» hss-5.2.3-install-plain-773-plain.exe
Overview
Analysis
File Details
Downloads (56)

hss-5.2.3-install-plain-773-plain.exe

Hotspot Shield

AnchorFree Inc

This is the downloadable installer to AnchorFree's Hotsopt Shield, an ad-supported VPN client that integrates with the browser. The free version injects ads in the web browser. The application hss-5.2.3-install-plain-773-plain.exe by AnchorFree Inc has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the HotspotShield installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.

File name:

Publisher:

AnchorFree Inc (signed and verified)

Product:

Hotspot Shield

Version:

5.2.3.9557

MD5:

e170af26e9be9e50ca826ef9b8c533ae

SHA-1:

b9c46bf7ba78243f998e9492ced8ae672062a06e

SHA-256:

3954ca6452d4023ba031efffb8a5a345929715d0189131bace6fe093847a1f7b

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

12/25/2024 11:42:43 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.AnchorFree.Installer.Meta (L)

16.6.10.9

File size:

12.8 MB (13,455,848 bytes)

Product version:

5.2.3.9557

File type:

Executable application (Win32 EXE)

Installer:

HotspotShield

Language:

English (United States)

Common path:

C:\users\{user}\downloads\hss-5.2.3-install-plain-773-plain.exe

Digital Signature

Signed by:

AnchorFree Inc

Authority:

VeriSign, Inc.

Valid from:

5/20/2015 8:00:00 PM

Valid to:

6/13/2016 7:59:59 PM

Subject:

CN=AnchorFree Inc, O=AnchorFree Inc, L=Menlo Park, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3DAA06F4E8BE7B2AE8FC57BA8578B7D9

File PE Metadata

Compilation timestamp:

12/27/2015 1:25:41 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

393216:TvD0tj7lmZsjHEZcorJySHnlJ6jT5GTPWqpk/dB:UDmmjkDHnr6j3/dB

Entry address:

0x327D

Entry point:

81, EC, D4, 02, 00, 00, 55, 56, 6A, 20, 33, ED, 5E, 89, 6C, 24, 0C, 68, 01, 80, 00, 00, C7, 44, 24, 0C, 00, A3, 40, 00, 89, 6C, 24, 18, FF, 15, B0, 80, 40, 00, FF, 15, AC, 80, 40, 00, 66, 3D, 06, 00, 74, 11, 55, E8, 51, 31, 00, 00, 3B, C5, 74, 07, 68, 00, 0C, 00, 00, FF, D0, 53, 57, 68, F4, A2, 40, 00, E8, CE, 30, 00, 00, 68, EC, A2, 40, 00, E8, C4, 30, 00, 00, 68, E0, A2, 40, 00, E8, BA, 30, 00, 00, 6A, 09, E8, 1F, 31, 00, 00, 6A, 07, E8, 18, 31, 00, 00, A3, 44, 8A, 7A, 00, FF, 15, 44, 80, 40, 00, 55, FF... 
[+]

Entropy:

7.9960 (probably packed)

Code size:

24.5 KB (25,088 bytes)

The file hss-5.2.3-install-plain-773-plain.exe has been seen being distributed by the following 50 URLs.

https://dw.uptodown.com/dwn/EE7_S5_zi3xaoODu___Y75JLfXPPPK7oFz4O-UjVgxVsCTjcQGhyfL4KN1ZNOHUYXJ3BDNpRQP6olJe9PCtndLuBns2WFnp_qS5GMjb6haE37JUEPLBC28L2z0MZ7yl_/Q-J3GB7ags6FSnz2QC7609obwGYVTeOzwP6dwz-f6ue5zw-KHb3dsAyDFfnmqCPPXO5mT_43Lc_-_WpZkG7HoQU1N7diZuqAaz0Ajxu3Y7vOhZWtYJeWr9gyVZ2l_exh/.../

