home

6544944_stp.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
6085d89042d3fb77779b31869ada2cc4

SHA-1:
abe4bada0209efe508aec4c9c66d41657be840dc

SHA-256:
8db246183f549c298d731cf61771f8f8adb37028d8ecc737fe1ad452899adb2d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 3:17:49 AM UTC  (today)

File size:
136.8 MB (143,436,858 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\6544944_stp.exe

File PE Metadata
Compilation timestamp:
12/5/2009 10:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3145728:BQHVSVWsZl1SP12AO4+ZhUGrmlTccUKOXIxxuEx8/ooBXh+QukG4KhAK/:O1qJQcAO4FGrmPUKOXkufBsQghv

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9999

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file 6544944_stp.exe has been discovered within the following programs.

QQ International  by Tencent Technology (Shenzhen) Company Limited
Publisher's description - “Video calls, voice messages, texting with heaps of fun emoticons. QQ makes sharing moments and memories much easier... The fun is always on with 100+ million online users at any time. QQ comes with a built-in translator for all your chats.”
www.tencent.com
5% remove it
WinRAR 5.21 (32-bit)  by win.rar GmbH
www.rarlab.com
6% remove it
 
Powered by Should I Remove It?

The file 6544944_stp.exe has been seen being distributed by the following 50 URLs.

http://gsf-cf.softonic.com/abe/4ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=21277&instance=softonic_en&type=PROGRAM&Expires=1423613831&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Nv4D5Egcw1bPlgOZi-Oi43qxz47TeKRIzcVgKvMx-xMfBFRirD1sDAs5-RgrXpiNEwUJ3FL96us7VlHW6zzdkoNjb5M9PNJv6BLyBCK4nM8MpQeIGnQldW5RYbI02ck3uYLu~QT7dN-iB3NuL0ADW44g8m-ottZk-TmK6ILT7gs_&filename=Apache_OpenOffice_4-0-0_Win_x86_install_en-US.exe

http://www.capitalvaultsbits.com/gN06ZSAGQaP2FhfXJf03dZjGRlUe AnVt8pr 0ha8dRcfLKj evDr ddaOIZSxGlzeueiNZlEKblhTJq4TZfl4_24DpMsBW76iIQC42z6VfQSSTfQuUacWDXrNLWVfnzNTkcq28iykRJHpT02SAW1LCKArSBC19rh_XipAUoQFXXRFkIzlmgJa4IOblgJ9b2I7glWz94f9xRY59 fLLfm3KhskBRYw==-Ow==

http://pf.dlvit.com/s/2/.../25829-672478-openoffice.exe

http://www.capitalvaultsbits.com/xRc1pUiSAkPomnqlbtP lSeQfCmDE2CSL3NavCVO4kbCzHU2qk0eAIQ2xew35y_6FkfN2h PaAxHX9tmCiQa9GbckPoV3JWEVmXdLrDiSNMMfYbGwqRq9HLC4vohaRkL24eiCaC3v71cjxBDEVRFc34BDJB9zJZcoauprCc4 NpwZ468Blwx7PTpQTH10GoogJud3Y9G gU2m fiJdW6iKvMsM38TA==-Ow==

http://www.tsupdates.com/.../dl-ai.php?pid=144

http://www.downtoad.com/landing/google/openoffice/.../download.php

http://www.jpkn.sabah.gov.my/utiliti/.../Apache_OpenOffice_4.0.0_Win_x86_install_en-US.exe

http://www.capitalvaultsbits.com/WVl6OTRQVlJ3UVhObU5XZEhjWGw2SlRKQ1NsQnNWVkZSWmpWV00wZGtSbWx4YlU5MlFWUkNkRFl6UkRkT2FUQjRTU1V6UkNaalBWTm1kVkp4VEdkeVJuTWxNa1oyUjFvMGVuTTNKVEpHTjBwV0pUSkNPVkZxVGtVMWMzVTJORXByT1doTGNIUXdTeVV5UWxveWRUSkRlRXhvZGsxcGNIUldaMHBGY3lVeVJqUlZOemhaUTNOVVNUQlRNSGRDWm5SalEzZE5WblJ6UkZaSUpUSkdUa2RtTURoR1NrZEJhRmRHTkRWaWRXa2xNa1pqYzNwWmJXc3hPR1EwZURkalZrTjJNWE5QYmtnbVpHOTNibXh2WVdSQmN6MVBjR1Z1VDJabWFXTmxMbVY0WlE9PQ==

