home

hss-3.42-install-e-550-plain.exe

Hotspot Shield

AnchorFree Inc

This is the downloadable installer to AnchorFree's Hotsopt Shield, an ad-supported VPN client that integrates with the browser. The free version injects ads in the web browser. The application hss-3.42-install-e-550-plain.exe by AnchorFree Inc has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the HotspotShield installer. The file has been seen being downloaded from doc-04-0c-docs.googleusercontent.com and multiple other hosts. While running, it connects to the Internet address 74-115-2-220.anchorfree.com on port 80 using the HTTP protocol.
Publisher:
AnchorFree Inc  (signed and verified)

Product:
Hotspot Shield

Version:
3.42.0.25251

MD5:
45f4e1bb4efd12f0e8b949174a198bf3

SHA-1:
88db1a764cb634be276982973f33c2b58a3311ce

SHA-256:
013311cd1942d6bf6596760cffe6672e754e9d9cce42f6f50a1a6459c3229422

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 12:00:51 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.AnchorFree.Installer.Meta (L)
16.6.10.9

File size:
7.4 MB (7,787,136 bytes)

File type:
Executable application (Win32 EXE)

Installer:
HotspotShield

Language:
Language Neutral

Digital Signature
Signed by:
AnchorFree Inc

Authority:
VeriSign, Inc.

Valid from:
4/3/2014 7:00:00 PM

Valid to:
5/26/2015 6:59:59 PM

Subject:
CN=AnchorFree Inc, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=AnchorFree Inc, L=Mountain View, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
33AB2385DD942A55035128EE9EA2B63E

File PE Metadata
Compilation timestamp:
9/9/2009 8:22:54 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
196608:34h25H5yDycvZTutMBySPHnlRH45IVnFQDign:3o25Hi9cmySHnl9lnI3n

Entry address:
0x33FF

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 70, 85, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, B8, EE, 7E, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, ED, 7E, 00, 8D, 44, 24, 38, 50, 55, 68, 6C, 85, 40, 00, FF, 15, 80, 81, 40, 00, 68, 54, 85, 40, 00, 68, C0, 6D, 7E, 00, E8, 35, 26, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, F0, 83, 00, 57, E8, 23, 26, 00, 00...
 
[+]

Entropy:
7.9969

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

The file hss-3.42-install-e-550-plain.exe has been seen being distributed by the following 34 URLs.

https://doc-04-0c-docs.googleusercontent.com/docs/securesc/82n967oo18ecec4q2d7u73ko9uglfknb/l0i74k27mpgrcsva7n5juht5mj8kucm8/1446818400000/16277925477523012925/.../0B1Gh-zMcX92gWmRNVlhISEJ0Vmc?e=download

http://www.slunecnice.cz/sw/hotspot-shield/stahnout/.../?m=31c283ffbf49aaa653b2be6b553767de&t=54d7ab99

http://www.storekom.com/.../HSS-3.42.0.25251.exe

http://cdn.completeappswindow.com/c?x=9wuWpcVFUuGyqG3LpOYll9F0i7O1sD8CKcGQe851EVU=&c=BH9Csbl1eaAwiDDj3RTK7wUeB87LSKKeqnQSMYn6Uaq8ED7wTOClrTwiUuuAKZy0q1v5r0uC1d1N MdFgQCBVw==&downloadAs=hotspot-shield-3.42.exe&fallback_url=http://pf.phpnuke.org/s/1430117478/en/8/.../84579-1801425-hotspot-shield.exe

https://fatcowfiles.s3.amazonaws.com/.../HSS-3.42-install-e-550-plain.exe

http://www.filepuma.com/file/1480454103c5936/hotspot_shield_vpn_3.42/.../0/

https://mega.nz/persistent/.../qcFEyYYT

http://cdn.completeappswindow.com/c?x=KBOgeiT 3Lq7R2vVis fFDp1IN/zX5svBCSJqdfBGzs=&c=ao322Z0SnS8U0UUUd5oGqMlkLTFHHHloHQfUAOGb8q7slTBnunngoGjfBuNGceY2vkLEqhzoKe850kK/EMa4hw==&downloadAs=hotspot-shield-3.42.exe&fallback_url=http://pf.phpnuke.org/s/1430097605/en/8/.../84579-1801425-hotspot-shield.exe

http://www.senddeliveryshare.com/WVl6OTRQVXhGVURWWWFtRnRkWHBTUzFGNldVZDZSamRJVFNVeVFrOXBNbEV6Ym1ScWRFbFlSbFpYTUc1RFp6SkNWU1V6UkNaalBYcFJlSE0zVUc1aGFtZ3pNelpGVkhKNGMwZHdXR054YW5KRFppVXlRbXhPT0Rka1ZsSTBiMjltT1d3emIyZHdhblZ4UVhGUlFrVlhOVGx3VG1sdGVEbGlRbWRDT1RGSFZIVWxNa0p4TjFweVIweENRazFZUjBkVVNHbHpSbHB3ZG1sc1RXVjZZbFpFZW1oR1VHMHlObWMzSlRKQ1lVMHlZWGxFVEhWWk5VVkdNVlpoYVdWVUptUnZkMjVzYjJGa1FYTTlTRzkwYzNCdmRDdFRhR2xsYkdRdE15NDBNaTVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtacGJuUjJZVEl1ZDJGeVpXeHBZbkpoY25rdWFXNW1ieVV5Um1Sc0pUTkdZbU1sTTBReE1qQXhNekU1SlRJMll5VXpSRkp2WTJ0NVFubDBaWE1sTWpabWFXeGxibUZ0WlNVelJFaHZkSE53YjNRbE1rSlRhR2xsYkdRdE15NDBNaTVsZUdVbE1qWnpiM1Z5WTJVbE0wUnpiM1Z5WTJVbE1qWmhhV1FsTTBSSWIzUnpjRzkwSlRKQ1UyaHBaV3hrSlRJMmNISnZaSFZqZEV0bGVTVXpSRE5sWldKd2JXMWtkM1psWkdVM2NYSTJlak16Ylcxa2NXUmpZM3BvZG5Cc0pUSTJlbFJ0Y0NVelJERT0=