http://dw.uptodown.com/dwn/4IogkwXSU7CrYSj65AKCTjqWGB7BmmP4z9P9-W0ZmulWLitg_r5XUlzuwvOMz_v16xgFzm0ZrJaurHO8HkYIqsc1sC1aJ_SLWuaagazJBiXS0HUpAN4Ssnmrnuhnyz5O/nOAVx3D3WkapM_LwIl81s12FR2xi7gIY2B7ZQLUUDtvoPctphiR_2bglKZQd0KBmvKts75yKChEx1oPtqJn1MglVOM0a8J0HlxQDL8U4rB9C4pAu6vw53UCaHi8vZEZa/.../

http://dw.uptodown.com/dwn/Sj3ZbBoCsAsl4VdP-nyjGZHf4-eRWYCo9RzqzftBfVdsc_hSrjTvuftBOihYJxjtIVzD9bCTjcfvqlKWs0xMQlao3ITljpwwJvD9aW9fQFAOzZprh4wahKZjVHLHLhCf/gIkOcC8PNf3BVcrxek6h83gl-y6gdrcN4N3Uj6CttV5_1btSJYgMX30nhRtvnyw7g53eQeL9zgEXNVasZLdNNqBVlhPn_x1Jvm0G1aukaIK-YCWLBa7OMmJabrZ-3ew6/.../

https://onedrive.live.com/download.aspx?cid=B53FFD1189FEF72D&authKey=!AK7BVIaSgY1gO-o&resid=B53FFD1189FEF72D!334&ithint=.exe

http://dw.uptodown.com/dwn/lxInw-iJpOQO7FjBwUWUeztVugIYg33gCjvd-Ly3A9BgbUao6GHzfxf9EJXYtxp6p3LGOPrSoL3hS7M3SbwPpJc9b1kF9MpzgEyAfQSO0U04OGoT44k-wQqf8EwHSgiB/V7AMYI9iSTHKfOtbJzZx-z-Cw9Jc1UQ2HCxo7QaQsxwbT6d8kNq4ToV6NygeUpTbUm2rsQKPOlSCx3o2HBXALcF04GC23lBoKQzEyO8KGe76BFZVsbxrW61s_8mk1WRA/.../

http://dw.uptodown.com/dwn/ei6J9xd-_nmNL1ysRJDq4E-nWF1exMzYmprZQjkZcx6GQOtvP2taCRGbXwHQSrKnaSVZ6_E9S4LbuZKWZc_jZ_KRi5uUv60vtp_ZXVJ-iIIMfsrormNabVRlqnjXoouz/ixhj2V1FPtsq5x6e0StMCrU26qgiMgIFq1oAhCzPNWgddslJSv3SBE47r6fImHoQyxBbINabBhj84qDNHhnh6IE6gSRDVejngiJQ7cM0YI7Ql0pe6AQK57soXhX3SedP/.../

http://dw.uptodown.com/dwn/53dXpnFphSFUk4VQ6STKPb489xdaWoOdxTNGMSMTOi3YJYCz1fptKdrD0TbUICVdizHIVkCCXgJtVQhDK7MAqRnhEkKbpaVj6_RE9mZMoOx322mbm3-gjtqjj1OFE_dz/dGIjJ_bYyiZJQQ6s5yXcuGZMnRmcR_g5nltW_xBdJNics04wUrrbswYrvwmS_hwTJLYJwvneb8xwhTZXEo6CQR_8-2wXBSnM5SptzULE5n1_Nw92ps5GCUgsfpRqOXTz/.../

https://onedrive.live.com/download.aspx?cid=B53FFD1189FEF72D&authKey=!AK7BVIaSgY1gO-o&resid=B53FFD1189FEF72D!334&canary=UxTd4lTXVSIbOrWbPWyNNDuoGEdftldca1yuSK4mG1A=9&ithint=.exe

