» irfanview_plugins_435_setup.exe
Overview
Analysis
File Details
Programs (1)
Downloads (18)

irfanview_plugins_435_setup.exe

IrfanView Installer

Irfan Skiljan

This is a setup and installation application. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.

File name:

Publisher:

Irfan Skiljan (signed and verified)

Product:

IrfanView Installer

Version:

4.35

MD5:

4a240dc60337ceced5d5dbc4f375ca16

SHA-1:

d2c65ef987f324acd4ba56429a689f9c0160bf4e

SHA-256:

7ec2974272c8a8a45c1f9cd34562b7f4beb84b2fd3fdd0290961b85575d4d558

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

11/27/2024 3:56:08 AM UTC (today)

Scan engine

Detection

Engine version

Rising Antivirus

PE:Trojan.Win32.Generic.15201FDC!354426844

23.00.65.14316

File size:

9.9 MB (10,328,776 bytes)

Product version:

4.35

Original file name:

irfanview_plugins_435_setup.exe

File type:

Executable application (Win32 EXE)

Language:

German (Germany)

Common path:

C:\users\{user}\downloads\irfanview_plugins_435_setup.exe

Digital Signature

Signed by:

Irfan Skiljan

Authority:

COMODO CA Limited

Valid from:

7/18/2012 2:00:00 AM

Valid to:

7/19/2013 1:59:59 AM

Subject:

CN=Irfan Skiljan, O=Irfan Skiljan, POBox=PO Box 48, L=Wiener Neustadt, S=NOE, PostalCode=2700, C=AT

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

4AAD33DAFC339E45E55F11ACE347D6C8

File PE Metadata

Compilation timestamp:

11/8/2012 1:56:18 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

196608:cj1DJjpPHzTCycG1ZncDG5eOq79BHLoVR/6ksoXvf94SxXmmxyRWp+WAxsFB9:cj1D9pP9tH5cRLoWNoffxXryRUXgsH9

Entry address:

0xC3F8B0

Entry point:

60, BE, 00, A0, 66, 00, 8D, BE, 00, 70, D9, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

9.8 MB (10,313,728 bytes)

The file irfanview_plugins_435_setup.exe has been discovered within the following program.

SnapPea by Wandou Labs

The software currently distributes the app through the OpenCandy monetization platform which is known to distribute adware.

snappea.com

25% remove it

The file irfanview_plugins_435_setup.exe has been seen being distributed by the following 18 URLs.

http://gsf-cf.softonic.com/d2c/65e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36492&instance=softonic_es&type=PROGRAM&Expires=1481949460&Signature=LeIugQiPRbp4J-6oeG59SQPtjr6uSm1uiJXe~OATpcvZsL~fGP4o21cCDHMdjvgUlbZissOjtCUud4-EECIhSSGzQ0AbEtbOrVJeWRoe2Xq6VUaNt0i7G4y~J7g12xCEeqzFua242Utmjq2xn1uzQhHMVZ0Dg2qAG~fPA5K9fZs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=irfanview_plugins_435_setup.exe

http://fileforum.betanews.com/sendfile/1099412658/1/.../irfanview_plugins_435_setup.exe

http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTQ2NzI1MjAyMTtzOjI6ImlkIjtpOjk4MDg7czo0OiJmaWxlIjtzOjMxOiJpcmZhbnZpZXdfcGx1Z2luc180MzVfc2V0dXAuZXhlIjtzOjM6InVybCI7czo1NjoiaHR0cDovL3d3dy5vbGR2ZXJzaW9uLmNvbS93aW5kb3dzL2lyZmFudmlldy00LTM1LXBsdWdpbnMiO3M6NDoicGFzcyI7czozMjoiZDFlMTBmMjU2MjA3MzZkMzczMDU5NWZhZGEwZjQ4NzciO30=

http://www.djvu.com.pl/download/.../irfanview_plugins_435_setup.exe

http://global-shared-files-lw.softonic.com/d2c/65e/.../irfanview_plugins_435_setup.exe

