home

powerpointviewer_fr.exe

Sebotacada

MICROMAX STUDIO, S.L.

The application powerpointviewer_fr.exe, “Sebotacada Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.downloadapplicationcontent.com and multiple other hosts.
Publisher:
Lokakol   (signed by MICROMAX STUDIO, S.L.)

Product:
Sebotacada

Description:
Sebotacada Setup

Version:
1.1.5.5

MD5:
a07d983781eedb5432c2d2b2d703a253

SHA-1:
4883ef4d7feef98a6504eaf58ed9e38c66dde3dd

SHA-256:
7186bbacbed8fdcd95de2c4a878433f7cfddcdb2f687a7793bee9c6f55625270

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 5:27:28 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
16.3.11.23

File size:
974.6 KB (997,944 bytes)

Product version:
3.2.4

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\powerpointviewer_fr.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:yAUt59ikysyTrfcEsbXDPLfrvHy8iYpvG:yA+OdtrfcDfPLfTdFpvG

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file powerpointviewer_fr.exe has been seen being distributed by the following 7 URLs.

http://www.downloadapplicationcontent.com/c?x=SbzpzueR405WxsMCriG5QXDc5YU jWW4YkAuczlbYCk=&c=CaC6Jb/k lfMaK2opSItYhFTcqFNy8d5AIuCEEBubypFe48wehH7eyAq Zv1wzCPD9SoMJmoqBtBXnVRmz6qdiu2rjN ucudl9J3lgHTbJ2xdk5IxUOUBC4NauPzoHI &fallback_url=http://res.prograbay.com/.../PowerPointViewer_fr.exe

http://www.bundlecurrentshare.com/c?x=hYF4Qc5QhRAOg3kj/dCZscxzWjPTxTmldQO2YfyHUGI=&c=THXhP2tepTgrHQSu0FZvoiMenjx5ldt3QVUiz5zZRvGfFB9CMRWOqvUvygWrHQVckO8NiRCDZ lKd8vW47gvI3PWbVVhtO8/tecjoQ5iT a680G/3nvm1gn6Z3HdqjlY&fallback_url=http://res.prograbay.com/.../PowerPointViewer_fr.exe

http://www.chucklebodyranch.com/c?x=Xt0d0HjjDwZLNtJ3tWIQahtfoCj83TCMhzJ7RKIoYtk=&c=r7Iy1ajxHGjze2qH4elV8bLQnWQXRxYgXMVhn4hk0dNieesKpjJfB7By4uFPhSJ08I9FCWoMDYXac5n5RMQoz35EXXO23zWsT9g9TNUuqY/NYuG5zjmI0eKzbXrZvzGd&fallback_url=http://res.prograbay.com/.../PowerPointViewer_fr.exe

http://www.chucklebodyranch.com/c?x=AQXOHu8aH8NveKPyofhtDoCzBMjBewH2YksmDIxGVVM=&c=gHvtqJTIyExxi7f33H1tCkUmDUtDFpj98ZPVNxMqiFHgg7hWatLz0lqBjjvIX/UaPN9LMByuvbw5F8nMy54R2MVJeuucbuidANc jlWv8LtzmAxbtuzBZd g5zYsVsdm&fallback_url=http://res.prograbay.com/.../PowerPointViewer_fr.exe

http://www.heartflashpresent.com/c?x=iOAzA2ZiwGLkKEUow0xw39TLtievxsHVgjDf4JWCxrs=&c=4PWYGlQcYbBExaTO6y5mCkhyX8Mm3gkGu/v/ScZV1ci z74Kx7938znkUAFttCsWl8hPAC1CFIrz uiePtxcYMXPdXyOur5AO14LUp MzHrBgAnhkx2 X6DPTfEAUDx1&fallback_url=http://res.prograbay.com/.../PowerPointViewer_fr.exe

http://www.downloadapplicationcontent.com/c?x=XOXXoBI2MrFr5g QtgMlgOw jsmw/7DvonTO6y1m9c=&c=cchh5vqTo lcVd0MpnBDy 4DYCpx0La2y5IQ9NOiwLXV91ZZZZJpm6Eze4PFMOh3p cK1XMw4XuNTyA2eYQswL/3gGKtqJ9QkO 3PScF93NXKRViGp/kTB1WQyd4Vbbi&fallback_url=http://res.prograbay.com/.../PowerPointViewer_fr.exe

http://www.newcapitalcentral.com/c?x=7MVnwiuIoDPX7JlTx8oKJgVdVjz ljNRedSrkPXvJ80=&c=G0OXwBXohZ3jhS2or 52EvQ5jVb2fiz7ddXixi4Z3kwHnilP9fvUHOaPmre26jRXBdtVdUhEKOIamn4gOiRKXWY6BTEE6d5J YUJFpCJU0vj/m8pbCbaUApuJKVlXKlI&fallback_url=http://res.prograbay.com/.../PowerPointViewer_fr.exe

Remove powerpointviewer_fr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.