http://dw.uptodown.com/dwn/KKgPhYoXoKdCPb-G07tHGvrhESnclS6aGAwejE9Dv_UbWU4eq1f95Q0c-JQix9w_Tok5Zt0DE6CrkHEdjtuJOLf3VDPzmsJizH8vQ-v_0gBIfEax-xrATkQOk93phk27/o6th-InZ0ra5Rw-3rjIE8ouG_AL335Qs1vN6EhaFvX4uzmMK0Yd7fEok5eoJ2BTHqG5FBBCb4SHMA5bG9UJ21Hy4bnBsdYA0dsRRLbhn3JPUo2jUqePu4wjfuYfrcMLT/.../

http://dw.uptodown.com/dwn/owiq5sAsd0g3qETCLoRnA6nYcEATuNDX0J3T1d5IFYTy9hkmITCYOcNOk7g_iyV7PBW9EQmv5FFmBRxBNehfVffOrqErVWTkfbGY_iBRcZr3FdOnvJd6U9qyZdweGlOY/KEmfAE4V9ZNFzKBz1GBpq2tN9ueNCk-yp-sm9vO8Qaa5iRkYYqMiNr-33ze26PtadJF_YulBD3G6VrifIUQ6T-wb0sPOXzLGpQTP8FgCBzuW4anaNvR8XwLX1PjTgyvQ/.../

http://dw.uptodown.com/dwn/6K0BhREYMSdZRzjhhlDE2aFk0OtMfoyHChSBcFCN5xpLrjih8Y6DJbdue_LQ5oW32qp1q9aG1oDphJHKdbdOzTpzPEylyLdo74lHGnsoPEUn3rvu56r_1UikjjvU_6wE/2Hl8vxEYb7CJSyxhr7Yr72BGvr055U_lcOmY1ETflnKdshaGSBJFal1089oV4UBO-zvntDkt_CKFqwKNYUkEA99UXzKWjGvpPd9Xh4JRVsKmpCt4B0FA_lPqZ8WAs9Wm/.../

http://dw.uptodown.com/dwn/pp_sfdCEB2Yj5P4iJztBQzJKJyUke5dmcsbjQ6gaCJAC-9IkAKZSHarB4NEUvZU14Z4X2u5KVPc1tXEfoBlrn70zsP8oH6pmIhb38zqomimZ7K-nafQ-s0u6LENNq7Rm/kjFXy6FJcre6AVza_Xa_qywXfxRFCuIAqxjocmIbn-wpqh894GwcUoKIrU_g847Fu5Uz5KTHHmw9lsb2mBAYU2aJADcFypK-YDoC48Htj-cOYo0zlztS2wpfJ0yIEnda/.../

http://dw.uptodown.com/dwn/GHq34PHCIP_yssQjsVVH624LXbPBvo3RT5Pui5Og3HUcmcM423XkryICiiTejbzoMrfFapPvK1QEoMx2izlMLCLeDriOuea3xLf-d91LFHDoAwNfy1NjmB8Awx401lJW/UPtqYaZ0ykjbW_pTnfBWtteGhgiS38lUPUXjQPauxKKODo4yai0bbcrVD_aHInwdgs1zR5XFsl0AqU8r1LNR45yM2teLXFfx_10i50m5PqPY_9n56iNgOegS-uYNrOuw/.../

https://dw.uptodown.com/dwn/5kEBYypwupBy7Ms2rFd4J4GxaxXfhnHI9XViWjMPaChpz0ZRM88x19hHZrdpJNHZmAQSwqQuiNVvrobOIo34bmDNOwC6W5j_ss8kDl45QhnonJeAh09DSdWZDIoIG70c/QVlBML5dveYg9sWgK5ZqwDXMnNjYdCaS8FM6HpHKZHu0zL729-azaqWzqugA5TAainOcUHTCIV_nnzYQG4t6pq0T6TCBHw9X701lAQDMn-kW8rUxQeVhpBvB76xH-ecN/7CdJT794bTaEAdy4lt5_EMO26kbvZQ9HZswyNtWIV0xj6KdmrGtet_gWU14sux7Mvxl0o26xiaEhTVTHinGSwRckdN3a1sI09Kd0RPjbeuUSBfwzEPn_jidqZyECuhKq/.../

