» SlimDrivers-setup.exe
Overview
Analysis
File Details
Downloads (64)
Network (37)

SlimDrivers-setup.exe

SlimDrivers

Slimware Utilities Holdings, Inc.

The application SlimDrivers-setup.exe, “SlimDrivers Setup Wizard” by Slimware Utilities Holdings has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from filehippo.com and multiple other hosts.

File name:

Publisher:

SlimWare Utilities, Inc. (signed by Slimware Utilities Holdings, Inc.)

Product:

SlimDrivers

Description:

SlimDrivers Setup Wizard

Version:

2.0.0

MD5:

e9339599b7b7e24aa38d86f19c02f6e5

SHA-1:

5078a5e8792eb14834f1aacfb7ee2938d07a0a6c

SHA-256:

4ae1d63eadab9e6dc51c92e917aef293aa5f53628ad71340db2149374ff38dec

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/23/2024 6:38:33 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.SlimWare.Optional.Installer.Meta (L)

16.4.18.14

File size:

958.7 KB (981,728 bytes)

Product version:

2.0.0

Original file name:

SlimDrivers-setup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Digital Signature

Signed by:

Slimware Utilities Holdings, Inc.

Authority:

VeriSign, Inc.

Valid from:

2/23/2015 1:00:00 AM

Valid to:

1/7/2018 12:59:59 AM

Subject:

CN="Slimware Utilities Holdings, Inc.", O="Slimware Utilities Holdings, Inc.", L=New York, S=New York, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

246BBE812B36C137225497BA8DF178FA

File PE Metadata

Compilation timestamp:

2/25/2015 5:27:44 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

12288:oIZLwDshZ2p6j2y4LcmXjxEL/hPKHvcXqFApycRpB9EF3J8QN:PZ0S2p6KIE6LJEvcpyc3nEFuQN

Entry address:

0x2F69C

Entry point:

E8, BE, 76, 00, 00, E9, 17, FE, FF, FF, 8B, 44, 24, 04, 66, 8B, 08, 40, 40, 66, 85, C9, 75, F6, 2B, 44, 24, 04, D1, F8, 48, C3, 55, 8B, EC, 8B, 45, 14, 56, 57, 33, FF, 3B, C7, 74, 47, 39, 7D, 08, 75, 1B, E8, F2, 4E, 00, 00, 6A, 16, 5E, 89, 30, 57, 57, 57, 57, 57, E8, 88, 7B, 00, 00, 83, C4, 14, 8B, C6, EB, 29, 39, 7D, 10, 74, E0, 39, 45, 0C, 73, 0E, E8, CD, 4E, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, D7, 50, FF, 75, 10, FF, 75, 08, E8, F2, 76, 00, 00, 83, C4, 0C, 33, C0, 5F, 5E, 5D, C3, 8B, 44, 24, 04, 85... 
[+]

Code size:

300 KB (307,200 bytes)

The file SlimDrivers-setup.exe has been seen being distributed by the following 50 URLs.

http://filehippo.com/fr/download/file/.../

http://filehippo.com/pl/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/fr/download/file/.../

http://filehippo.com/download/file/.../

Latest 30 of 64 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to ec2-54-172-246-138.compute-1.amazonaws.com (54.172.246.138:80)

TCP (HTTP):

Connects to ec2-52-22-228-216.compute-1.amazonaws.com (52.22.228.216:80)

TCP (HTTP):

Connects to ec2-52-205-138-83.compute-1.amazonaws.com (52.205.138.83:80)

TCP (HTTP):

Connects to ec2-52-73-139-56.compute-1.amazonaws.com (52.73.139.56:80)

TCP (HTTP):

Connects to ec2-52-200-95-59.compute-1.amazonaws.com (52.200.95.59:80)

TCP (HTTP):

Connects to ec2-52-55-209-160.compute-1.amazonaws.com (52.55.209.160:80)

TCP (HTTP):

Connects to ec2-50-17-223-81.compute-1.amazonaws.com (50.17.223.81:80)

TCP (HTTP):

Connects to ec2-107-22-237-248.compute-1.amazonaws.com (107.22.237.248:80)

TCP (HTTP):

Connects to server-54-230-5-180.dfw3.r.cloudfront.net (54.230.5.180:80)

TCP (HTTP):

Connects to s3-website-us-east-1.amazonaws.com (52.216.81.58:80)

TCP (HTTP):

Connects to ec2-52-22-122-136.compute-1.amazonaws.com (52.22.122.136:80)

TCP (HTTP):

Connects to server-54-192-19-180.iad12.r.cloudfront.net (54.192.19.180:80)

TCP (HTTP):

Connects to server-52-85-94-120.jfk5.r.cloudfront.net (52.85.94.120:80)

TCP (HTTP SSL):

Connects to a96-6-212-51.deploy.akamaitechnologies.com (96.6.212.51:443)

Remove SlimDrivers-setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.