» hss-5.1.3-install-plain-701-plain.exe
Overview
Analysis
File Details
Downloads (21)

hss-5.1.3-install-plain-701-plain.exe

Hotspot Shield

AnchorFree Inc

This is the downloadable installer to AnchorFree's Hotsopt Shield, an ad-supported VPN client that integrates with the browser. The free version injects ads in the web browser. The application hss-5.1.3-install-plain-701-plain.exe by AnchorFree Inc has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the HotspotShield installer. The file has been seen being downloaded from fs32.filehippo.com and multiple other hosts.

File name:

Publisher:

AnchorFree Inc (signed and verified)

Product:

Hotspot Shield

Version:

5.1.3.9460

MD5:

e8faaa8dc2d891d2a41dd6e5157421db

SHA-1:

2fac6c08b2be8b1d7235a48bbfdfe41969ed740f

SHA-256:

20953369859ae28d3a8f21e681cd27d2c3e37e3cfe2601e7b8e105e7333786eb

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/15/2024 5:48:42 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.AnchorFree.Installer.Meta (L)

16.6.29.9

File size:

13.6 MB (14,213,688 bytes)

Product version:

5.1.3.9460

File type:

Executable application (Win32 EXE)

Installer:

HotspotShield

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\hss-5.1.3-install-plain-701-plain.exe

Digital Signature

Signed by:

AnchorFree Inc

Authority:

VeriSign, Inc.

Valid from:

5/20/2015 8:00:00 PM

Valid to:

6/13/2016 7:59:59 PM

Subject:

CN=AnchorFree Inc, O=AnchorFree Inc, L=Menlo Park, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3DAA06F4E8BE7B2AE8FC57BA8578B7D9

File PE Metadata

Compilation timestamp:

2/24/2012 2:19:43 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

393216:A4qbH1V2oVBJySHnlJ++S8s6MaIodY97xNZ:A4E1V2oV1HnrxLsXiYtZ

Entry address:

0x3899

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, D8, 16, 7F, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, F0, 15, 7F, 00, 8D, 44, 24, 38, 50, 55, 68, 64, 92, 40, 00, FF, 15, 84, 81, 40, 00, 68, 4C, 92, 40, 00, 68, E0, 95, 7E, 00, E8, 18, 27, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, 20, 84, 00, 57, E8, 06, 27, 00, 00... 
[+]

Entropy:

7.9953

Packer / compiler:

Nullsoft install system v2.x

Code size:

28 KB (28,672 bytes)

The file hss-5.1.3-install-plain-701-plain.exe has been seen being distributed by the following 21 URLs.

http://fs32.filehippo.com/3031/.../HSS-701.exe

http://filehippo.com/download/file/.../

http://www.filehorse.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.jsoftj.com/files/.../jsoftj.com_HSS-5.1.3-install-plain-701-plain_jsoftj.com.exe

http://filehippo.com/download/file/.../

http://www.sendbulkfactory.com/c?x=9hM6IkdYu8F/Xc0VfErKM0yGmjgwkIp1MAStd2TQG38=&c=XDvJ7DMH1350bSBoniOjQn6Gh/gXNjv5rSes/v9tE50ItE2D329u73n0JgbSdO3C1v eYmX3RVWoMD8hRmXfqs9AIxKaYtvqFrx0fY9Jk4mT3HLvtKzmYoP5TsVmzRHP SvWgAvcLquURXgr4Idk w==&downloadAs=Hotspot Shield Downloader - JalanTikus.exe&fallback_url=http://files.jalantikus.com/dde/833/.../HSS-701.exe

http://filehippo.com/download/file/.../

https://jalantikus.com/apps/download/.../

http://filehippo.com/download/file/.../

https://eu4.proxysite.com/process.php?d=joV9vUeUG1Bbl9vQG1Tcg4tCOGwOhmRzqoqxySaO8/.../V5rkR8CKW2tRb3NvkKZglB06IrVrlf5C3m8c&b=2

http://fs32.filehippo.com/9285/.../HSS-701.exe

http://filehippo.com/download/file/.../

http://mydati.com//download/.../HSS-701.exe

Remove hss-5.1.3-install-plain-701-plain.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.