https://onedrive.live.com/.../Uu1 sM=1&ithint=.exe

http://dw.uptodown.com/dwn/-c4nGo2iWgSuNKGkUif8OCBRyK1DnPe7Bxsw8RzO6ioRluPKmOvzKppnYw7rYpQI7zLkfyMvNoKmfuxwoZwlwld3g4cIMt9saucV-zwlVgTTg-YLP4AUX5vtCB0CHcdx/qyC1pE6yg3Qe5mYPFtik6lQMaV3okVtxwxjOQRymr-QwLxpL2F8Xn7FoSQP_RVq2Nky57Up2-WUNze_C2z3nYzna5iuHe3GnkBcSScLddncz98HBpDTOBxJq9L4enxT4/.../

http://dw.uptodown.com/dwn/lKvAuAUdKjFzr_QW1sQ6ODWxpY6ydtj1vhlmQVBm-plMOpFcesWz1qXvv6hMsO2t3kQZQaQEPvRcelVWLvpUz09jN3VYATwb_f8zhVzgm4COnBtA43KlGbaziON8FhUS/FUUvhAdJR3W5GBLhf730YlN0bIaPet2zGiDqeHdZtucuEupxfA7IKKuflIDyksXG-lKOgvzqhr4lYUUeaIVRTl16nwpsn3_ISNWpLgQMKHRSIxp_Z8B82j7mB9UZ0mOU/.../

https://onedrive.live.com/.../zvkDpMzO2Xr1paau4zchlh4WI=9&ithint=.exe

https://mega.nz/temporary/.../MItBmQbQ

temp:HSS-5.2.3-install-plain-773-plain-1.exe

http://indir.gezginler.net/i/15284/.../

https://dw.uptodown.com/dwn/Xi7ZCzeTITDcCUONjX-ye4ihhRY5sfYccjymiBN-8D5lIXCflx94Y-k730sGPxXirMfbxpCuKSk8mPb3TMomMYAIEB3ttRLcUn_WeKI9OEn5yXdo9szHVTKWHl5oKFPa/cX9PVPFkGndrXX2Mk02vbHbtn72JTLevFQe8DPjavkYgsfUDtnYBdJikzxn9HS3-Mid9WWaUT881ZyiYoEUU5w_KOFCB16fZ2rO9Qv73lVJpcLoHKR3V35EiVP5W5E0w/.../

http://dw.uptodown.com/dwn/tnHruyt_FtGzC5QTIJ2mWwVZV8VeBC8CXx5hf_2JH-nSdIGHLVoKVMD6AybKC331VCG2d3HVYmnR8Di4ABrF_mBg4Tdl9NqvrN-ZaHd1rbII5K2j_GYDCl3bMRLGPXxf/G2s-ULdNhNJvTPTiXX5qu2okMPxROlHRoDnuiMFEfNUeOj7uFqAK-fpNZvcjcQAfAOKAc0CC3eodwnAvurMhL0w97Ew26SEc6ZvxM65BzNcloa9IxgC5MFkZZ2K4rO9G/.../

https://dw.uptodown.com/dwn/X9kZTArrla8fCmwfJIMKRz6qRUNxDipKreCeDMnS8NkPDIEDVC1tbZbbWJSmvTHZjhtWKynN7GAKrCFDsDqLTyvC3GA1wiD70pFRr6tjalaDkKAQOlR9vyvJA2v1IjFk/NP6t9qtkzDOQely44ZQIrkK2Qvcv2813Vwt40YOFR_0LgEqg4hSZTWvFRliU0PuwxGVezsU7G4od1xI_len7k1cRG0MjRFnv_Hiqg6E6GMy7CRXszIKiGvaHc3dLPxIZ/.../

