home

pdf995s.exe

Software995 Inc.

The application pdf995s.exe by Software995 has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Software995 Inc.  (signed and verified)

MD5:
f90f6942834967ec5cba26e1dc5ba506

SHA-1:
b161ce2b8b4d6e60526fb28dc9a744580f8d7153

SHA-256:
3a95185a5bd5a7f35d6fccc5f2a36b0b6545e9e814adb7db9d195010fb0364aa

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 7:24:14 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Software995.H
14.5.12.22

File size:
2.6 MB (2,684,312 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\pdf995\pdf995s.exe

Digital Signature
Signed by:
Software995 Inc.

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
5/3/2009 8:00:00 PM

Valid to:
6/21/2011 7:59:59 PM

Subject:
CN=Software995 Inc., O=Software995 Inc., L=Palo Alto, S=California, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
35AD158DE07A252BB28710B7FD5C97C2

File PE Metadata
Compilation timestamp:
2/24/2009 10:50:34 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:8pZVgArncq8PQ5HMEyjN4USqKlrFcuPp2kFn5zupGBwxochkp:8p3VrcLPQhME7zwO5CpGHL

Entry address:
0xAF1E

Entry point:
E8, 6E, 4A, 00, 00, E9, 16, FE, FF, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, D0, 4B, 42, 00, 89, 0D, CC, 4B, 42, 00, 89, 15, C8, 4B, 42, 00, 89, 1D, C4, 4B, 42, 00, 89, 35, C0, 4B, 42, 00, 89, 3D, BC, 4B, 42, 00, 66, 8C, 15, E8, 4B, 42, 00, 66, 8C, 0D, DC, 4B, 42, 00, 66, 8C, 1D, B8, 4B, 42, 00, 66, 8C, 05, B4, 4B, 42, 00, 66, 8C, 25, B0, 4B, 42, 00, 66, 8C, 2D, AC, 4B, 42, 00, 9C, 8F, 05, E0, 4B, 42, 00, 8B, 45, 00, A3, D4, 4B, 42, 00, 8B, 45, 04, A3, D8, 4B, 42, 00, 8D, 45, 08, A3, E4, 4B, 42, 00, 8B...
 
[+]

Entropy:
7.9768  (probably packed)

Code size:
76 KB (77,824 bytes)

The file pdf995s.exe has been seen being distributed by the following 11 URLs.

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_it&type=PROGRAM&Expires=1475869859&Signature=O~XXIdLfS6fQfq5MO4UIbBM-qyOAicyd7OjSPnqvxn~-tyN4u5Vx4h~xhSYQlyrEGt2IzTWzbMRijJR-qBwWmkB5LGqtrRuWD-yjs6icQrMmg0fJuY9s5Rr7-ors-mSG4AE9eL6BWHwKhQPLzE6TEqS0DzT-8ob-MpJvQbyP83A_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pdf995s.exe

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_es&type=PROGRAM&Expires=1459251133&Signature=SXzwqGsxo6v3uwuYWN783Dmq4Yb2aVSmLieDBaJFENBN0n5c0tgfoESKf2NSRr8FtGgrv-~jnfX0BuDW60kEBloZyuApCmRLfh7FjA78MLZcccik54Ped~OG1LjO3h7QgqHsC9a2vm26PZ~omJ~NOr3AhGHLNo94mc~3rs4bOKc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pdf995s.exe

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_br&type=PROGRAM&Expires=1477040741&Signature=LfG43hpUs5SL~fqii5Q6ct7BhOw4cRO-maXuCl~vpZ9yEe7cBPNoDzpTKZCYzJSgjM8n5N8DmyMPftnuaNQnIXslxE0po-NYJAHr7h0ipaSve65kuImiPSIl0FEsoDflmCpqX1NtvVLuVIsppkSpSWTtv2ZuOF97sPWiXbB~4yM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pdf995s.exe

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_es&type=PROGRAM&Expires=1463059467&Signature=FvWdoxSfCsaiKmsUnwxq~g0kTuhu0DCTFXYCnn1Izbt2lhIJmtSE9kxirPh1ypsGJiSgkCM3Kc~ISmATwqI9P7ovW9o13K0C1qyP5aVshWHAlA5252JZAcTs2KrN-FqJV2XssEtJjAv5Akm1ov0vqudCDQx27blmsfLdxoPWS54_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pdf995s.exe

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_es&type=PROGRAM&Expires=1456347557&Signature=X9YxPEAMQGat-PoVHXw8z90NdXXzwAQjNmaF~xiE2wE7dIf1PxuHiAZBU~phlBt0RI3szY9arpqZfQ7kr2uSMVJYMk25Kh1qRxpqHSXBhgseaBohcsEca7lVfLcenoNIniKlyQY4oUnxqWVzDF6oxv~hgns-r2fHNegc7Nsl9uU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pdf995s.exe

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_es&type=PROGRAM&Expires=1462846785&Signature=e8j5TghYimXz-MZbgMCjzxLmPimXl2RykqmvjzUNMegrzLXtaVPifYXH9iwkFT9uOrv2372mGahmbkm5ghS9NoVb0AwhAPTKi78wHmJeHs3zXt9kQr-ZzGYlvLlSnqlFrURcy~9b~pjbkmGek~VBL33V8rX61F06HimGLzXM7JQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pdf995s.exe

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_pl&type=PROGRAM&Expires=1465523133&Signature=ceTQW0ppFXPi5VLnvsfRAOkYgjvoCTHpnxpmM8KN37IEPzvk8wg4DfU5Onr9Bz5r1baH4P4R-YtCtVd0KPj1tvIR4-AP3xAn5gQq~QvWJw-cS8OUVaSGHTq2rQ5fBKX~O8Gv995sdlUSO5T~RzRh3BzShbFE3Q2ehKFYHKwg-aQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pdf995s.exe

http://gsf-cf.softonic.com/b16/1ce/.../file?SD_used=0&channel=WEB&fdh=no&id_file=19141&instance=softonic_it&type=PROGRAM&Expires=1435022814&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=AofabKSFEpg8uwS~018jP8i-FAEUD7EbAJ2QI-UHB98tzuPL9KkIZLhdWoWt22nQg5gX1Z3sJiephIFkagNCwBHMieTK7HRH8YwQ2x19h75MFgMqK8lM2kSm~~zCsMllQiB-qzSdJl96OY9fBpTOJuIJK2CcRjYyN9MtAy~Zm4Q_&filename=pdf995s.exe

http://www.software995.net/.../pdf995s.exe

http://global-shared-files-lw.softonic.com/b16/1ce/.../pdf995s.exe

http://www.freeware995.com/bin/2010/.../pdf995s.exe

Remove pdf995s.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.