home

cmstudnt.exe

PackageForTheWeb Stub

InstallShield Software Corporation

The program is a setup application that uses the InstallShield Setup installer. The file has been seen being downloaded from www.dropbox.com and multiple other hosts.
Publisher:
InstallShield Software Corporation

Product:
PackageForTheWeb Stub

Version:
2.04.001

MD5:
49405acff21ffe6e6d4568fd9b73c91a

SHA-1:
dded09897c2cf0427529ab00990faf71d0993a8f

SHA-256:
4e73a598f26b3a4fb80e97570429e938168fc87aca7be83fccdbed7e01283394

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/26/2024 3:20:01 AM UTC  (today)

Scan engine
Detection
Engine version

Comodo Security
Heur.Suspicious
18848

File size:
3.2 MB (3,400,151 bytes)

Product version:
2.04.001

Copyright:
Copyright © 1996-1999 InstallShield Software Corporation

Original file name:
STUB32.EXE

File type:
Executable application (Win32 EXE)

Installer:
InstallShield Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\cmstudnt.exe

File PE Metadata
Compilation timestamp:
1/7/1999 11:10:41 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
49152:jm/cxiLHzl1iT46jVvSAZYZpdqQEK013m299BJLRrtq9iKA3:jYcxiLHx1646jVvPZ3f7BJ90A3

Entry address:
0xCE00

Entry point:
55, 8B, EC, 6A, FF, 68, 40, 31, 41, 00, 68, 58, F9, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, C4, A8, 53, 56, 57, 89, 65, E8, FF, 15, 8C, B4, 41, 00, 33, D2, 8A, D4, 89, 15, 10, 85, 41, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 0C, 85, 41, 00, C1, E1, 08, 03, CA, 89, 0D, 08, 85, 41, 00, C1, E8, 10, A3, 04, 85, 41, 00, E8, 94, 01, 00, 00, 85, C0, 75, 0A, 6A, 1C, E8, 39, 01, 00, 00, 83, C4, 04, C7, 45, FC, 00, 00, 00, 00, E8, EA, 27, 00, 00, E8, D5, 27, 00, 00, FF, 15, 90, B4, 41...
 
[+]

Entropy:
7.9873

Developed / compiled with:
Microsoft Visual C++

Code size:
70.5 KB (72,192 bytes)

The file cmstudnt.exe has been seen being distributed by the following 13 URLs.

https://www.dropbox.com/s/.../circuitmaker_student(1).exe

https://onedrive.live.com/.../FcX9HMuv2e3JHvD4f6nWd0j2iTVfj5vYStoiE=3&ithint=.exe

http://docente.unife.it/mirco.andreotti/insegnamenti/allegati-elettronica/circuitmaker_student.exe/.../file

http://www.baixesoft.com/wp-content/uploads/2012/.../Cmstudnt.exe

https://moodle.ufsc.br/pluginfile.php/1694459/mod_forum/attachment/.../Cmstudnt.exe

http://docente.ifrn.edu.br/leonardoteixeira/links/instalador-do-circuitmaker-student/.../file

http://www.technologya.ps/index.php?index=files&request=download&D=1551

http://i-learn.uitm.edu.my/download/.../circuitmaker_student (1).exe

http://physics.randolphcollege.edu/psheldon/classes/p331/.../cmstudnt.exe

http://babbage.cs.qc.edu/courses/cs343/.../circuitmaker_student.exe

https://fenix.tecnico.ulisboa.pt/downloadFile/.../circuitmaker_student_64.exe

https://byui.app.box.com/index.php?rm=box_download_shared_file&shared_name=55lid0230gxc24nk32f3&file_id=f_992291541

https://dl.boxcloud.com/bc/2/8ecabdd955b5b8044353d2541a83eabd/oxsr6n5bVQhyic6N7TfrMf0sVTkQUOBIH0HsZBGRDI0si84Chpt_3ZjzaZYMPOwbyyATOQjCMtuz5i34lvwOPzn6vqjPIlTrSc5QsrWM9azon8_U4LjbzhWHmhk5Jz40E9L2kFWHtSdtuLT1BX4MbfVgUcmXL2YRkHmJrcahVWRssX7o2khl3KZCJqDvbumfUVLeclpRhvyJDq1vPoO-Kfiyl5wsKV_9uK1zMXIR9WVyB1k4RN8AoZfOzTlDhxL8jcjlvkfuVgWbd1stQSh2wEDK29LuUVmGB0JFr6n3DIRbtn1gdxTiqtpbP47zQ3w4KYydiKIwwvnn9z-jpPMvrHX9V-HcRa_77ZwcIQVy9385mMJoNQuEblRy5k-bINw9NHnXkXPQda6gXqCyfNaQSNV-0YKUv1HnZJ2Hl0GCtsPRsxmDFbtiSJJj-gbTXsS2JSupKnfNuB5sCvA_dDI9Dw86pApSfKteFTrqtONNuFf-qJGDwRw1WxMSTs4H9pHym-5GgriiUPTx524T_9b0b_HKH6jeAOwQj75IqIbJBuPJpQj6D9OIJ_XrY84Z0kF1mGi6drT7WW500CkXGv40UoqMQ0rRO9tR_8o9TvP5ylh9FJV8kX4C0tN73mqa0DyVTwvh5-mH1wKaBe1ZE4CEG8dnnVnE5gv3a9FxOGwICjjJOzaKVdQwtU_Ems65MQ0kL2p3rwaQXbCageb5I3Ws4zNENh3n_shbJeI0H6T_HmCt3jfmxVQqDlASnsTp9uvZVwbCMJAXEgy78ry_d8p463zrP6CfAmvK-ASQi7tg78E,/.../

Scan cmstudnt.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.