home

fotosketcher.exe

FotoSketcher

David THOIRON

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from od.ccm2.net and multiple other hosts.
Publisher:
David THOIRON

Product:
FotoSketcher

Description:
FotoSketcher Setup

MD5:
647005943d6b6ff29c305788df986c9f

SHA-1:
25e55cf85354e0e45e55de02b3485c745ec90fd3

SHA-256:
21c689031e46454f8ea8f392af82fe6d5329c7cecc7c282ea7017c3385b4d62f

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/5/2024 7:31:34 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Bundled.Toolbar.Ask (variant)
8.9612

File size:
7.4 MB (7,808,428 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\fotosketcher.exe

File PE Metadata
Compilation timestamp:
3/17/2011 11:22:54 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:AIo3AHQ8Wp3owIXGWk0s2xTpCON966RS5:AIoM7s29pCm96L

Entry address:
0x16478

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
84 KB (86,016 bytes)

The file fotosketcher.exe has been seen being distributed by the following 7 URLs.

http://od.ccm2.net/www.commentcamarche.net/download/.../FotoSketcher-2.20.exe

http://gsf-cf.softonic.com/25e/55c/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66058&instance=softonic_fr&type=PROGRAM&Expires=1470628555&Signature=ihuBzAKFieIxMNkbaHWt~26RQTk8Eepfn~fRFgSRUqcQnxpP6QKWYVFdDrLHEIfdzuXM4OPyInqYyc7v6gpRjznbQmZw29MdsZ4BrXJGMzFXGu9W4zQItwtz-RGxf8JIzYrIdzGPZup7DxfCQymZQtdr1f~Dxshs8k9naDQE24E_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FotoSketcher.exe

http://gsf-cf.softonic.com/25e/55c/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66058&instance=softonic_pl&type=PROGRAM&Expires=1452224798&Signature=Q1T1H873OD79Fn5c33PWErPWFZqKEb866P~BwE5fLMwGv9XbVCVzKk15ISMJ42RgJ1bI4bBmhsPQ2sgy~8cq1PmtbtCpfJvp~oXkiGi9pJLM0liGdXH0L-KPzmuS9-IHxzqWgboA5qbQMCwN4xj1bFbVdLRJitxDJDPzvL2-f7o_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FotoSketcher.exe

http://gsf-cf.softonic.com/25e/55c/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66058&instance=softonic_fr&type=PROGRAM&Expires=1457463589&Signature=RmSjQq4D78SqsO5o1hwUHowSEMIqXeNCozAIVIYTMz1V02-78pujp0yVT-taC~yorK0wZyhksBHssq1~Di0wxzPEejfXfoua4YwvnH~BygSPkQqap-6-ODF16yjGb~cFHtv9WhnQ31ikvYVq4mckHRnF7WJpEgwhffT3~XMCMh4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FotoSketcher.exe

http://e.ccm2.net/www.commentcamarche.net/download/.../FotoSketcher-2.20.exe

http://gsf-cf.softonic.com/25e/55c/.../file?SD_used=0&channel=WEB&fdh=no&id_file=66058&instance=softonic_fr&type=PROGRAM&Expires=1445640998&Signature=aRMNzsXbVRpsvhXKwDfTw2UF2p4m8vPKityehxb3y-hwfQ5LAw2~y8Y7jo4qlS7K6E8zuYeeyzoLcrdVEha6s3lePTFcCYP66n1wsY85I0a8KH2ydnTiiONCtT3Q4fuzN4uXwy~c6y7hAgcV7c2Z7iIJ3GAPpi36Lg2Y88OVVJo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FotoSketcher.exe

http://www.fotosketcher.com/FotoSketcher.exe

Scan fotosketcher.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.