home

saveplus.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from www.baldor.com and multiple other hosts.
MD5:
4dfe78b571819c81ece50c75b7d3f7fb

SHA-1:
b4c25240dd14d6d16071912d7b4f03e5b3c71a3c

SHA-256:
42668a28dbf6c095f007b83c6c37b852d3fc1bef4a199160ccd32cfdafbfcab2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/29/2024 6:45:37 AM UTC  (today)

File size:
2.2 MB (2,299,862 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\saveplus.exe

File PE Metadata
OS version:
77.10861

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
2.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:Dzs240REerYJMdm8oas3ZW800aJlpoIJoImMOxVEXASsq:Dzsxs4MdS90/JPJoI8xVEXEq

Entry address:
0xA0009A

Entry point:
4D, 5A, 9A, 00, 03, 00, 03, 00, 20, 00, 00, 00, FF, FF, 48, 00, FF, 00, 00, 00, 00, 00, 00, 00, 40, 00, 00, 00, 01, 00, FB, 30, 6A, 72, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 00, AA, 01, 00, 00, AE, 01, 00, 00, B2, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.9984  (probably packed)

Code size:
192 KB (196,610 bytes)

The file saveplus.exe has been seen being distributed by the following 2 URLs.

http://www.baldor.com/~/media/files/brands/baldor-reliance/.../save plus software.ashx

http://www.baldor.com/.../saveplus.exe

Scan saveplus.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.