home

PDFCreatorSetup.exe

PDFCreatorSetup

Microsoft

This is a setup and installation application. The file has been seen being downloaded from d1uc4fr8hoy8ts.cloudfront.net and multiple other hosts.
Publisher:
Microsoft

Product:
PDFCreatorSetup

Version:
1.0.0.0

MD5:
dcd3e9069e78f2a2d0a550b831722812

SHA-1:
092cf61eff0553cad8616ed76fc6df72d61d8c1b

SHA-256:
4a5599242e342fb28e72c884cbcfb6c85a4b3d1baa747ccc52c2019d73fd7ccf

Scanner detections:
5 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
11/23/2024 7:48:41 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Barys.190.4
7.11.131.32

Comodo Security
UnclassifiedMalware
17774

McAfee
Artemis!DCD3E9069E78
5600.7215

Norman
Suspicious_Gen4.BMDKD
11.20140219

Qihoo 360 Security
Win32/Trojan.255
1.0.0.1015

File size:
16.9 MB (17,764,352 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © Microsoft 2011

Original file name:
PDFCreatorSetup.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\pdfcreatorsetup.exe

File PE Metadata
Compilation timestamp:
10/27/2011 5:33:45 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
393216:uKVuVuNgdwntAmmCwmGDwYbRBdnzHq4W2sY5QjaTYz2MAAOhAB4bt:0NwtAxCwFFTzHq4W2aGTYz2rWB4bt

Entry address:
0x10EF66E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.9994  (probably packed)

Code size:
16.9 MB (17,752,064 bytes)

The file PDFCreatorSetup.exe has been seen being distributed by the following 3 URLs.

http://d1uc4fr8hoy8ts.cloudfront.net/bundles/.../PDFCreatorSetup.exe

http://d3emsmln8xfj03.cloudfront.net/bundles/.../PDFCreatorSetup.exe

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../PDFCreatorSetup.exe

Scan PDFCreatorSetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.