUkwYzJ4R0pUSkdlV0owVm1aVVZ6Rk5SVVJCZVhkQlNHTTNSRlk0Y1hwc2FraHpjMDVVTXpCeE1EbEpiRFZ6YmxSaFRHVXlaeVV6UkNVelJDWmxQVEFtWkc5M2JteHZZV1JCY3oxd1lXbHVkSFJ2YjJ3dGMyRnBMVEV1TVM0d0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbkJtTG1KbGJtcGhiV2x1YzNSeVlXaHpMbU52YlNVeVJuTWxNa1l4TkRZME5UUTBPVFEzSlRKR1pXNGxNa1l5SlRKR01pVXlSakl5TmpVek5TMHhOemszTXpZNExYQmhhVzUwZEc5dmJDMXpZV2t1WlhobA==

http://s10207.chomikuj.pl/File.aspx?e=-HsSKkXCMKL5RqhDp5FNgUVXhSFfQgWN9XSnJgBVU-qwxOdhfTBPOVjLZnWhGNl2vKaDWRlzhk6aERz2WTferqXlGGDks_JC80sT6m0gqp_2hpwk3puKZR2o1CIIkB9dBJwfuUSYnUOAiLBLfPBZHxX6P0DLwb-iwxwXLw-NVztGit9KpOlL1AdBFfB0P_Lj&pv=2

http://s6015.chomikuj.pl/File.aspx?e=-HsSKkXCMKL5RqhDp5FNgZEhspN6c3Pr5_S7IVdQg6HOMHlvwsNA2ING9kFm7E1mFb5ms7x4nKn0ViJYovoeeEUSNcorsMMrGWzsnXufL4z8obIs0udfbWHpZlpfAgIW5nJ-rcHS8YHSC7u3yxeq2UKLpEDtp9YLpnEXcoIYinkg-5DdU_3jU5SQ5gAotEw2&pv=2

http://s10207.chomikuj.pl/File.aspx?e=-HsSKkXCMKL5RqhDp5FNgUVXhSFfQgWN9XSnJgBVU-r3Yulgatxp3Q9GQYoJ7q9jqPXKitFdeIZOIim4XcZi6TXb7vieqdrq60ttAa2Mj89VOvcxSaeKSYaQlTlYVheRtEjFadl-lTxoj3R48wP_u-KG_1ezGOcHGY3xDue6GVI93dKsBMTdHHxAya7UUlI9&pv=2

http://www.stockclearhead.com/c?x=JEwiIa66lo6wi87drVN99jbtCCSgY ZB/BTNt/35e74=&c=3HrFeXybR2KVpubnPdZ05UVrPV3Pmb7pnv3KHAEr66qxd6g0lNPgxKZX3zmQ62JW4DgROtRl8h EL757juZgk YWYlI/WxvXG 8EUIHtMGJJK4DqNM5Kw5gn59u2i9hJrp 1GVbUiH7qHbfYdzdwu4DywCZKRjD22yQ16qAdlMZWQIvavEZ2XhfzoUpIhLUT&e=0&downloadAs=painttool-sai-1.1.0.exe&fallback_url=http://pf.benjaminstrahs.com/s/1463874826/en/.../2/226535-1797368-painttool-sai.exe

http://s10207.chomikuj.pl/File.aspx?e=-HsSKkXCMKL5RqhDp5FNgZEhspN6c3Pr5_S7IVdQg6Ea82VFvpXjKTPbkianf9yT-EAnLX1KBd2E3YNNhDq6crUugtG4rTxWbtypVc-MMEYY2V1vtyUd3s4sKvq9GdS4_d9-IgMibB1uYD2N_Eb47hRammptaFPa2iOkBCS1YxB_StE8baWRk1kkX609gT6t&pv=2

https://docviewer.yandex.ru/source?id=acyyj-bi920dpvalhwrdczqmufq9nbh4747bmrgnai695v11w2ftljf2379sfva88xl96yc0f41pqy6yuz26afgee7hwao3bl1j13g67m&archive-path=//.../sai-1.1.0-ful-en.exe&ts=1542a3c919f&token=LjzL6GsTU7sOc6Ro4NimGQ==&name=Paint_Tool_SAI_ver1.1.0_English.rar&uid=335804268

http://www.afterdawn.com/software/general/.../painttool_sai?mirror_id=0&version_id=17011&software_id=2141

Latest 30 of 51 download URLs

Remove 226535-671351-painttool-sai.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.