http://www.storekom.com/down/.../h

https://installers.phpnuke.org/?ic_user_id=432

http://cdn.destinydreamphpcontents.com/c?x=ThI09ZyfwlUHpy/ uO2zsr0WvtTPi1QAiWYXz14Vm8U=&c=fD V7owuaaaF5Q8kj6NjS7fkXdzcSxvXcpXJsU5zX4wOblsoryTT /bYHK88UxPOQav/HyhvpxN7H6fIegVXEQ==&downloadAs=hotspot-shield-3.42.exe&fallback_url=http://pf.phpnuke.org/s/1427488460/en/8/.../84579-1801425-hotspot-shield.exe

http://www.scanwith.com/download_soft.php?d=2503&s=848

https://installers.phpnuke.org/c?x=CL1iMF7YTy1IhpLBZJfpzX6yJs1a/sPl/i24ntM/ciQ=&c=BjvmHPg41260GkxN5ilb5SOLROj/sFSOS2w2rSg2ddiQ7MsHSeeXtBghQWEJWpawc7ki6 jG7iVhDKseQsBLZA==&downloadAs=hotspot-shield-3.42.exe&fallback_url=http://pf.phpnuke.org/s/1424621301/en/8/.../84579-1801425-hotspot-shield.exe

https://mega.nz/temporary/.../qcFEyYYT

http://cdn.goodpackagescities.com/c?x=aTSw81m Dp5XXK/tXdiW4L/ Z69jGzZIoQdqdfdHfc4=&c=SaJe0H4Mxz86S5QxIfBcjkqDYh6MsRPQe/NaInYo9uUCYqk1TPIqOXUclbhszHBelbyQ1mcF7GBlfWZjNfgYpg==&downloadAs=hotspot-shield-3.42.exe&fallback_url=http://pf.phpnuke.org/s/1429779575/en/8/.../84579-1801425-hotspot-shield.exe

http://downloads.ziddu.com/downloadfiles/.../HSS-3.42-install-e-550-plain.exe

http://www.freedownloadsplace.com/Transfer/File-1/.../26867

http://cdn.goodpackagescities.com/c?x=LYe1yGMeMWvERzJniNWh86tiP6nt0yKiDS PFwyYmTU=&c=PCOGG/CXYWVuoCKBDZ6rysZRo/7Jmw2STvvVmtXM1JTraV85z8GYEbQf0/YkHazI0/OpHse/bjfBv/Z0T3epQg==&downloadAs=hotspot-shield-3.42.exe&fallback_url=http://pf.phpnuke.org/s/1429808411/en/8/.../84579-1801425-hotspot-shield.exe

http://installs.innovativesyst.com/.../HSS3.42installe550plain.exe&u={90DC18F8-714B-470B-BD00-944DA1DB26BF}

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_2_837_AJ8JDNkAABKxVKWA3ABSCBk6M 4&fid=Sent&pid=2&clean=0&appid=YahooMailNeo&ymreqid=f287ab90-d01f-a3ba-0196-62001f010000

https://mega.co.nz/temporary/.../qcFEyYYT

https://dl.dropboxusercontent.com/.../NRQzdSk333Dpj7JlRMbPl6RYYawRZCE4TXED4GHj9tVAaLGfBjSggG7VhMXfRK2v?dl=1

http://pf.phpnuke.org/s/1420112343/en/8/.../84579-1801425-hotspot-shield.exe

http://external.comss.ru/url.php?url=http://mydati.com/download/.../HSS-install-e-550-plain.exe

https://www.dropbox.com/s/.../HSS-3.42-install-e-550-plain.exe

https://installers.phpnuke.org/?ic_user_id=9237

https://onedrive.live.com/.../TM1zFmnE=1

https://installers.phpnuke.org/?ic_user_id=327

http://download.informer.com/.../hss-3.42-install-e-550-plain.exe

Latest 30 of 34 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 74-115-2-210.anchorfree.com  (74.115.2.210:80)

TCP (HTTP):
Connects to 74-115-2-220.anchorfree.com  (74.115.2.220:80)

TCP (HTTP SSL):
Connects to server-54-192-159-90.sin3.r.cloudfront.net  (54.192.159.90:443)

TCP (HTTP SSL):
Connects to server-54-192-159-47.sin3.r.cloudfront.net  (54.192.159.47:443)

TCP (HTTP):
Connects to 131.subnet180-250-66.speedy.telkom.net.id  (180.250.66.131:80)

Remove hss-3.42-install-e-550-plain.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.