home

nokiasoftwarerecoverytoolinstaller.exe

Nokia Software Recovery Tool 6.1.49

Microsoft Corporation

This is a setup and installation application. The file has been seen being downloaded from wordpress.redirectingat.com and multiple other hosts.
Publisher:
Microsoft  (signed by Microsoft Corporation)

Product:
Nokia Software Recovery Tool 6.1.49

Version:
6.1.49

MD5:
a6f475cac17230fe9a771fb2ad3e0fbc

SHA-1:
6ad7e4b01b0da9a3f66de55cd232c7ced8570d11

SHA-256:
908710ea02973565fabbaab5646983ec244156990284ba9612479f5419f047d2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
12/26/2024 6:52:39 PM UTC  (today)

File size:
18.2 MB (19,055,224 bytes)

Product version:
6.1.49

Copyright:
Copyright (c) Microsoft. All rights reserved.

Original file name:
Bootstrapper.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\programs\nokiasoftwarerecoverytoolinstaller.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
6/4/2015 8:42:45 PM

Valid to:
9/4/2016 8:42:45 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
330000010A2C79AED7797BA6AC00010000010A

File PE Metadata
Compilation timestamp:
12/9/2014 1:44:59 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
393216:gFRc4AukJftmGNNqPSEAQa3btCM4yPhn/qhfyhwe2a2VK+jpt8r4F9:gFCqC1wqDQa3btVZn/2ahw99c+jpuG

Entry address:
0x2945F

Entry point:
E8, 00, 3A, 00, 00, E9, 7F, FE, FF, FF, 3B, 0D, 00, 20, 46, 00, 75, 02, F3, C3, E9, 89, 41, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 54, 24, 0C, 8B, 4C, 24, 04, 85, D2, 74, 7F, 0F, B6, 44, 24, 08, 0F, BA, 25, 5C, 3F, 46, 00, 01, 73, 0D, 8B, 4C, 24, 0C, 57, 8B, 7C, 24, 08, F3, AA, EB, 5D, 8B, 54, 24, 0C, 81, FA, 80, 00, 00, 00, 7C, 0E, 0F, BA, 25, 60, 20, 46, 00, 01, 0F, 82, 3A, 42, 00, 00, 57, 8B, F9, 83, FA, 04, 72, 31, F7, D9, 83, E1, 03, 74, 0C, 2B, D1, 88, 07, 83, C7, 01, 83, E9, 01, 75, F6, 8B, C8...
 
[+]

Entropy:
7.9718  (probably packed)

Code size:
270.5 KB (276,992 bytes)

The file nokiasoftwarerecoverytoolinstaller.exe has been seen being distributed by the following 6 URLs.

http://wordpress.redirectingat.com/?id=725X1342&site=nokiaworldhun.wordpress.com&xs=1&isjs=1&url=http://go.microsoft.com/fwlink/?LinkID=525568&xguid=300f4f56d3128645d9c9b0447e90b1b8&xuuid=56b5e5c08b3904390bb94b16cf0287af&xsessid=809ddc40a11404aac53263240382d98a&xcreo=0&xed=0&sref=https://nokiaworldhun.wordpress.com/2014/07/15/hogyan-allithatod-vissza-lumiadat-a-nokia-software-recovery-tool-al/&pref=https://.../&xtz=-120

http://nokia-software-recovery-tool.software.informer.com/.../

temp:NokiaSoftwareRecoveryToolInstaller.exe

http://relizua.com/.../go.php?url=aHR0cDovL3JlbGl6dWEuY29tL2Rvd25sb2FkL2ZpbGVzOC9Ob2tpYVNvZnR3YXJlUmVjb3ZlcnlUb29sSW5zdGFsbGVyLmV4ZQ==

http://go.microsoft.com/.../?LinkID=525568

http://download-fds.webapps.microsoft.com/supportFiles/phones/files/.../NokiaSoftwareRecoveryToolInstaller.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.