home

gsv50w64.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from dl-web.dropbox.com and multiple other hosts.
MD5:
604f681e2e364e83ff9f4e4db6fad88c

SHA-1:
57811cbf86c97c6e5a6e1ec356fffc873222196b

SHA-256:
80d0161abbb3cfb0ff08f3787c4959b8a41585ef1470dae4aea20341820d49af

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/5/2024 10:14:14 PM UTC  (today)

File size:
2.1 MB (2,176,512 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\gsv50w64.exe

File PE Metadata
Compilation timestamp:
1/9/2001 3:09:05 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.10

CTPH (ssdeep):
49152:eZm4WKeGO1o6ddU+er7B3OIwLjo+vTndiHKE8DVN:eE4WK8o6ddndIwLjo+cHKEK

Entry address:
0x3F8F

Entry point:
53, FF, 15, 4C, 70, 40, 00, B3, 22, 38, 18, 74, 03, 80, C3, FE, 8A, 48, 01, 40, 33, D2, 3A, CA, 74, 0A, 3A, CB, 74, 06, 8A, 48, 01, 40, EB, F2, 38, 10, 74, 01, 40, 52, 50, 52, 52, FF, 15, 50, 70, 40, 00, 50, E8, 9E, F3, FF, FF, 50, FF, 15, 54, 70, 40, 00, 5B, C3, 8B, 44, 24, 04, 8B, 40, 3C, 05, F8, 00, 00, 00, C3, 55, 8B, EC, 51, A1, 88, 94, 40, 00, 83, 0D, 00, 93, 40, 00, FF, 56, 33, F6, 39, 35, 40, 8E, 40, 00, 89, 35, 34, 94, 40, 00, 89, 35, 84, 94, 40, 00, A3, 24, 97, 40, 00, 75, 05, E8, 9D, D2, FF, FF...
 
[+]

Packer / compiler:
WinZip, 0x32-bit SFX v8.x module

Code size:
21.5 KB (22,016 bytes)

The file gsv50w64.exe has been discovered within the following program.

Webroot SecureAnywhere  by Webroot
Publisher's description - “Webroot SecureAnywhere uses a radically new cloud-based approach to online security that protects you against the latest threats as soon as they emerge. And it does so at blazing fast speeds, typically taking two minutes or less after the initial scan of your PC.”
www.webroot.com/En_US/consumer-products-secureanywhere-complete.html
25% remove it
 
Powered by Should I Remove It?

The file gsv50w64.exe has been seen being distributed by the following 4 URLs.

https://dl-web.dropbox.com/get/Archivos para compartir/.../gsv50w64.exe

https://drive.google.com/uc?id=0B6D1voQzYJXSeDV4a1VnblFycTA&export=download

https://file.wx.qq.com/cgi-bin/.../webwxgetmedia?sender=@6b584ae7fd40e7a0c8286fc0a1a060e1&mediaid=@crypt_fa49c06a_f7e56d107b8f91352cd950abf63383e9acbe8a6512754c594d33671bc07526be1cda380cd9f06f56aaae31426fba2286c27a9409a1f06a6d263de7b2b4b4a5b6bc2f3d40669a366d646fde3d7b1111cbc179c15380f369a19fe2d728838a18d5ea89fc16335adb981c23e01329ba1c5ef7931304717c0767e1fb6a6dd5b0eff02c34faf8bf7db94d59df6771157e7a28e9b1ba9b745614414aad3b2a04ff41b8cf2211166c3441305e92face884fec8794b55116b3be762a1c57fa70c18666a7c954cfe4e46eac84db1a48dc7519791a&filename=gsv50w64.exe&fromuser=108359795&pass_ticket=j6MTyICtAQeoMU76hez5H2o1B0ldI FFgxN2sdi4jHE=&webwx_data_ticket=AQc28JgHzL28UoXAwDfflaOS

http://pages.cs.wisc.edu/~ghost/gsview/.../gsv50w64.exe

Scan gsv50w64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.