home

csiw_setup_16_jan_2014.exe

Cracked Steam Installation Wizard

Anti-Valve Software

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from download1904.mediafire.com and multiple other hosts.
Publisher:
Anti-Valve Software

Product:
Cracked Steam Installation Wizard

Description:
Cracked Steam Setup

Version:
16.01.2014

MD5:
926da27f62b87a5feebe38794a47ff36

SHA-1:
5427471e95073979b8d7a3b57d525546e9af0df5

SHA-256:
7de616e9060ce487696dd01576116314df4d18b14699f63e3e72496a2062f702

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/23/2024 9:33:22 AM UTC  (today)

Scan engine
Detection
Engine version

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.24.3

File size:
13.1 MB (13,690,974 bytes)

Product version:
16.01.2014

Copyright:
© Anti-Valve Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\csiw_setup_16_jan_2014.exe

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:ay6ZkQ/MuueMVdaNawan5L34anemZcjv7lps/3d+HOU8OFKAovIWW91Upx/nRi:ajMDwanh4aemKi3d+HO0Pa4/UppQ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9933

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file csiw_setup_16_jan_2014.exe has been seen being distributed by the following 22 URLs.

http://download1904.mediafire.com/h6777s9i49ug/.../CSIW_Setup_16_Jan_2014.exe

http://download1904.mediafire.com/bo2dtltbe5gg/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.dfiles.ru/auth-147946465413416b54f6fde73b4ca2a4-212.164.40.133-41818494-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://download1715.mediafire.com/060uebyztikg/.../CSIW_Setup_16_Jan_2014.exe

http://download1904.mediafire.com/ni4i63d3nxmg/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.depositfiles.com/auth-14785194158912a9150c4542f4f3242f-188.53.48.222-32587627-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://download1904.mediafire.com/syug5rf7d44g/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.depositfiles.com/auth-14777128464fae8e80b680e8501762e7-86.99.235.11-24065046-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://download1339.mediafire.com/lxac25nycikg/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.depositfiles.com/auth-14608304860413cff2c285f99e88eed5-105.107.135.9-2534744205-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://download1904.mediafire.com/dhcyz59vvdig/.../CSIW_Setup_16_Jan_2014.exe

http://download1904.mediafire.com/pm6o5bycv9xg/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.depositfiles.com/auth-14702316681b8aa7964fff919e085fbc-85.65.38.79-2639607124-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://download1715.mediafire.com/e321rhnkpp1g/.../CSIW_Setup_16_Jan_2014.exe

http://download1904.mediafire.com/uyy6cbulbpzg/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.depositfiles.com/auth-14564152848ff714dedf0491f24d936d-2.51.57.100-2481361272-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://dc724.4shared-china.com/download/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.depositfiles.com/auth-141837817652dc7aba8540ce92f913b9-37.236.160.12-1835704608-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://fileshare1110.dfiles.ru/auth-14095209766ffd45026338a172ba72fe-188.186.150.101-1646559251-151575686-guest/.../CSIW_Setup_16_Jan_2014.exe

http://dc641.4shared.com/.../Sfbto8iace?tsid=20140815-095945-ff3d3ae3&dsid=7bcouj.914133e7c6568dc23ce9c4a0744afe3b&sbsr=02dc5a055c2bbe86bbaf450145d127f17a8396431302c439&forDownloadHelper=true&lgfp=8000&dsid=7bcouj.914133e7c6568dc23ce9c4a0744afe3b&isApi=true

https://api.4shared.com/.../Sfbto8iace?tsid=20140815-095945-ff3d3ae3&dsid=7bcouj.914133e7c6568dc23ce9c4a0744afe3b&sbsr=02dc5a055c2bbe86bbaf450145d127f17a8396431302c439&forDownloadHelper=true&lgfp=8000&dsid=7bcouj.914133e7c6568dc23ce9c4a0744afe3b

http://getwapi.com/software/download/file/.../CSIW_Setup_16_Jan_2014.html

Scan csiw_setup_16_jan_2014.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.