home

br_setup.exe

Sony Online Entertainment

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
Sony Online Entertainment  (signed and verified)

MD5:
6e14bf1853ec49fb81736d066c9c5386

SHA-1:
f754928de34fffd062cafd3ec66cff957a2e71c0

SHA-256:
75febdfb947eec28b8327d3631436aea95c862b17918f5b7f87b168e2be209f3

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 9:25:46 AM UTC  (today)

File size:
61.8 MB (64,840,880 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\br_setup.exe

Digital Signature
Signed by:
Sony Online Entertainment

Authority:
VeriSign, Inc.

Valid from:
1/21/2011 1:00:00 AM

Valid to:
3/17/2013 12:59:59 AM

Subject:
CN=Sony Online Entertainment, OU=Sony Online Entertainment LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sony Online Entertainment, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
68DF7F78F6836ED5C4AF0C3AFD4F65CE

File PE Metadata
Compilation timestamp:
6/6/2009 11:41:48 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1572864:mztKhCVG7ahyO6eIUX63FJClOdOnT4woFCioa:EsjO6R66PCpTqoa

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file br_setup.exe has been seen being distributed by the following 12 URLs.

http://dw.uptodown.com/dwn/kohEsbAETiOZ4DYuXlSC_hAgeqpLJmwqvOMOMGKpg_ue1K3MH2V2isYCRbybyTpdPOZsw7AR2jGa6WPNhrXLukcu6vgZX7LP7DNlgae6CdfI2S1XWqPyRAX1oaiGkWZG/f4Kn81LhP6H3y7eCJl_Dw_F6p12mUFE8WbaWHNeMbsMpMY5cSTfeWzdTQp5NXDzRJwF-mQPndkZ8XJ-cI3UlituTTL5NEvwPPnFKKwoILApEtCMG6tUsR3OGC7uMVuBe/vQWkRPBC1lZwhs9vCTKFV_uIgVymc_HldLaiubBgzaEPk4za8iDISl-ay_5CLMeDSjZb9m2nA7bS3cYlESF_zMXfHa3MhxbDYQt-f5F10FnQhT6cuj0flswpWYg36pPM/.../

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_en&type=PROGRAM&Expires=1472283872&Signature=EKP8r3lOEbHlpWbMoAQ-BSO-lnKHmynL-rWNO-KRpU9~duAxPaWgCTvvEsf0cB9kY-MwFaqVwq-4cJFmdiRB-SBphvT0E34Vs0SmbkET62AJIGVxgKefUjrA-t1vjc64mgtnOaNvgHAsej0Go6DPq4cKE8NCp3QH9KfZu49AnI0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_en&type=PROGRAM&Expires=1472089742&Signature=D8iDFR~jQKFUwDAniDwZboQoMeayZ3yBHcPpllUUommsobHIeItneWPbFN7twCrTv7oCqkPd3RVudDeYkIp3PSq25mGJQs1LN3HuzuzxpDVoVFVjTVI4Y6P6gD1AkKMlHTbRWS6i5jpWLYIDTr6OWzmjwCKBPdw2BgJhwsKi5NM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_es&type=PROGRAM&Expires=1446983570&Signature=OQc2e2dCopoIN5SW8Rs21uWUUSQIPTDvwj2cw~1KKEVA52DiMsqZ45cA5-9vAOdH7LBF3EesUxsGAipejj7kcGxeKrMQ8eHC8bwrcGq3LrPDDUQpz-Us9nILuGUa09kEZwsa~4HuSCHtrZNNcVvPSNa5BgNve0MsFIZmqKMJYt8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_es&type=PROGRAM&Expires=1424685891&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=dZxFe7qMxQxbpDe9s0CBfON5k8odogMEe2gHRueSgXKmdeB66h6rHGM8YygH8bQfe-xZQkzpcYl6qn2Oor0Y40U-KHhJkjOW3iBA~WuMM8WjQfRAw0ulewapnAzmzaJXicEmfU4XVvrjxrT~h-UXiBKkb0~vtzjDuCgpM7oW5W8_&filename=BR_setup.exe

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_es&type=PROGRAM&Expires=1459504500&Signature=ehMWvRol~ZRTkB0gFBmvKSj4gjVCYGizXXVfC95GcQvIClVc5zSZR8iQsZRBBz8wzjY3t6OZWt479BBYfUevT~1x7LsKq4aS~u1iDaY-Z0R25105T0aY-fjU7EN1SnAyoSW6nMJad2uLkM1j~tPY3qVVAAl5caKRp~OEwflRC78_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_es&type=PROGRAM&Expires=1444975883&Signature=FnzSVici5d8hD8GvnR6wjwCONfDPm4Yz4sa3vsAZ0ag8EOKtQyJ-nyE7mHdZqzytej6dTvTwnMhfTJvet4500Odobz2GMpKP9f9wyYVSMdABIdZwmBkTNnwsJYrA58B~8rX-IKA1qHpSMX0mNQcYsKY-XrqArbyK11R2V5Jvru4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_es&type=PROGRAM&Expires=1459242596&Signature=d80zOAfmHxregp1M~b79apyaPgjUNhxHzB3kJlC0iKhdQWfipWe2YdBGWaeOpIk5WaWvNPf3KXROLq1o3wu6CUxR1voMWBqcO~6sxgSW3Lm7eLIxF3Vn0soHW6-jo1Ce3f5oOZF4ho3KVsWAT~YEYAj5rxkiGgA4ZFaK7yF2rnY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_es&type=PROGRAM&Expires=1456762927&Signature=dBGppHvz31az0gJLx5MqimShvv51QtTSo3jtW-I6~LFI6p9Vo28CyL1wxwVpl91cp~xlP4PdWewMa3-Wv6ddgd4Dnh4M~asPHWSv0Og6LHHzOKwf1Ef9vLqERT6zL1FFi8O~fIX2xpSLcht-fVOM6qdA1mwwMnZtDA3P0-1PVqg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

http://dw.uptodown.com/dwn/2m1hKFWeUN6VdWFv7Wn2QxN97_gVaEPcmtmqgmbIYpaSYbjqMz6nVUFClMHdQTfe9HRStGAgf8WmNvPpo5x9rfIthCipT7_P1v7fl6MtA8z1Ns5Q69N9LBP7ezmDuRXA/s1HXwUUxb-MVAIUXbaQv6vg0RzdDvxYrDzcozDLvGzQAbNAJJk3m-WlJ7hNiU-yE773GVKieiEZZFbe6D8Ku5rmykv29la8yL3gVhq2Xst0aN-7apJCLCa_yT9_bGb7M/.../

http://gsf-cf.softonic.com/f75/492/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3349673&instance=softonic_br&type=PROGRAM&Expires=1450460139&Signature=ItnGIzvt-Ve~waCViWb-k6E-B4ygaKF2euF1V5qaXMf8Q2CJDqx8q3JnNfpFGIoe8Z~VOeM4z0b0Bs10Q0fFeUpHMtUZCRcj8N8LJzMF2Xk2VTKVBGvfj8LP8O1VYeOb6f9z53iRGkAxmINKCA9Umy0ztCgS5-t5DBjNTzObq~o_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BR_setup.exe

https://launch.soe.com/.../BR_setup.exe

Scan br_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.