home

kanevasetup.exe

Kaneva, Inc.

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from cdn1.kaneva.net and multiple other hosts.
Publisher:
Kaneva, Inc.  (signed and verified)

MD5:
0b7cd80b21a2ac4e98778a4382e6ff34

SHA-1:
aae8ae4b329a107ec4f3ffdaf3cf5c97815dbaf6

SHA-256:
bdb0fde7eb4bbf4917827b32a2204c9f2d63b73b366b7d56417308b5cf86f089

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 7:31:47 PM UTC  (today)

File size:
16.8 MB (17,650,256 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\kanevasetup.exe

Digital Signature
Signed by:
Kaneva, Inc.

Authority:
VeriSign, Inc.

Valid from:
11/2/2014 6:00:00 PM

Valid to:
2/1/2017 5:59:59 PM

Subject:
CN="Kaneva, Inc.", O="Kaneva, Inc.", L=Atlanta, S=Georgia, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3CEB4FC1C8935C6A90964DA6D0CBB2F5

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
393216:Qd2HdFYBup2l6FYnw0ZLU6x/Wvqnesi+mgdJGPN6vAF4qd05u:ykFlp2Pw0ZLU6xoZsZZdJGkAmqdCu

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9995

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file kanevasetup.exe has been seen being distributed by the following 8 URLs.

http://cdn1.kaneva.net/patchdata/cdn/installer/.../KanevaSetup.exe

http://alphapatcher.kaneva.com/.../WorldofKanevaSetup.exe

http://ultradownloads.com.br/.../2,242548.html

http://www.ranchsendgift.com/98MH7YUsRwbRU1T vXEj7Vug2QwgIPEaGSzaR6pzXs5Jt 8ia_U8tDI8Ve6i1Dymkqg Z75WWWcUKqoWUlE eICvnAYOq7vqtogwCQMDuJpplEV8i8gVU8n8w8hQKG9a0AL4zXL8gakPkI3EEsTexMUIHUby2ECMjP xfsDramAShouSOpJT9Yy1bLitUgv5rNGSYjLmkocDIyv2vaf9h7mo35qaZg==-Gz4AAATKbbFtpaxZBEP6cBZBRaYIDjlw JJAIyukwENWyiVmOq0xAdLP5djQ5MmWK75Qys8aZPWidyPvNj4=

http://world-of-kaneva.software.informer.com/.../

http://patch.kaneva.com/patchdata/cdn/installer/.../KanevaSetup.exe

http://cdn3.kaneva.net/patchdata/cdn/installer/.../KanevaSetup.exe

http://cdn3.kaneva.net/patchdata/cdn/installer/.../KanevaSetup.exe

Scan kanevasetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.