home

imagetopdf_setup.exe

Image To PDF

Ye Yizhou

The application imagetopdf_setup.exe, “Image To PDF Setup ” by Ye Yizhou has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from it.softonic.com and multiple other hosts.
Publisher:
zxt2007.com   (signed by Ye Yizhou)

Product:
Image To PDF

Description:
Image To PDF Setup

Version:
1.7.2.0

MD5:
61d42f6861637363bc4bcc5dc55a8477

SHA-1:
bcfbb54741766eae4aaf51355e8f42c5f89653a1

SHA-256:
d9d87f08978cbaeee5220d1907cc02e80635c7f6a2e13e0f6599973f403d452b

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 7:34:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Bundler.YeYizhou.Installer.Meta (M)
16.7.8.10

File size:
1.5 MB (1,596,536 bytes)

Product version:
1.7.2.0

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\imagetopdf_setup.exe

Digital Signature
Signed by:
Ye Yizhou

Authority:
WoSign CA Limited

Valid from:
9/7/2015 6:00:33 AM

Valid to:
9/7/2016 6:00:33 AM

Subject:
CN=Ye Yizhou, L=Longyou, S=Zhejiang, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA G2, O=WoSign CA Limited, C=CN

Serial number:
304E7576E2082A9B6E87C0FFCC4B397C

File PE Metadata
Compilation timestamp:
7/16/2015 4:24:20 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:5xG69ZR0RWxUunjQe7CdzYnIqIIKrXCXH0aY/bRjZp0DIGbCHoJrfRaBF:SpGUujQe7CF9qf+CXKKMGeMRaX

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 34, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 1E, D8, FF, FF, E8, 6D, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 33, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 54, 86...
 
[+]

Entropy:
7.9453

Developed / compiled with:
Microsoft Visual C++

Code size:
63.5 KB (65,024 bytes)

The file imagetopdf_setup.exe has been seen being distributed by the following 10 URLs.

http://it.softonic.com/sads/tracker.php?ev=c&co=IT&sid=6af86f6fc31d7b944eb2de2357fb367f&upv=765bd7250ccb6edb87552035315d58f2&z=results&sk=0&abp=1&params=F24F8F4D368AFA5D32C8A90D9EFD1CBA43C7E30966742A4FB50C7DC03389F3D5C8E2E2E734D8EFD61CB0A5BA3C519DE31144352209D3FB693F040AE59D679D6B4EF4F05E420BBC23EA5ECD526F1A44B1DED782B64E90F0211CD5380760EC5D7C72746D3779C57AB35F4C63F4D2BC643EF33522EF2470FCD3A836C306904AC9B5A19842C75777924C305308B53BA78291F5F1ED20E16520FDCA45B1D9DD470D63&h=121DBBCBE65AFF10F60C7A07AF9324AB546F14492ABD124D98D66A696580B3D3&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=MX&sid=93935964c68bb814d6695771b5f42384&upv=422caeb2c6c4b25eff7ebca837698ca1&z=download-cpd&sk=116&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAE1A16743FECF3EECEB4DC3D7B3E7AEFBFA71E9A0D9035C53B495FCB861A6DC99005D447149E9F659C52047E46BF546692E85A8CD5B5BA73227DF1205BCEAB307ADA5BFBB5D5D105BABB47B56572901DA28414DF5E1A26E044A71451FB79185C12F2CE464B281DBA4F601E88597EE3131CA8D10F7894D9391C243E6ACB9AC9308E537BA226612B619141733884690C32A&h=FC219CD7AA88A54BC8995DA1B711583344D99FF21E877A148F57E0F801794CF2&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=PH&sid=272fb6e932aafac719536d02f1bd83da&upv=6a7d06c99ace95d9f93e894c2871aeaa&z=download-cpd&sk=121&abp=0&params=F39B2A32BFC101987B1458170C278E03C04C00EB1B518730AEF2A76D81F9E01647F9CE130805BBEDEB53700AA0216B4761B3427C83D2A2A3AB5BB0A2925E88966C851E1A128F8894FAD9664321DC732496CB99CAA213B36D066251EAA0B1DFFB25E9C00372FFC9127B241270F4411BFA953D3F34E8F4AF11464E5CEE6697F1F0BC3452E1B4F58588E3F6A0EF28F6AB6659CDD1B0F9477EF9083B3A7D0A4A1CA9&h=CCA609494D3BDC3E24CC94998A2B0FB4DDB41A74C9B81756B8587E05104EDEAE&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://image-to-pdf.softonic.com/descargar

