home

fscapturesetup77.exe

The executable fscapturesetup77.exe has been detected as malware by 10 anti-virus scanners. This is a setup program which is used to install the application. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from www.faststonesoft.net.
MD5:
5188fc1802a294d0d6d5455824d79285

SHA-1:
5ce8dedeada7d4284d6e0d431a998317dfef5e63

SHA-256:
c667a9e00607385c84ba8f726c74b19d9849733d49a92aacf03907fcf75ca30e

Scanner detections:
10 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/25/2024 1:34:30 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Kukacka
160326-0

AVG
Win32/Sality
2015.0.4355

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.219.624.0

Norman
Win32.Sality.3
10.04.2016 15:29:17

File size:
2.7 MB (2,827,310 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\fscapturesetup77.exe

File PE Metadata
Compilation timestamp:
6/7/2009 12:41:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:HpKQ5TXr2+SFpeQFucAKRvmMmzMFM8RKMNYZXaLPnnL0IA4BfI40pl5/MOTw/s2Q:PTXFSds5secagRLP43mfI40T50Ls0xgt

Entry address:
0x323C

Entry point:
60, 3B, DA, 74, 02, 88, E1, 52, 68, 59, FA, AD, 00, 8B, CD, F6, C5, 73, 85, D1, 3D, 1B, 19, 17, 87, FE, C6, 86, F7, C7, C6, BB, 5F, B2, 70, 81, C7, F1, BB, 00, 00, 86, DF, BD, 9F, F8, 21, B0, 81, C7, 63, 09, 00, 00, 88, E6, 69, EA, C7, D0, FB, F9, 87, ED, 8A, C3, C7, C1, CD, 94, CC, 61, 0F, AF, C8, 34, A0, F7, C1, E9, FC, 2C, 15, E8, 17, 00, 00, 00, 84, EF, 8B, DE, 2A, D3, 80, F4, B3, 87, F6, FE, CD, 81, F7, CC, DC, 00, 00, 84, D5, B6, 78, 5E, 0F, AF, CE, 69, E8, 67, 65, 11, 14, FF, C2, EB, 02, 8A, C4, 81...
 
[+]

Code size:
23 KB (23,552 bytes)

The file fscapturesetup77.exe has been seen being distributed by the following URL.

http://www.faststonesoft.net/.../FSCaptureSetup77.exe

Remove fscapturesetup77.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.