home

bubblebobble.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
398873c427f5c1173533209a8a74e992

SHA-1:
6802e9cd9b2eb9a753d9ec50754e7e80a94a522b

SHA-256:
4e4f51f4332b187ca80c89adcd4ee4a6d45de567ef5e9bc5bc214e40cbc2b94a

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 6:42:13 PM UTC  (today)

File size:
2.2 MB (2,285,478 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\bubblebobble.exe

File PE Metadata
Compilation timestamp:
10/6/1999 1:33:39 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
49152:T/UOu7cZIjmlsANyu5QqD4eok8m9AHIN4EAWYEvhLEG+Mxx6gwxopO7slCClUE:T/AcsSnyJlbk9N68lx+Mf6gwQ9Cw

Entry address:
0x1020

Entry point:
55, 8B, EC, 81, EC, 14, 04, 00, 00, 53, 56, 57, 6A, 00, FF, 15, 08, 41, 40, 00, 68, 00, 50, 40, 00, FF, 15, 04, 41, 40, 00, 85, C0, 74, 29, 6A, 00, A1, 00, 20, 40, 00, 50, FF, 15, 20, 41, 40, 00, 8B, F0, 6A, 06, 56, FF, 15, 1C, 41, 40, 00, 6A, 03, 56, FF, 15, 1C, 41, 40, 00, 33, C0, E9, 0C, 03, 00, 00, 68, 02, 7F, 00, 00, 33, F6, 56, FF, 15, 14, 41, 40, 00, 50, FF, 15, 10, 41, 40, 00, 68, 00, 02, 00, 00, 8D, 85, EC, FD, FF, FF, 50, 56, FF, 15, 00, 41, 40, 00, 56, B8, 00, 00, 00, 80, 50, 8D, 8D, EC, FD, FF...
 
[+]

Entropy:
7.9980

Developed / compiled with:
Microsoft Visual C++

Code size:
2.5 KB (2,560 bytes)

The file bubblebobble.exe has been seen being distributed by the following 16 URLs.

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1476652117&Signature=hWbLlfXZpuH1zd3ydQm65h6RWwB3TcXf8l6f9cH-lS2sIpgyCHcHniFuytgtLq9L-lrrrZJsMzQI8KN9KkZ6q-g~RLqLLW98400uEKpyyxQxDt9u-RyAmSnwKW2zVzZSPVMulNFE8oSF1sgqqk9VxQ2NH7CtTqExK-CPML4r6C8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BubbleBobble_1660.exe

http://lb.cdn.m6web.fr/d/c/a/085d56caf58ff5020254ab378aa92a08/585067b2/soft/.../Bubble_Bobble_Nostalgie_3.0.exe

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1477807403&Signature=fMnfrtBis7J7BAkeiNXO-BvuG4hcQYevdPs4ik1k4qOBm7k8MG5izYAj8phLs2u-v~bcMoV4nzUbrm7iPwbAqH5NLendP4aQCGjTYzreEXnsXO2ca7qgh2XQzrSFvqqIgtFqlJ6RXPX29zwMaqbbo~AvzCss9yxxX4uXjMWuIEE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BubbleBobble_1660.exe

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1424216435&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=gW50TK6k72qU6T2sVkcBmEmEtgIF4TBtrE-aSwQBCdQBBNDymtnln5NbZo9P4aETdyfBEIRVqpVee-yNuFJtRpu~8q55QVXfyujKTcYr7CyojV3fnYWmr2cE-oL3H2JLtN74~lDZHNbTKa89cIOutU7DK8Ta7PzhJ7V3xyT4Deo_&filename=BubbleBobble_1660.exe

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1471098586&Signature=hXniLMpbYpkakY7gdNrrI5C9GhUi0weARHVDBCkkCwyjDayrH4Gy4VRr-RwceeC7OsCB~21oCrI8wdq-bPBQc5ODutyt1xmfvL8To4aF1WxyCMW2GDPjRLer3Fi4GAUQl8719i6kkdTFtRbqubbmU0i15~XggMc7rhV18HQY8zs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BubbleBobble_1660.exe

http://www.alawar.com/BubbleBobble.exe

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1463619871&Signature=QyRCAGolmk38G739hbdawrFG4IEsFZlU-EEL6D2Vd~e5NIBCVNkTeQMmBOUXc~kKpUB3B40GrhSP9Yq6Oh3hylmKr0agvF0~5GQaam9I6NyWy7Dy8SZ3hYG~wwRMFDgdKIL9RBSzl1Bd6R8nZgJq2uXeISnpls06MWJl7sEKkq4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BubbleBobble_1660.exe

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1462166612&Signature=QnIsnFU87qM-vMaHNDeF5Vy~CBevd~GlePyAQtAMwfZf3AR-KXrIUCSf2GTDgJe~zkMACyXUP2yadJY68RmXD1y6j9hZx1vDU1U7qdE1b5wjWkV5kQ~2ZeTv6V0IUWdajYjsQocWOYwRiRbJM0Gr2i9fa8Qk4ygQ1-Pb7YhpOP8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BubbleBobble_1660.exe

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1448084219&Signature=U3zzJsJfkssgHDBXFlpXgzgEiu8OgcO6~hndNNtfvb-z8FjCp2IC~~wQM18~P24j6-btB289nRAKYaSmlynoAFFK4C2pjC7gmfqSAx5kir8KR85QMQfgBM7flNHZ-tSvdMt2-pQv6bEfRJC5iRTqR1fRdAzEr2rIifsfjmV~gY4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BubbleBobble_1660.exe

http://i_eazel-com_bubble-bobble-nostalgie-2-1.fopjutrirelad.com/crawled_soft/4/0/.../40595-75768-bubble-bobble-nostalgie.exe

http://eq03.mirror.alawar.com/BubbleBobble.exe

http://gsf-cf.softonic.com/680/2e9/.../file?SD_used=0&channel=WEB&fdh=no&id_file=45360&instance=softonic_en&type=PROGRAM&Expires=1461276752&Signature=dl-wFNRlWgi8I1fBc4K2FJbPbIyidU2flcTPM9kCtfCXvT78Sz7sPJ0-leey9VW0udEYAIIzs0Qi8U8da8m7U~eRbE7Cq4lDIp0mZVUFyuhRref53JZaMcFYHcPYTbufTcXXbq4qCkmVfHPz9oSw-pnXwJptn98YaMy~ng9Yjfo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=BubbleBobble_1660.exe

http://eq02.mirror.alawar.com/BubbleBobble.exe

http://eq02.mirror.alawar.com/BubbleBobble_1660.exe

http://download.informer.com/.../bubblebobble.exe

http://bubble-bobble-gold-edition.software.informer.com/.../

Scan bubblebobble.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.