home

photostagesetupsoftonicfr.exe

NCH Software

This is a setup program which is used to install the application. The file has been seen being downloaded from www.softonic.fr and multiple other hosts.
Publisher:
NCH Software  (signed and verified)

MD5:
07ab3788a63e679ef8e93b11a5c45cf5

SHA-1:
3d2d4d8aa875ee88acbae8accdc3d1301dac393f

SHA-256:
04709ae9109d5641d3c3cd0b024a3639d82ccae38a183b3d37f02fc3f7f7afbc

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 11:03:15 AM UTC  (today)

File size:
4.9 MB (5,157,960 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\photostagesetupsoftonicfr.exe

Digital Signature
Signed by:
NCH Software

Authority:
Thawte, Inc.

Valid from:
5/20/2013 2:00:00 AM

Valid to:
8/8/2015 1:59:59 AM

Subject:
CN=NCH Software, O=NCH Software, L=Canberra, S=Australian Capital Territory, C=AU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
6A560820FA3E9AD8E5411734B1D40AD5

File PE Metadata
Compilation timestamp:
10/1/2014 2:46:55 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
98304:6qB3vreXLzGLAGmsHK4f7/tOZFKl2jHq8uFbMum8Tj14a5gRDWE:6qBUvWAGm7RZ7K8uF4uTj2gdE

Entry address:
0x209B

Entry point:
55, 8B, EC, 81, EC, 20, 04, 00, 00, 53, 56, 57, 6A, 63, 8D, 75, F0, E8, AA, FF, FF, FF, C7, 45, FC, 01, 00, 00, 00, 33, DB, 8D, 85, E4, FC, FF, FF, 50, 68, 04, 01, 00, 00, FF, 15, 1C, 10, 40, 00, FF, 75, FC, 8D, 85, E8, FD, FF, FF, 68, 64, 10, 40, 00, 50, FF, 15, 44, 10, 40, 00, 8D, B5, E4, FC, FF, FF, 8B, C6, 83, C4, 0C, 8D, 48, 01, 8A, 10, 40, 3A, D3, 75, F9, 2B, C1, B9, 02, 01, 00, 00, 3B, C1, 76, 02, 8B, C1, 33, D2, 3B, C3, 76, 31, 8A, 0E, 46, 3A, CB, 74, 0C, 88, 8C, 15, EC, FE, FF, FF, 42, 3B, D0, 72...
 
[+]

Developed / compiled with:
Microsoft Visual C++

The file photostagesetupsoftonicfr.exe has been seen being distributed by the following 3 URLs.

http://www.softonic.fr/sads/tracker.php?ev=c&co=FR&sid=c9f3c774b4c0442e7c9441ae1fd95839&upv=a82056f4b1c57486c12d5a20ce56a2ed&z=results&sk=0&abt=&eid=&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAB19ACD83E39FB2DF721B7062228037F19883962951E77D0CE0ACF63277F72667310E0435A588904EE86B2B06ED4AFBA5D83C9AC3D7AE4808EB929C0A7EB524B1EE20E31DF1C62AAD3203AD0A5C6D946A8775090E61F4E1B85DEBFE76192AF20467CECCAFB6153737CC2E98926B1EBC1A3027853B40A36EAE808919ED79C0B67A5D14D0691763973818391352B7FC3A4D&h=0F9C89B04137766B7083630EFA7D479763D20C61DBDEA3E56943CFA1D2629C64&directdownload=1&f=66499&d=http://www.nchsoftware.com/.../photostagesetupSoftonicFR.exe

http://www.softonic.fr/sads/tracker.php?ev=c&co=FR&sid=bc40e7bf994d2fe4e639ecf955e5abd7&upv=acc5ea9ff782be1b38beb6ff257821b0&z=results&sk=0&abt=&eid=&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAB19ACD83E39FB2DF721B7062228037F19883962951E77D0CE0ACF63277F72667310E0435A588904EE86B2B06ED4AFBA595C27B7328AE231A24584D75DA089834C8C546D548B75E1FC71B2B9DEFEA61393D72523FF32CC3CA2EF9C12322E0ACB998260002B13F364607C3C51034DB13742E9B4277EC52D82C68B222FF2A0154F4667466CD0FD539B846280E9508ADBEF7&h=B428EF96BF5580D87794FA54CC7503281991E5741F2D5CC43B79F86AC6DCD02C&directdownload=1&f=66499&d=http://www.nchsoftware.com/.../photostagesetupSoftonicFR.exe

http://www.softonic.fr/sads/tracker.php?ev=c&co=FR&sid=a68294349ca9488e3487ac38ada9a95a&upv=ba15dec752bc634243f1c36db5b06cf1&z=results&sk=0&abt=&eid=&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAB19ACD83E39FB2DF721B7062228037F1DBFE4337AD10D7A6E3F2BD2410AC2A7203232337D2CA73F1C07B63E2797F72124DD960A8CB17AB0AEB4C2E6B6C4C8A51AA5FA0CFD451CD50DB79180A9F9B266668B53547A3A6E4C6ADDCCB1679F8C41519A90E1178746CAEAF96E6BE21C302C3B387DE7E0178CA1EBDC94B13E5F53DCD1791216EACCEA9CD34C196E2A03D3023&h=BDC1F9071F8AE892F452A4AF0EFFC381021D83928E4299B606AA832080634040&directdownload=1&f=66499&d=http://www.nchsoftware.com/.../photostagesetupSoftonicFR.exe

Scan photostagesetupsoftonicfr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.