home

mp3rocket.exe

Program

MP3 Support

The application mp3rocket.exe, “Program Setup ” by MP3 Support has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from software-files-a.cnet.com and multiple other hosts.
Publisher:
Internet Application   (signed by MP3 Support)

Product:
Program

Description:
Program Setup

MD5:
9c3c551035f02c398db72a9ef918ce3b

SHA-1:
1902f9ff9caab667d25b29b913895546b04bc626

SHA-256:
ca77c8fa05df29f686a1545da6ada67df4dd608200af28553979fe78bbfc7f68

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 1:35:03 PM UTC  (today)

Scan engine
Detection
Engine version

K7 AntiVirus
Unwanted-Program
13.194.14941

Reason Heuristics
PUP.Installer.MP3Support
15.2.11.17

File size:
834.8 KB (854,808 bytes)

Product version:
3.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\mp3rocket.exe

Digital Signature
Signed by:
MP3 Support

Authority:
Thawte, Inc.

Valid from:
6/26/2013 8:00:00 PM

Valid to:
7/11/2015 7:59:59 PM

Subject:
CN=MP3 Support, OU=SECURE APPLICATION DEVELOPMENT, O=MP3 Support, L=Oshawa, S=Ontario, C=CA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
146C2E323177663B9DF87FFF1B9C31D8

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:UFz4pJ+51smx+V/7ruwduTbW0fV5OHX9PsVUE0/M5ioeglvzQbF:Uh4/8smEZruwdu3VPsXqVUEaMVeev8bF

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.7294

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file mp3rocket.exe has been seen being distributed by the following 19 URLs.

http://software-files-a.cnet.com/s/software/13/54/79/.../mp3rocket.exe

http://www.safefiles.com/.../mp3rocket.exe

http://www.mp3searchbot.com/.../mp3rocket.exe

http://www.ezmp3s.com/.../mp3rocket.exe

http://www.limesearchbar.com/.../mp3rocket.exe

http://d5.mp3rocket.com/.../MP3Rocket-Win.exe

http://d5.mp3rocket.com/.../mp3rocket.exe

http://www.musicrocket.com/.../mp3rocket.exe

http://gsf-cf.softonic.com/190/2f9/.../mp3rocket.exe

http://d9.mp3rocket.me/.../mp3rocket.exe

http://www.allmusicdownloads.com/.../mp3rocket.exe

http://software-files-a.cnet.com/s/software/14/07/83/.../mp3rocket.exe

http://www.safefiles.net/.../mp3rocket.exe

http://www.allcoolmusic.com/.../mp3rocket.exe

http://www.rocketbackups.com/.../mp3rocket.exe

http://www.toucharger.com/.../?count&i=33401&n=1&d=1&t=1

http://www.imusicsearch.com/.../mp3rocket.exe

http://www.mp3rocket.me/.../mp3rocket.exe

http://www.psprocket.com/.../mp3rocket.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (199.58.87.155:80)

TCP (HTTP):
Connects to ec2-54-207-84-20.sa-east-1.compute.amazonaws.com  (54.207.84.20:80)

TCP (HTTP):
Connects to 92b91b35.rdns.100tb.com  (146.185.27.53:80)

TCP (HTTP):
Connects to ec2-54-232-235-7.sa-east-1.compute.amazonaws.com  (54.232.235.7:80)

TCP (HTTP):
Connects to ec2-52-67-76-234.sa-east-1.compute.amazonaws.com  (52.67.76.234:80)

TCP (HTTP):
Connects to ec2-52-28-72-26.eu-central-1.compute.amazonaws.com  (52.28.72.26:80)

TCP (HTTP):
Connects to ec2-52-26-136-207.us-west-2.compute.amazonaws.com  (52.26.136.207:80)

TCP (HTTP):
Connects to ec2-52-206-46-116.compute-1.amazonaws.com  (52.206.46.116:80)

TCP (HTTP SSL):
Connects to a104-105-128-117.deploy.static.akamaitechnologies.com  (104.105.128.117:443)

Remove mp3rocket.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.