» dragon_setup.exe
Overview
Analysis
File Details
Behaviors (1)
Downloads (13)

dragon_setup.exe

Comodo Dragon

Comodo Security Solutions

This is a setup and installation application. The file has been seen being downloaded from filehippo.com and multiple other hosts.

File name:

dragon_setup.exe

Publisher:

Comodo (signed by Comodo Security Solutions)

Product:

Comodo Dragon

Version:

50.14.22.465

MD5:

e018b275fcc426344eb909eb984ebe9c

SHA-1:

6771a7383a27f41c51f588c5dffbab0c16b6fa2b

SHA-256:

fc769417d334440925a9db42c55e3f18af6b4ddc88510d550b58d7836c35b0d5

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/23/2024 1:54:41 AM UTC (today)

File size:

53.5 MB (56,127,856 bytes)

Product version:

50.14.22.465

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\windows\temp\dragon_setup.exe

Digital Signature

Signed by:

Comodo Security Solutions

Authority:

COMODO CA Limited

Valid from:

1/4/2016 8:00:00 AM

Valid to:

1/1/2017 7:59:59 AM

Subject:

CN=Comodo Security Solutions, O=Comodo Security Solutions, STREET=1255 Broad St., STREET=Suite 100, L=Clifton, S=New Jersey, PostalCode=07013, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

474BF5DFD0395CA926B2F2367E46DCE8

File PE Metadata

Compilation timestamp:

12/27/2015 2:25:55 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

1572864:sStkCiKVt9O0XQgmuQ1rNP6L2PRZW8Q0k5sY0EjN6oW:sqxjtBAgmuQ1F6SPQTqY0roW

Entry address:

0x326A

Entry point:

81, EC, D4, 02, 00, 00, 55, 56, 6A, 20, 33, ED, 5E, 89, 6C, 24, 0C, 68, 01, 80, 00, 00, C7, 44, 24, 0C, 00, 93, 40, 00, 89, 6C, 24, 18, FF, 15, B0, 70, 40, 00, FF, 15, AC, 70, 40, 00, 66, 3D, 06, 00, 74, 11, 55, E8, 51, 31, 00, 00, 3B, C5, 74, 07, 68, 00, 0C, 00, 00, FF, D0, 53, 57, 68, F4, 92, 40, 00, E8, CE, 30, 00, 00, 68, EC, 92, 40, 00, E8, C4, 30, 00, 00, 68, E0, 92, 40, 00, E8, BA, 30, 00, 00, 6A, 09, E8, 1F, 31, 00, 00, 6A, 07, E8, 18, 31, 00, 00, A3, 24, 92, 42, 00, FF, 15, 44, 70, 40, 00, 55, FF... 
[+]

Entropy:

8.0000 (probably packed)

Code size:

24 KB (24,576 bytes)

Startup File (All Users Run Once)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

!CD

Command:

C:\windows\temp\dragon_setup.exe --silent

The file dragon_setup.exe has been seen being distributed by the following 13 URLs.

http://filehippo.com/download/file/.../

http://cdn.download.comodo.com/browser/release/.../dragonsetup.exe

http://filehippo.com/download/file/.../

http://files.downloadnow-2.com/s/software/14/73/57/.../dragonsetup.exe

http://download.comodo.com/browser/release/.../dragonsetup.exe

http://external.comss.ru/url.php?url=http://dl.comss.ru/.../dragonsetup.exe

http://filehippo.com/download/file/.../

Scan dragon_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.