home

shareazaturbobooster_installer.exe

Shareaza Turbo Booster

Hipgnosis Vision

The application shareazaturbobooster_installer.exe by Hipgnosis Vision has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.webspeeders.com.
Publisher:
WebSpeeders LLC  (signed by Hipgnosis Vision)

Product:
Shareaza Turbo Booster

Version:
4.7.0.0

MD5:
648c5a6033c2f7ad202cc56dd62708e5

SHA-1:
23514e9ba0dccce2d8ba001eb38ad6cf73e18fef

SHA-256:
c55829d704858730dea3a9433c93933f35463a59431e5398ed05b552076314ff

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
1/12/2025 9:34:05 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.HipgnosisVision.Installer (M)
16.1.22.11

File size:
885.4 KB (906,648 bytes)

Copyright:
� WebSpeeders LLC

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\shareazaturbobooster_installer.exe

Digital Signature
Signed by:
Hipgnosis Vision

Authority:
Symantec Corporation

Valid from:
2/16/2015 1:00:00 AM

Valid to:
4/17/2016 1:59:59 AM

Subject:
CN=Hipgnosis Vision, O=Hipgnosis Vision, L=Craiova, S=Dolj, C=RO

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
74CB8A9F6210A537EAE293153461ED0C

File PE Metadata
Compilation timestamp:
2/24/2012 8:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:MAzcM+HfucCo4t3YFtT13oKv7qwNaOh7u9XqMuxT7IdchlDZx:dp+HtCrOtT14K2IaGuzgfK2X

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file shareazaturbobooster_installer.exe has been seen being distributed by the following URL.

http://www.webspeeders.com/.../ShareazaTurboBooster_installer.exe

Remove shareazaturbobooster_installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.