http://t2.softonicads.com/tracker.php?ev=c&co=FR&sid=28e2aae5a8b4c38d7f85a868f17adb00&upv=b56d93bd24e17f09ec39a53a8eb3a44e&z=pp_warning&sk=124&abp=0&params=F39B2A32BFC101987B1458170C278E03C04C00EB1B518730AEF2A76D81F9E01647F9CE130805BBEDEB53700AA0216B4743DE058D80313CD054FD1739071BD6205214A55F7E239133FDBFE79BBB88F3EDABC374FC1E48AF1026781508FC7CFC94B83FC98E0F5BDE7E6D3317ED4EF2F25C022BB09016AC6212857F7EBBAB96199504919FC80477129A5EFEF87F675493077D27FD619F37C81B5C05B611E08DA509&h=905EEA21EBB7372C4BF22D63D45F0C2A7C89A57D984974193AFFD8977D13E856&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://en.zxt2007.com/.../imagetopdf_setup.exe

http://image-to-pdf.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAPm/eURI0r2 Z1Ex4HTkguiuZyHJud643DM7EmpZq9imbect25BwYv5 8B6DmB31WczN1si2Sv/Xa/.../QGf5VM6mYNPAYP8=

http://en.softonic.com/sads/tracker.php?ev=c&co=ID&sid=b7f1492fe075ca45ce3882ec4aa1c5f3&upv=9d50b2a01605a5b905b4bac587d0ce92&z=download-cpd&sk=121&abp=0&params=F39B2A32BFC101987B1458170C278E03C04C00EB1B518730AEF2A76D81F9E01647F9CE130805BBEDEB53700AA0216B4761B3427C83D2A2A3AB5BB0A2925E88963236284CA31E244CBEEFAFDC29ABE38DAF0ADD379A12363B4AEA5FFF3C0BEBBC53364AA356C1C1E14A109D9F1572F5851A665DC829C18DB5EC9C4278BB6C3C6E5BA3E61227E75266864B9A750F98DB529AA68578928729D349CC803D04C761E3&h=B160800FEC9753652A7888FDD22051AC1B5BC8AD4C62803C5F3300DC7591B36D&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=AR&sid=5d8b1d2a2ae97bef636dfed4fb45ef0f&upv=e6f44c10561def46e6f9a9b4471761bc&z=download-cpd&sk=124&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAE1A16743FECF3EECEB4DC3D7B3E7AEFBFA71E9A0D9035C53B495FCB861A6DC990ECD7B0CE755F930EE66F18F52A77547BF9B0BECFE0027C00EAE355A688021E2EE8CF0F79A3D7262FD7F530A5634120A497D4A8F2DC9C0FFE73E5C05FDC5AF22E29252E248D97D0E391857822CB76D54284107E93FA077581067C5182476B41625CAE36E1CF959B759D9D39A55A9447D&h=A9DC62D70D175BD796BF4A7AD57BD51D897A09795D6C5FE7A118DFF1EBB1667B&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=IN&sid=1d467f86bb575232d54e883460e625b5&upv=969f2b18228bc344742aa2dbf6fde180&z=download-cpd&sk=126&abp=0&params=F39B2A32BFC101987B1458170C278E03C04C00EB1B518730AEF2A76D81F9E01647F9CE130805BBEDEB53700AA0216B47BF197649A63E9B4895864D8BF50020D5CE2BC7497343D2B38176E5A10704D416ECB300DC1E5B8DB0D17388F20BE97DBB2C4F1B993307D8D8071E6AF8E5B0FFAD9B9099738C12B0C9379D84C0DBD542AF1E703F7FCDB255A9B7B506151371DDB32C362350E60927E22D826CE75BD60CA3&h=7F6207DC1B666C1F79A7E6A073E7315BB1AE621EA0AC6B541F63D7F0ADF53B92&directdownload=1&f=3346679&d=http://en.zxt2007.com/.../imagetopdf_setup.exe

Remove imagetopdf_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.