home

ffsetup3.3.4.0.exe

Format Factory

chen jun hao

The application ffsetup3.3.4.0.exe, “Format Factory Video/Audio/Picture Converter” by chen jun hao has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from download.instalki.info and multiple other hosts.
Publisher:
Free Time  (signed by chen jun hao)

Product:
Format Factory

Description:
Format Factory Video/Audio/Picture Converter

Version:
3.3.4.0

MD5:
a47becf8b66a4dbc00d237ddab21d0d2

SHA-1:
d86d2fc37b1fed635caf6f25254d7a575466ed1e

SHA-256:
af7460ce581d3e96d86e34fa4062c612189dba7a2cc2caddbb4fd4604f57546d

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 5:02:25 AM UTC  (today)

Scan engine
Detection
Engine version

NANO AntiVirus
Trojan.Win32.Runouce.cvgtyi
0.28.0.58873

Reason Heuristics
PUP.Installer.chenjunhao.L
14.7.31.23

File size:
52.5 MB (55,003,752 bytes)

Product version:
3.3.4.0

Copyright:
Format Factory

Trademarks:
Format Factory Application is a trademark of FreeTime

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\ffsetup3.3.4.0.exe

Digital Signature
Signed by:
chen jun hao

Authority:
GlobalSign nv-sa

Valid from:
6/25/2013 11:09:13 AM

Valid to:
6/25/2016 11:09:13 AM

Subject:
CN=chen jun hao, C=CN

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11215F9DDE67138EA8C52C9F6F1901954DE8

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1572864:VVxC35EIwFHo6FB+4KRtYky4Z+LH/fwyQrfA4:E3KI4HoC44KDZy4Z+LH/fwR44

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file ffsetup3.3.4.0.exe has been seen being distributed by the following 44 URLs.

http://download.instalki.info/programy/Windows/Multimedia/.../FFSetup3.3.4.0_www.INSTALKI.pl.exe

http://www.slunecnice.cz/sw/format-factory/stahnout/.../?m=df8882cb97854a15986d071ee1562554&t=53f39c9a

http://www.slunecnice.cz/sw/format-factory/stahnout/.../?m=28fada3fecbc1b01bfa38222941a13cf&t=53771f73

http://es.kioskea.net/download/.../descargar-6542-format-factory

http://lb.cdn.m6web.fr/d/c/a/adc810dc2a455bd81d5d83df796380f1/5360e920/soft/.../formatfactory_3-3-4_fr_223920.exe

http://www.download.fi/.../download.cfm?version_id=79460&software_id=2243&mirror_id=0&installer=0

http://e.ccm2.net/es.kioskea.net/download/.../FFSetup3.3.4.0.exe

http://lb.cdn.m6web.fr/d/c/a/a18ebd4eb8788f112587c46bbb6a0c79/534bca13/soft/.../formatfactory_3-3-4_fr_223920.exe

http://depo-tamindir.com/p/f/.../formatfactory-3.3.4-tamindir.exe

http://download1945.mediafire.com/o87m2v7s0b3g/.../FFSetup3.3.4.0_softexia.com.exe

http://it.kioskea.net/download/.../download-191-

https://ilias.aon.edu.pl/goto_PDKW_file_17439_download.html

http://www.programosy.pl/.../pobierz,formatfactory,2.html

http://lb.cdn.m6web.fr/d/c/a/b1d5bcc892caaab174696bda8955b04b/5357bf2a/soft/.../formatfactory_3-3-4_fr_223920.exe

http://cs10.superfiles.me/f/0/1458834199/46902952/0/.../FormatFactory_Rus_Setup-spaces.ru.exe

http://www.afterdawn.com/software/.../download.cfm?version_id=79460&software_id=2243&mirror_id=0&installer=0&perion=0&air_installer=0

http://gerenciador.nzs.com.br/programas/urls/iron/.../formatfactory-5231_82504102.exe

http://telechargement2.pcastuces.com/temp6bs2/.../FFSetup3.3.4.0.exe

http://lb.cdn.m6web.fr/d/c/a/aa25d5fae03984eedece867ad51bfb4d/536fdc47/soft/.../formatfactory_3-3-4_fr_223920.exe

http://software.thaiware.com/download_url.php?id=10737

http://en.kioskea.net/download/.../download-3532-

http://es.kioskea.net/download/.../download-6542-

http://dl.softexia.com/FFSetup3.3.4.0_softexia.com.exe

http://www.themediastorage.com/cgi-bin/dl.cgi/.../FFSetup3.3.4.0.exe

http://www.themediastorage.com/5dr9jcujompr

http://download.slunecnice.cz/slunecnice/96b687abed5a11bf83a8e5f09e0dd279/5345c49f/win/.../FFSetup3.3.4.0.exe

http://www.slunecnice.cz/sw/format-factory/stahnout/.../?m=96b687abed5a11bf83a8e5f09e0dd279&t=5345c49f

http://www.formatoz.com/.../FFSetup3.3.4.0.exe

http://www.formatoz.com/download.php?file=FFSetup3.3.4.0.exe

http://download.slunecnice.cz/slunecnice/2632a8386df222f313a702370ec768ce/53c98516/win/.../FFSetup3.3.4.0.exe

Latest 30 of 44 download URLs

Remove ffsetup3.3.4.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.