home

setup.exe

ElcomSoft Co.Ltd.

This is a setup and installation application. The file has been seen being downloaded from s7265.chomikuj.pl and multiple other hosts.
Publisher:
ElcomSoft Co.Ltd.  (signed and verified)

MD5:
b213dbfc88fed5214cb1bf21b3ab6b8c

SHA-1:
10e6a2291ed81a07ff0a820c10d2fb702a232901

SHA-256:
aa4d68575da1a9c34b2b039dc76dc96f3d5f8810d3d66d7662deaecf5ecca139

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
11/30/2024 10:49:32 AM UTC  (today)

Scan engine
Detection
Engine version

Quick Heal
(Suspicious) - DNAScan
4.14.12.00

Sophos
Elcom Password Recovery
4.98

File size:
1.3 MB (1,313,104 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup.exe

Digital Signature
Signed by:
ElcomSoft Co.Ltd.

Authority:
VeriSign, Inc.

Valid from:
8/9/2004 12:00:00 AM

Valid to:
8/9/2005 11:59:59 PM

Subject:
CN=ElcomSoft Co.Ltd., OU=Development, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=ElcomSoft Co.Ltd., L=Moscow, S=Moscow, C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2001 CA, OU=Terms of use at https://www.verisign.com/rpa (c)01, OU=VeriSign Trust Network, O="VeriSign, Inc."

Serial number:
31743A5CFEB1696D22C601A5C8C8BF47

File PE Metadata
Compilation timestamp:
12/3/2004 4:43:19 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:/QQrqYcd3CyHm32JPHzrmYASfXk5bGAnd0StzKneafj2hFZoI83aLZ253i6:/QHCyH00PHzqAfXAbGAndbzVafaPWHWY

Entry address:
0x3C53

Entry point:
83, EC, 20, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 68, 91, 40, 00, C6, 44, 24, 14, 20, FF, 15, 28, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 68, 88, 92, 40, 00, 68, 40, 3B, 42, 00, A3, F0, 43, 42, 00, E8, 8A, 2A, 00, 00, BE, 00, B4, 42, 00, BF, 00, 04, 00, 00, 56, 57, FF, 15, C8, 70, 40, 00, E8, 7A, FF, FF, FF, 8B, 2D, 8C, 70, 40, 00, 85, C0, 75, 21, 68, FB, 03, 00, 00, 56, FF, 15, C4, 70, 40, 00, 68, 80, 92, 40, 00, 56, FF, D5, E8, 57, FF, FF, FF, 85, C0, 0F, 84, 47, 01, 00, 00, BE, 00, A0...
 
[+]

Code size:
23 KB (23,552 bytes)

The file setup.exe has been seen being distributed by the following 12 URLs.

http://s7265.chomikuj.pl/File.aspx?e=wiS6vfxGNqGbEY2Bx5bpd1MjX9ASExhKWUXjhn7ARHmBKzrijb6e8ZSbSVSkZIWEOwF3sZwWUru6HRG1BCPg6Hy8fNUNqp6I6JqkYfEL5zOEYBtl_Dl93fbSq56pTI4zHp1lhmABMnmeAbxey6ItpFlC7lV41Cv6U3Gu53flieo&pv=2

http://s7265.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEaO0G8YMo0cuCV9JDNFdY-l_zt9pwJ-zBuJAVJ9TRBIO9MFkMgJ8rzzh8i3XNozh65YryPMpxHp-wVdyV4DWKFGgWXdwEDeiVQwaNpj6yf9O3oKaEKNdfQxk3gQeaVzd68wAydqY64bnwCu8dhX_4lQ&pv=2

http://s7265.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEd8J4BJsKOWcN88CZO3xwcBlvqb7jqFN7996JUYdnESWbJnOVdnPZcD2P7DDeUb2pAVdf59Hjg-_rGBhGKPj7hUNsXDRfswxs8ciDKy5Jxyl0hiFAj69bzyOiwxE8f3iknpkWlSkW1yHcY86x-0tB88&pv=2

http://s7303.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZETwrX0t1dsHHja9Wx81srjMBdELMa2cp3bvWm4xBDtG46vgpPGLDo_FvM83Qud2vqgWj35EwTHbgqLxinW5gZ7qQ2-NB8hu-Qcnjt_X4AAg3OGLMISFvAOSogjagjYPojKRNvICTp85sopc149xyze8&pv=2

http://s7303.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEVFsgd5znbT_8Wm4GU7exWzjAEuw6wtUe-obl_RQk0pcA5y23LKiXVSWCMPtOZGUpLoBZejtycrdzvkvKWQ87Upe6MUL4X-XJdZdKBAfqz_W2jigXziDDwajpicmKjLJotw5GhOrU3OYZuN7yQH_ou0&pv=2

http://s7265.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZETwrX0t1dsHHja9Wx81srjNGh9EZIWZ40xNRIEvKkXkbNwaAj_uOb5oJGOmiFdd5nFgmWpMcO3jb9x1nZqdb9_kSgsVl2PffEZjCTivd82Z0JHNe9736TQE8Rju11arjS_pCQxArAGJTA0h3Le2AekA&pv=2

http://s7303.chomikuj.pl/File.aspx?e=wiS6vfxGNqGbEY2Bx5bpd45baoFIKkR0P5nAeo2oEb1T8-aqQ_DY2-Aa958325ueCwIwhYvKmZil_qvyAkyh20mEGbpSnWW4afl1vzwB6cgO5Gv8bsAIJKSXOwPNHuxlNtFyZbvQoi_Jw266cMZWN-2pA-z0PO63brdYf_PlyhU&pv=2

http://s7303.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEcQSP1FlC4VdzV9yO82983OncWwziqgxdZZqobTrL7OKzWSpB194plW8Bu70u5b4jpjFlXqlw3RtCiDT3bhFhKVpUT61Jy-RdU7KT_kMnv5nFOW0GqUs5rf97brcOjCNcwLDjr4mQSSXDSeHfvLhXhU&pv=2

http://s7303.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEd8J4BJsKOWcN88CZO3xwcBwIfQHjKScsX9i6U1R57w1GyFqBr0CyQlSQBcxayzLOEbT-P2Vf38TrAj9bGh30CPuhCtNcoOitJkq0EqHwYSOS8wRhZR7MBIESchNbQynbHkprFvuIyv0FVx59v9mPzc&pv=2

http://s7265.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEQj14xmJcXoJDeCP_3G0gvOwocB4qUcGO2NDelDXftNeAzXqQDXSUioVxQyDFK1nlH8bIUZu81hYDVU_ErezyMHEXmRWRrNKelfDScxd4yV3l7LMU-tMXUl0d5EWPbMNIkTH3tDJ_U-hsleIVlOk9kc&pv=2

http://s7265.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEejzyJ0vOHGCYWS2WuQq6jqzA7N6J_tXfHKWxIpbYF_CvxLgxtYFk8xUypjq3JqUXc3piIjW5ciBSApXamaxIkqyVnb0Ayu0mQ69gSUaBnFBJjnzo2HDg0sRqiOmJCw8Wqw8hFUqyMSb9YBOp-knvFg&pv=2

http://s10094.chomikuj.pl/File.aspx?e=ZU9x_jEMvRgAzQUX8PdZEd8J4BJsKOWcN88CZO3xwcC-BzO9NdUNkQ9uOtGDKYdLDxpm-JcxG2-_eznYNuQtUQeeznH2bbJ2OWJ1oS3rebEGtBsqpMaddQAg1BDrRk1AdBFep89u4RtKAep8wxtIpFpy9OfWfVd0Azo8KSfk-Hg&pv=2

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.