home

setup_winsadib.exe

Andrzej Huzar Huzar Software

This is a setup program which is used to install the application. The file has been seen being downloaded from www.huzar.pl.
Publisher:
Andrzej Huzar Huzar Software  (signed and verified)

MD5:
a503ef85a14eecedbe5e737b7c062676

SHA-1:
1d3df0c3266ee0669328d0dbd9d9faf5821d0f9e

SHA-256:
ea1f98789ba6979b71e660b1ac919b636a25ca48a81c7c5989d14abdcc1fa459

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/16/2024 3:01:23 AM UTC  (today)

File size:
18.1 MB (18,980,848 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\setup_winsadib.exe

Digital Signature
Signed by:
Andrzej Huzar Huzar Software

Authority:
GlobalSign nv-sa

Valid from:
11/26/2014 3:04:06 PM

Valid to:
11/27/2015 3:04:06 PM

Subject:
E=huzar@huzar.pl, CN=Andrzej Huzar Huzar Software, O=Andrzej Huzar Huzar Software, L=Wroclaw, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121812629A93579A7A08DBFB2FE87FF370C

File PE Metadata
Compilation timestamp:
12/22/2014 3:01:43 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:DmuOXJa3cgTpVqXtpEvLg0NjGuk94rXK/9vDlkyyFrSylqYdobrjg3:KZXTr0Nj9kqa/9rYvqYdqg

Entry address:
0x65BA8

Entry point:
55, 8B, EC, 81, C4, DC, FE, FF, FF, 53, 56, 57, 33, C0, 89, 45, E0, 89, 45, DC, 89, 45, E4, 89, 45, EC, 89, 45, E8, B8, 3C, 4A, 46, 00, E8, 51, 0F, FA, FF, 33, C0, 55, 68, F5, 5C, 46, 00, 64, FF, 30, 64, 89, 20, E8, 5A, DB, FF, FF, 68, 0C, 5D, 46, 00, A1, F8, 8F, 46, 00, FF, 30, 68, 38, 5D, 46, 00, B8, A4, 00, 47, 00, BA, 03, 00, 00, 00, E8, 26, F2, F9, FF, 6A, 04, 68, 50, 5D, 46, 00, A1, A4, 00, 47, 00, E8, 11, F3, F9, FF, 50, 6A, 00, E8, 51, 18, FA, FF, 83, F8, 06, 0F, 85, B6, 00, 00, 00, 33, C0, 55, 68...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
403 KB (412,672 bytes)

The file setup_winsadib.exe has been seen being distributed by the following URL.

http://www.huzar.pl/.../Setup_WINSADIB.exe

Scan setup_winsadib.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.