home

mkvtoolnix-64bit-8.5.1-setup.exe

MKVToolNix

Moritz Bunkus

The executable mkvtoolnix-64bit-8.5.1-setup.exe has been detected as malware by 1 anti-virus scanner. The program is a setup application that uses the Nullsoft Install System installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from dl.cdn.chip.de and multiple other hosts.
Publisher:
Moritz Bunkus

Product:
MKVToolNix

Description:
MKVToolNix 8.5.1

Version:
8.5.1

MD5:
f1c712b54b87bbaa3d075efc433e5a0a

SHA-1:
6dd0e8440526f9c486dd00f6c02e0578d3b25251

SHA-256:
60d51e18f8cadefc76fbeeca86864d7027ccea69f57e95939d5ee523f80ac63e

Scanner detections:
1 / 68

Status:
Malware

Explanation:
This is part of the Crossrider Internet browser extension framework which may modify the user's web browser settings including changing the home and search pages.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application.

Analysis date:
12/26/2024 4:09:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.12.7.10

File size:
13.7 MB (14,314,733 bytes)

Product version:
8.5.1

Copyright:
Moritz Bunkus https://www.bunkus.org/videotools/mkvtoolnix/

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Language:
English (United States)

Common path:
C:\users\{user}\downloads\mkvtoolnix-64bit-8.5.1-setup.exe

File PE Metadata
Compilation timestamp:
4/30/2015 9:33:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:2OD14sCfKJp/lLPeX3ipCyX96uqtlVAwmmbA:2OD14sQQi3OCyXYhlVAGbA

Entry address:
0x4377

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, D3, 42, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, D4, 42, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, D4, 42, 00, 56, A3, 30, BD, 42, 00, C7, 04, 24, 08, 00, 00, 00, E8, 81, 3C, 00, 00, A3, 00, BE, 42, 00, 57, 8D, 85, 88, FE, FF, FF, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, D4, 42, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Code size:
34.5 KB (35,328 bytes)

The file mkvtoolnix-64bit-8.5.1-setup.exe has been seen being distributed by the following 14 URLs.

http://dl.cdn.chip.de/downloads/.../mkvtoolnix-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1446634986;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/d4552b992cd41588a7426c11732bbac3b17b084bd62e4e4cca00aac497a96b7a/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1445589455;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/42b5ad449f144e8e531900a12cd6cb146c8bc4af981b1f994fc642879bc483e0/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1446082751;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/1e673892dfaf2051076c0e6b16e711436c866b94267585c8ce46999b10c57136/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1446610816;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/440d12315dbd01eec4baa3b9308d4990b3452720738316678a305ddc5fb48cf4/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1446577468;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/4861d54ede772b182fbd1badba2b465b09fc4224dec70053b069ab7c5d8c8605/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://mkvtoolnix.software.informer.com/.../

http://download.softpedia.ro/dl/d7b20108fe61caa43772a58f04349fa4/56387ddf/100043981/software/MULTIMEDIA/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1445506295;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/0822e659696f9f4871153182a9c890b5f843d6577c09e3792b33f3b8bf15914f/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1446636817;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/c26535f1b71ca44abf3ed802d16abe14eb7bb003799fb7e9eab4838788000d3c/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1446646045;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/5c9f1b857955893d1ee6225dc130b6f7085d456c1d7186c379e3f79965ec8ba1/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1446399419;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/c8b11e41a6d6d41c41beab32c5efbabc5562834647c293f3f8eb4e9093114d88/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://www.videohelp.com/.../mkvtoolnix-64bit-8.5.1-setup.exe

http://download.fosshub.com/Protected/expiretime=1445714333;badurl=aHR0cDovL3d3dy5mb3NzaHViLmNvbS9NS1ZUb29sTml4Lmh0bWw=/03ee7856864f92793bfb46fc63ce23ac68e5b410cba0af0891760beaf7fd4545/.../mkvtoolnix-64bit-8.5.1-setup.exe

Remove mkvtoolnix-64bit-8.5.1-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.