home

7078455_stp.exe

Smart Image Recovery

Smart PC Solutions, Inc.

The application 7078455_stp.exe, “Image recovery tool ” by Smart PC Solutions has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from smartpctools.com and multiple other hosts.
Publisher:
Smart PC Solutions   (signed by Smart PC Solutions, Inc.)

Product:
Smart Image Recovery

Description:
Image recovery tool

Version:
2.4

MD5:
12e9f0c490d664d490dd4cd10f5b3fab

SHA-1:
8df334603bd150858d5faeaae5af5b7dc7af3a19

SHA-256:
7878707d277c3eaaa5ba3385c16f73083339913c8afcb0f75be11866ddaeff96

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/5/2024 10:33:36 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Optional.SmartPCSolutions.L
14.6.10.14

File size:
2.1 MB (2,248,304 bytes)

Product version:
2.4

Copyright:
Smart PC Solutions

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\7078455_stp.exe

Digital Signature
Signed by:
Smart PC Solutions, Inc.

Authority:
VeriSign, Inc.

Valid from:
4/4/2011 9:00:00 PM

Valid to:
5/29/2014 8:59:59 PM

Subject:
CN="Smart PC Solutions, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Smart PC Solutions, Inc.", L=Alexandria, S=Virginia, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
502E76B6ACDCDE4F3336BF9286946063

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:2abW8Ln7FT0gDfHVgTv5jI9phNFKbo7S/uv1ywr//Qkf6kiCTGinXBg9:nS8LBTzLHVCvBI9phN8M7S01yE/3SVCI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file 7078455_stp.exe has been seen being distributed by the following 2 URLs.

http://smartpctools.com/.../imagerecovery.exe

http://www.smartpctools.com/.../imagerecovery.exe

Remove 7078455_stp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.