home

imagetopdf_setup.exe

Image To PDF

Ye Yizhou

The application imagetopdf_setup.exe, “Image To PDF Setup ” by Ye Yizhou has been detected as a potentially unwanted program by 3 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www.softonic.com and multiple other hosts.
Publisher:
zxt2007.com   (signed by Ye Yizhou)

Product:
Image To PDF

Description:
Image To PDF Setup

Version:
1.7.2.0

MD5:
7072957fd6bb69ab94c668e5cbc10f3d

SHA-1:
6f06e463501145d20b367199429ca5d2edbf0823

SHA-256:
7beea00c75557baf1acd4364834bfb367710ed7b8e0ebdcb66a9e57338084bec

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
12/27/2024 2:38:13 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Adware.Agent.NQE application
8.0.319.0

Reason Heuristics
Adware.Bundler.YeYizhou.Installer.Meta (M)
16.7.8.10

Zillya! Antivirus
Trojan.DelFileCRTD.Win32.1507
2.0.0.2919

File size:
1.5 MB (1,596,608 bytes)

Product version:
1.7.2.0

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\imagetopdf_setup.exe

Digital Signature
Signed by:
Ye Yizhou

Authority:
WoSign CA Limited

Valid from:
9/7/2015 8:30:33 AM

Valid to:
9/7/2016 8:30:33 AM

Subject:
CN=Ye Yizhou, L=Longyou, S=Zhejiang, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA G2, O=WoSign CA Limited, C=CN

Serial number:
304E7576E2082A9B6E87C0FFCC4B397C

File PE Metadata
Compilation timestamp:
7/16/2015 6:54:20 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:qxGl9ZR0RWxUunjQe7CdzYnIqIIKrXCXH0anyvjZp0DIGbCHoJrfRaB2:PwGUujQe7CF9qf+CXYKMGeMRaY

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 34, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 1E, D8, FF, FF, E8, 6D, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 33, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 54, 86...
 
[+]

Entropy:
7.9452

Developed / compiled with:
Microsoft Visual C++

Code size:
63.5 KB (65,024 bytes)

The file imagetopdf_setup.exe has been seen being distributed by the following 6 URLs.

http://www.softonic.com/sads/tracker.php?ev=c&co=AR&sid=a43682bc3d6d911f9af051a189b057ab&upv=4de7239b5a918ecdb50785a67089632b&z=download-cpd&sk=136&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAE1A16743FECF3EECEB4DC3D7B3E7AEFBFA71E9A0D9035C53B495FCB861A6DC99005D447149E9F659C52047E46BF5466905B013DF48ED4EF9AFB3AE14CF4829DBD71151156C3D5490CCC54EDB0DA5DCB48C497CB5BB380F295DE813C93D6420E468E4CF28D0F60B9B10801AF4FCE20568362BBE7E8550F9289341B616CA58E5272184966EF49D96367A94C0655AEC4B57&h=810DF53CC2F5CCFF8A63FAB1D61E937AC9228497D9A520A43938FF20A532BBCA&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://en.zxt2007.com/.../imagetopdf_setup.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=AR&sid=b82fc21bbfbff4d5d1155e86b7046bdc&upv=be42d33b779d31dc07aa897cd2b507dc&z=download-cpd&sk=145&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAE1A16743FECF3EECEB4DC3D7B3E7AEFBFA71E9A0D9035C53B495FCB861A6DC99005D447149E9F659C52047E46BF54669FFB0EF438D9F51828ADF43CCE9E21C5624044C4C722EF3BFEE7A6B8A575C0FAF41A1E89BD7992AF6D462C29C391B3C21169B632FBEF5BA8D6BE669E479F613A979F2FFE898BED34B7AE8DBE55F90ED76E87C55A24338A5FEB0B57B48025E89B0&h=12246CFB723EE1888A97D42185B1670913475CEA2784E114297210276A525EF5&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=IN&sid=e4dcf900e328907aff2c9d6f7551002b&upv=6cde4b1d07146fd7e4de2633fe748fda&z=download-cpd&sk=117&abp=0&params=F39B2A32BFC101987B1458170C278E03C04C00EB1B518730AEF2A76D81F9E01647F9CE130805BBEDEB53700AA0216B4761B3427C83D2A2A3AB5BB0A2925E88966C851E1A128F8894FAD9664321DC73240282DA6EE0BDC2D325B48E5E7D937FAD40DB8B8834A4A5245B1C115A830C08B35B26AD31D79882558D2A69D4ED5E92C5285BB5EC3A199CE5C2D01237631278DBB459AD9EE4CE7AAB57D74DC2526E7DE3&h=A40DD6E618A297B38DEEA52E99BD8892F04214A263BABA9DDAA03D47E85AFF6F&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=ID&sid=d2802fdda43f4e8d5742fc66d7ae3096&upv=4fb0b6abc0355b0555a2d325a1bb07f9&z=download-cpd&sk=124&abp=0&params=F39B2A32BFC101987B1458170C278E03C04C00EB1B518730AEF2A76D81F9E01647F9CE130805BBEDEB53700AA0216B4761B3427C83D2A2A3AB5BB0A2925E88966C851E1A128F8894FAD9664321DC732487B67715652126C436138BE5D9084F03C85BBA172E6E3517C6B80796AF059787C78D4DD8DAF2612F4BD669F5BA8F4055477834213CB23B46539767D8D17A8D4863166454A82FA25C388D27A3E63DA995&h=141DAF5A5C2945CE9EFCCD24C620689B6206A1AA3E52493C405D58F3EBAC54EB&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=MY&sid=07c52ae20d793a6fc5c225d84cc7b007&upv=e46a7e670176ed84698db130e19d9e2d&z=download-cpd&sk=144&abp=0&params=F39B2A32BFC101987B1458170C278E03C04C00EB1B518730AEF2A76D81F9E01647F9CE130805BBEDEB53700AA0216B4761B3427C83D2A2A3AB5BB0A2925E88964B597C0DCBA05720DF045814EF472AF49906419764705CEDFE5D55E89C5BE74242BEDC672E1A9A80FDD0C253597D636477F437AD841522B6E9AAA118B09165E9ECA46A2540B16EA7316E56A3F0564723B7DE3BF9771FCC2A6B1BF44BBF1B40D5&h=AC0385CC029F138C8F4FBD553D5134AD5B0F5A5A1911C3104C9B0E571DC503CD&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

Remove imagetopdf_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.