http://customer45464.musvc2.net/.../t?q=3=4V5V4&C=2&D=2V5&E=6Y4Y7R6&K=hKuF_rrTp_32_sqSq_36_rrTp_27nOd2u9.cFn_HQtQ_Rf_IRsP_Sg4oNoBo2e_HQtQ_Rf9tI-w0oR_rrTp_27I1a2bsS-X8S.eOf&4=mLtLcS.o5t

http://dw.uptodown.com/dwn/3PBPkClwInnTsb95HM2QsaynM1HKcX6fv-YFzG4Dw7r9R6fbX8BqniCaAX67INMy_o5Sru5ckMVQEWGVvi_1aIn1SK_CbvOpYs2QPHq76-6rBcC8NZ2j9_GQT3fAuwwH/aDkbNvW9djnhQnBg3hs6owyLmzyXMvHWFKwTKxzNndNsXo3HcS_Yipuu3CPUwVR8wSIsgPdoPT2BRNnN4O0RkFr8-h-p03Yf93JNw6BhqPIaM5N1v1wNTr5-boYtPDnl/.../

http://dw.uptodown.com/dwn/YSR3c8H_bHbXBp4TILJZnbCVselKZkLs_0Bvzs2mgu7LpzX6erXDuViMYUX4auAuC0AcS21uX9PyrbdhJGoeHCOkpXw-20oxHaYN6obZ0836nFTYNprJW5HgyTfcWswO/bAsiKpSPU_oR-E39dIquWF-QD-8kOI_3mTwRGd0nPd0_w7LCNkw4A4NH2pTIZn4dUKr5r13J8Cfhk4COq2kl3cXjJfUYh55RYWQxYK_OVsM6HpNdM_9HKDw-JyrX-tVG/.../

http://dw.uptodown.com/dwn/DbEhK1qyXTXt4RNOmirasxX3eS3kOAcpQZqMwIl8hC-fQcxL7fWC0-S-yLXIOhHX8M2h5uiG2L058UNZayk0FA2XwbaQMfHTqFaeJkTCiLpSi2wx0NIO8jMzboC_g0hU/KfyUTngMEmg_veUpOc-qpzZ6NW1qqc-r27xjkbkxpdEYTFSiQF1kt5OWAREfBv84FdlxQEA5XUavmnyhUjz9DqhE7v_CzRr3tEyAinDU43pdp5MfQP7GNarh2Veld5y2/.../

http://dw.uptodown.com/dwn/vXSTWl1ePV4zlNbwxvv3bkssZJ3DG9RqHwuY6Bg1fw7qOdTMsphce7psyRpbed_chVqOpveA25nEbljN2M6vmXpiNaiVDL2IQQ4yYIFvhNeJH2ZqfBKAZsfZZ9MusWNT/uodruSnyGtiFKjL_PocWopT_-9Mah2RxlhjwFVTACXnmLsAVBcpRk4TF5OQ4M1zAQnzs_F-YoZl7zSMgOmoxEGKewcVRJUWBvJIw8njAyZlCKpg440xhFGQT5KSuDvyJ/.../

http://dw12.uptodown.com/dwn/8ACrBGS3dRh_OwPg-dOqM-xZzRAR0LC365GWwb6d2tyrfS41nz83m-LhkcF2QK3hc878yT9XVzKsWS072Z6mnM9Hzsnhhvg1UInPfl0pyNlWJAuR7F2i-dACDgaNcrNc/0xkhtQoApppcZmrK5MOXNEVcs43RSRnllnlpQeVlfghn-zF1B2NpvQYbHc4wOu2hXb6kepXs1td1iwRyJj-4WuAte2sUN5jE3penyRHpReUlCcHVJRYs_znojurrp-Hj/.../hotspot-shield-5-2-3.exe

Latest 30 of 56 download URLs

Remove hss-5.2.3-install-plain-773-plain.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.