home

pf-setup-en-653.exe

The application pf-setup-en-653.exe has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. This version of the installer will bundle the Ask.com Toolbar, a potentially unwanted web browser extension. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
2e462b473d266194f26800fabe58e28a

SHA-1:
a091e182fd9e156c0975c784027e5bbc4067f9f5

SHA-256:
3626a2a03ce3a644f51f3a8e14cb60c37c5a558804ed9c26b605c50d389d47ed

Scanner detections:
3 / 68

Status:
Potentially unwanted

Explanation:
Bundles that Ask.com toolbar as a third-party offer, a web browser extension that may modify a user's search and home pages.

Analysis date:
12/25/2024 11:33:04 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

avast!
Win32:PUP-gen [PUP]
2014.9-141125

Baidu Antivirus
Trojan.Win32.Bundled
4.0.3.141125

ESET NOD32
Win32/Bundled.Toolbar.Ask (variant)
8.10752

File size:
4.8 MB (5,015,061 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\pf-setup-en-653.exe

File PE Metadata
Compilation timestamp:
6/6/2009 10:41:48 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:ammIdgYQ87fvsBt5Z2dqVMSIlr9INtMe10fjg6JZ4ubG0gAipUts:JdgyDvalBVMzQNuko0EJ1E

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9991

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file pf-setup-en-653.exe has been seen being distributed by the following 13 URLs.

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1470161590&Signature=AIN~aaGRGqIDFoW1BjrZ4oQqSUGbKaJZ0ZLET-CKHs9e3k4OGr4ApgIRbgTkQViNOV1sO5DjeMAud1iUs9oISE1hyp4V3RMuDrBva8e6vZkT-9p-gc7CwO-~Hl8Nf308-~pPo88CBoxUL03Zg0aB9zmHqY5t8f~JoPeRyv~fdyo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1422655402&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=aoK9xhluLbwcnNc9wHYNGInGA1QzemMcVVU37elOUtrrP~9OpAbc9BJXlWTcYjqiNE5m9ESHj2no6efVqGrIM-n8dcqVCeSH3cs3MsRODGuVkjlNtqDybJioiDE0pAGO8gbbwue8u0kGvx77dBNT5ZrCvaaiJlP18zJJaNOjzz0_&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1476190063&Signature=T60SXibMpBA-i5I~w448lczzDn4LH5XofZSl-e7ZI3KU2blJ3lFtjykYkUzIfSZCGi-REE6jX~m4UrwDMvshgy2cUrBNosrPYKUl-HLdbKpYVW6Yh4QssLrzSChiHP-2-V3Q~h4yyED6rrN7c0DOTp-P6Wyw0exYCiP-jjzOo7s_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1481849262&Signature=L7CV0EGPiz2fhE356tDsCeFhAAv00cXkNmCqjaIwk0lY361ecA9knBrTdz66sz4mLwQw-txJlFnbKRObxvMUMDSMWI5H5-BGCAks3wFJFyJonzniksz~VNfc3eJ90HL-RSbEUUaQmLgsvTZZbxnMQp-p7AUEtO7woL8NrXky01w_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1474954397&Signature=iqecevVW7EA4qjkDOfsa~WNZuLyxFVbw2mtMexwlisghhD4m3~GoWqZhwpx0fkRc45wUMLJ7mgxEa1aKK0pkMqbXO~4HT3sekpOg8JbPxtiyz~-anxXm9PyxAV~VjgKm6OYjDjSCribMO9dZTEjceSoKp0~JJVaPDgMQQx9-KQ8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1475849938&Signature=ZZsw82u9RDmxphyRayl7mL1Y~oDo~4uHma~tTIrrS0XCe5Gl0Z81GrrQfNCpiKD4ZE7SVqcq2F3RVtJOChskNmvlVQ1rCffW4dEllp6G4klisbZJKqIOYgyGuhsUR5UpIwED8CGDnZxhOtqczU3cQQmRlRxeqzdasnC27K0co3U_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1429259373&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=HhqSlZkBVqVwnrQePsfxahBUwAKcpOQawvFAEM~WbNuLnuKizsPps53p-e3cmjw1os7E3~8rAUqBy3SptZEmcx-j7ZW8m4UH7FBbVpqwYIzox0RYQ1mKcvMqFJ7X74Zt4RodvNYTQU3602Dqv3tAPoBsuSnChathSIatX07z6Mg_&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1457570430&Signature=g89OateEGxavbIxH2NUzKkp4Hpo3FEwHI-yCli1gwtHc6dKAXH5ugMvrsGQKcQY7tmRn1uK1MeGP9r5oIDKxaNifvDlrlPcd0RmAX5pOOFXwSe3xDKurcVyPNUV7wA7oFMmbaP493lgY2bTxLbHkvih5xKb9V4~1evHSbgnzVYs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1457612568&Signature=DdJrqKbzIdJLTUP67QezqbgkhS3SdyNMwNmFRElIGYVEp53FgKw8hOj5~RQqKMyZWMRsfdPYcj8uwWcq60bXI8gEcP0k7pNZpbQ47BuINgYp2q8OdSR2EN~wcDWrfMJKjeeLimHHaXDzwXmhhR2ZfyEDPdXw~vvKFUcNLH5UQb4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1460442842&Signature=PQRWOmgqZteM2j7eKPD2MIxARCk3tHDUHCB1hc5fhxBi15kbUX7kxw3iC4Cr6w-7fUlnyEvA3bdC8hIiZAVAypaAw4Vmmpgp6qPakyNLUVfjJ43ooHZL88uiRYCJJHajjEG8dcnzlvw5QtVODe546pV~TcChM-vYy5X6G-sfcxk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pf-setup-en-653.exe

http://gsf-cf.softonic.com/a09/1e1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64392&instance=softonic_br&type=PROGRAM&Expires=1427201063&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=WlebSrX7kGr-Y9BoqmF21Vwh2p70HauNhRBhhC6iOSQ4QawTf1PMESNMwQ3VZX5QOMPwcQrd6Om89zdALFrBoEc~nqNo5CC9RFK1~OKCf4AocXl-pcS0POseQwdz6HE~-Bn6AG~uIn1i5aKlBrwjpaPvOlOU9q82PHn0JV6beuw_&filename=pf-setup-en-653.exe

http://softvisia.com/request.php?mirror.1453.12

http://photofiltre.free.fr/.../pf-setup-en-653.exe

Remove pf-setup-en-653.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.