http://gsf-cf.softonic.com/abe/4ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=21277&instance=softonic_en&type=PROGRAM&Expires=1424672741&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=MmP5-i7qvTPdXmmeBIVeZg9O1GeNHAAtBaZGvjrzy4jh9YmBJN6DA6-XNTvmYU9yTkXnOgbGGmksmoGNT1fwsJ1dfRaMqEZlCtw2uvfRdKB82OVGIaf9OrB~DvYPzDT0Gn0T28jGRKRiA~NOOekW50YbMqNaUFPYdqkz7dATvXk_&filename=Apache_OpenOffice_4-0-0_Win_x86_install_en-US.exe

http://www.capitalvaultsbits.com/WVl6OTRQVmxqYW1seFExa2xNa0pWVVc4NFltOURVakpJTWxOU01qSktRbFYyTnpGMVMxSkdaRTFwY3pWelVVd2xNa0p2SlRORUptTTljM3BFVlhWdEpUSkdSVmg2T1RCUlZsUTNZemRWZDFCemQzWndRbFp6Wm1KRlVUbEljbEJQY2pOR01uSmljRVZRVlZsemJGQnNlaVV5UW1kS1ZuRmhkRUZPWm5CU1UwVjFaazBsTWtaNGQzRTBVbTlDYTNsSVZUSlRSekZuVjJVNFZXb2xNa1pEWjFKMlpWSmtiRkp0V0RRNU1GVTNXR2xvWnpoVFZXMW5RbXcyZG5CdVJWVklSU1prYjNkdWJHOWhaRUZ6UFU5d1pXNVBabVpwWTJVdVpYaGw=

http://www.ranchsignbundle.com/WVl6OTRQVFprUmxVd2ExRXhWRFkzYkZwdkpUSkNWbGRsVEdaMVUzRk1kMFIzYnpoWFdVWlRXbmxKTkRnME4wODVWU1V6UkNaalBVdzNiREEzTTAxeVpWcHpVbmhCVkZsNlNtNGxNa0pSYnpOc1QyMHlSMmRTYUdrbE1rSnhiVmgwWlZZbE1rSTVVM1pRZW5sVlJIWlRRbEppV0VGMWNucFpVeVV5UmpJbE1rWmxKVEpHVm04MFlXVm1la3h3VjIxbWRITTJWR2wxWlRGMmJYcHBWa3BWUTNSRVoyVnlSREJzWXlVeVJubERhR0ZLWkhOc01sSjZNMVZEZGpReVNIWlNXbmxwZDFrbVptRnNiR0poWTJ0ZmRYSnNQV1p5YVdGbWFXeGxjaTVqYjIwbE1rWTBNRFE9

http://www.todaysendsoftware.com/c?x=0MCpk51oU4dnDM6Cpgj7qBc0BABG cO3JP7sAV SAcI=&c=BhIIueGOtKhOQ8dMXINwRih1lerrBiBANV5ilt8w1gjtSDUpLENqDhAR6 NQpbN0Pvj0BCLKAc5bPMA8ulQ7uX05YoRLI1Erj0eprhVdp4mC9Qd2aSmFQser8RyDzq0Dq73Z00hsGkf2ObpLSioUVbIs4HxOdxvv6U4 An7gJT0=&e=0&downloadAs=OpenOffice.exe

http://www.flashlaboratoryapp.com/WVl6OTRQVE5xU3poblFtMXZVRGQ2YW5GYVMweDJWR1pLYUUxSGJqWkNTbmN4V1hwVWVub3hhekJSTW5oSVIyY2xNMFFtWXoxQ04yRkRWemgxVGpOWFlVUndjM2RrU2lVeVFrcFlRbkpQUkVVbE1rWk1OVGhSZVZCaE56RTRNM0ZVVnpjNEpUSkdWMGxJWTJ4ck4yNTBjMWRtTUhOSVdubFdaRkZOWkhwWWFsUnJORGcwUmxWU09VaEdXVWhKYlVOS0pUSkNjMWhqUmxOMmFYcGlRMHRWU25oWk9GYzBUbEYzTjBKa1dpVXlSbTlEVVRodVMyVWxNa0pqUkVkcUpUSkdUMWc0Sm1SdmQyNXNiMkZrUVhNOVQzQmxiazltWm1salpTNWxlR1U9