http://gsf-cf.softonic.com/d2c/65e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36492&instance=softonic_it&type=PROGRAM&Expires=1438073861&Signature=XvuT4~tE8I-Ow1j9ofS7~lOh32RTlTkJ4zWy3YgxlYh6TyA9wUm7yN9XakNTqhkwcB4l122gH0B93R8JKoNXJZ-59d2hXJRI0oTfufJ~Ii-04ZB8ALvVrV72PoY3-A4DWfnhVZebbFYnRGFhrhI1geA4wfMamoH6koOdLWxGwp0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=irfanview_plugins_435_setup.exe

http://gsf-cf.softonic.com/d2c/65e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36492&instance=softonic_pl&type=PROGRAM&Expires=1440494676&Signature=DfIC-kyJLh5lWDs4fYyjsgHaDDhVApeuGFphGc5dJ6UGS3-2Eo3qNdGh3cskLZY85n3MzTCdF6AWz04cfhrer5EEr0yYWqN8PILtTiWJ59OaBxaO9l9YCM-nxpMibG2phVyyIeULT03jSBJ9ICcWrgX1~zyWcliP4L~uWJbWMJo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=irfanview_plugins_435_setup.exe

http://gsf-cf.softonic.com/d2c/65e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36492&instance=softonic_es&type=PROGRAM&Expires=1447653184&Signature=G5t0VIgPRW6ZfCxE1h6KeTBHt8S-yPm4GgfgLTwWytZyx3nlaQnrkzglvPxGhc7dyXmtHLcuDGXdtklN3ww~YQzffp5QQJunEaoIN-7DSzbJXY~ycJt3TeLKdy~EfSMZ12~CIhA38B-9mfWE6q-LeVB4Ns1wz3pecnPl2~2lvA4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=irfanview_plugins_435_setup.exe

http://gsf-cf.softonic.com/d2c/65e/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36492&instance=softonic_en&type=PROGRAM&Expires=1449439890&Signature=OFK95ckEESFIZPPU17MY6JIq9KC1RfDh8SnF-RsOyROZexDgzYyty3oouG0hXyXLaSINtMNMhwlHN30UJIbNrwL78yz7hDK2t423HFiQ7zjVHYiL1Wcq06famXqd28bJfEygjlWYCh3NT3zKdD-oAPQMqkWKQaPdW-iBwaG~40I_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=irfanview_plugins_435_setup.exe

http://www12.tucows.com/windows/.../irfanview_plugins_435_setup.exe

http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTQ0NTQ5MDQ3MztzOjI6ImlkIjtpOjk4MDg7czo0OiJmaWxlIjtzOjMxOiJpcmZhbnZpZXdfcGx1Z2luc180MzVfc2V0dXAuZXhlIjtzOjM6InVybCI7czo1NjoiaHR0cDovL3d3dy5vbGR2ZXJzaW9uLmNvbS93aW5kb3dzL2lyZmFudmlldy00LTM1LXBsdWdpbnMiO3M6NDoicGFzcyI7czozMjoiNjc0MzlkYmQ0MzY2NTkzNWQ0NWI5ZjNlODY0ODI2ZjAiO30=

http://download.heise.de/software/5a1c55003ef92db2d92ac34b3c3aab0c/51c09202/.../irfanview_plugins_435_setup.exe

http://files1.majorgeeks.com/files/a2ce8f1706e52936dfad516c23904e3e/.../irfanview_plugins_435_setup.exe

http://fileforum.betanews.com/sendfile/1099412658/1/.../irfanview_plugins_435_setup.exe

http://domainunion.de/.../irfanview_plugins_435_setup.exe

http://download.betanews.com/download/.../irfanview_plugins_435_setup.exe

http://irfanview.info/.../irfanview_plugins_435_setup.exe

http://lfiles3.brothersoft.com/photograph_graphics/.../irfanview_plugins_435_setup.exe

Scan irfanview_plugins_435_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.