http://global-shared-files-l3.softonic.com/abe/4ba/.../file?nvb=20150120062447&nva=20150120182547&token=012900cdade4152de7c02&SD_used=0&channel=WEB&fdh=no&id_file=21277&instance=softonic_en&type=PROGRAM&filename=Apache_OpenOffice_4-0-0_Win_x86_install_en-US.exe

http://www.flashlaboratoryapp.com/WVl6OTRQVkpEYTFaNEpUSkdTaVV5Um1WcmRqbGhhbHBKVjJONFltNXpkWHA1UzNOaFIwMTBPWFZQTVhaU2NVSndkRTh3SlRORUptTTlZbWN3UWtoTGVuaDFiRXBwYkdKbllreGtiRkJsT1ZWc1dITXpkSFJEUm1ZbE1rSlNNVVZ5TVVSdEpUSkdhREJPVEV3MVlYUjRKVEpDWjJzemFDVXlSbXd6Vm1sUlRTVXlSa3BXV2xsdVJuUm5ZalZ3YzNCb2FYaHBUbFZ5TldSSGVEWXllVm95T1drbE1rSTVReVV5Um5KaWQxbHliamRhUnlVeVFqaDJVR1puVFZReWEyNDViblUzVWlVeVJraHdObGNtWkc5M2JteHZZV1JCY3oxUGNHVnVUMlptYVdObExtVjRaUT09

http://filehippo.com/it/download/file/.../

http://global-shared-files-l3.softonic.com/abe/4ba/.../file?nvb=20141120142535&nva=20141121022635&token=0e8307f104e323b690c15&instance=softonic_pl&filename=Apache_OpenOffice_4-0-0_Win_x86_install_en-US.exe

http://www.downtoad.com/landing/google/.../download.php

http://download.instalki.info/programy/Windows/Biuro/.../Apache_OpenOffice_4.0.0_Win_x86_install_en-US.exe

http://www.filehippo.com/pl/download/file/.../

http://gsf-cf.softonic.com/abe/4ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=21277&instance=softonic_en&type=PROGRAM&Expires=1422992583&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=ePYZFt60sp7nwQNFOAX~6aCkDQLFyN5NPK7rpVNn1DflPnQI7YldVPDtkT3I7HYoR-jXJu65zGDMZVAbYN7OjmVDpH8DHFAY1Hbp-epI7Rv1WkPlGHL45GjTnS-RcF3rQyR5ejLC4yItnAJg-HbiLD62uYcH-GRouYVX9M5Rj8I_&filename=Apache_OpenOffice_4-0-0_Win_x86_install_en-US.exe

http://www.oldapps.com/openoffice.php?app=6085D89042D3FB77779B31869ADA2CC4

http://cdn.downtoad.com/.../openoffice.exe

http://gsf-cf.softonic.com/abe/4ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=21277&instance=softonic_en&type=PROGRAM&Expires=1424227751&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Qzlg3GeH9ndjqRfhL8iTGV84iOSvDXY-VyUoThd5M8Rl21~iOq-khcVe-PC27LT3~xuY5nsPu3ba96WAUGnexrqhYeosafBkJQWNePfgMqsajZoVbL--q4IgW0eFq5pZMVdXVoMi6HtsXILz~t9B2njL7ydCndunEA4jJlboMt8_&filename=Apache_OpenOffice_4-0-0_Win_x86_install_en-US.exe

http://switch.dl.sourceforge.net/project/openofficeorg.mirror/4.0.0/binaries/.../Apache_OpenOffice_4.0.0_Win_x86_install_en-US.exe

http://citylan.dl.sourceforge.net/project/openofficeorg.mirror/4.0.0/binaries/.../Apache_OpenOffice_4.0.0_Win_x86_install_en-US.exe

http://filehippo.com/download/file/.../

http://fs41.filehippo.com/2003/.../Apache_OpenOffice_4.0.0_Win_x86_install_en-US.exe

http://fs40.filehippo.com/9463/.../Apache_OpenOffice_4.0.0_Win_x86_install_en-US.exe

https://downloads.sourceforge.net/project/openofficeorg.mirror/4.0.0/binaries/.../Apache_OpenOffice_4.0.0_Win_x86_install_en-US.exe

Latest 30 of 54 download URLs

Scan 6544944_stp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.