home

Songr_2_0_1977_Setup.exe

Songr

Xamasoft

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from global-shared-files-lw.softonic.com and multiple other hosts.
Publisher:
Xamasoft

Product:
Songr

Description:
Songr Setup

Version:
2.0.1977.0

MD5:
77969b3cdfcdda9b8b39ef6f695d26d6

SHA-1:
19f25654979bb02c8f1c2e941f1ad4b4fd649f41

SHA-256:
d1485e016ec0481a85880e4d1315e3a326aad8ac8dc16655509e0e97dfdad5cf

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
12/25/2024 3:23:05 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/DownWare
7.9190

Rising Antivirus
PE:Trojan.Dropper!6.3CE
23.00.65.131220

File size:
5.8 MB (6,100,899 bytes)

Product version:
2.0.1977.0 (8342b1c43bcf)

Copyright:
© 2009-2012 at-my-window.blogspot.com

Original file name:
Songr_2_0_1977_Setup.exe

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\songr_2_0_1977_setup.exe

File PE Metadata
Compilation timestamp:
12/5/2009 8:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:Z3ebvV9fFVMUmVHL++Wl6WwuG+Llg2bjCCVQ+pko0gxavW6f1m4YfMJ:JebDfMUmVI/DG+LlgG1fpkoLxdOm4YfK

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file Songr_2_0_1977_Setup.exe has been seen being distributed by the following 12 URLs.

http://global-shared-files-lw.softonic.com/19f/256/.../Songr_2_0_1977_Setup.exe

temp:Setup De Songr 2.0 - World System.exe

http://songr.softonic.com.br/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAM74JgN2d3OZsCaL2BYWi jx0xxgtGNzRJQe5t3nl Qq8eORDO/9Yi FoIk2sPfh9VE2zVsf45PvaBJvVlvd9hfpX0m9difQH6KMgcGpctAjpmsuUsOfS16RFq YU89Owy49YAKCz45z52g3RPpU JuW0VUFgIODnQqb1J7u9/Umc8Zcu 5OFgUmUI1f54HX/kyrMlrLGFFzmRlAELq1REYEkd20sRS3IHNViv67Mf39sX4W8AcR8Hf6hjqg5JMNeT4kKeHOd3bZifeukvSkZLsdgOugyb7mWbMKQtsX wnJuImEFfeb2nITBwLQMChP8xMl8WGFxfvWgbsoU6O2hauTlqH1/.../LORE8E9feyKlw==

http://gsf-cf.softonic.com//19f/256/.../file?id_file=88221&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=yes&SD_used=0&Expires=1408626201&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=GPOkPUtqOZUFLxWnoQTqRWJFaW2sqTGSKSx9EEU86uUFG4bKuT-RyElHSGXTZ6Bq-9F7wyoIMzvAK6oRp0AocgL48i-lFU-Z2d3MH3~xTQYrdvdkqBxf9v1tjU2LfQeSN-2kMzWgufrxSS9y4sfhjyqLWa2Ub5oifHeaQYfFe3o_&filename=Songr_2_0_1977_Setup.exe

http://gsf-cf.softonic.com//19f/256/.../file?id_file=88221&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=yes&SD_used=0&Expires=1406336549&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=JsqqUoC4z-0n-1BzauT6K36UV6wVyVCR8xVb9t6BrfpN9m9Q8ZXYARSudw1bUwnK71fT9XB27Pf-9RIRsojtZuSrXLJIHu~OxjmKQ2rcXIFI5Q4LvU1NqUeLoNb8sobBDaVfVXMXl1zzW18PA8lPkSXR0pp29p1UStVyvXWfyj4_&filename=Songr_2_0_1977_Setup.exe

http://inndl.com/download.php?version=180714&domain=songr&name=Songr&icon=aHR0cDovL3NjcmVlbnNob3QuaXQuc2Z0Y2RuLm5ldC9pdC9zY3JuLzg4MDAwLzg4MjIxLzJ0X3NvbmdyLTMyeDMyLnBuZw==&ss=http://screenshot.it.sftcdn.net/it/scrn/88000/.../songr-18.jpg?key=api&url=aHR0cDovL3NvbmdyLnNvZnRvbmljLml0L2Rvd25sb2Fk&os=&lang=it_IT&desc=T3R0aW1vIHNvZnR3YXJlIHBlciBjZXJjYXJlIGUgc2NhcmljYXJlIG11c2ljYSBmYWNpbG1lbnRlIGRhbGxhIGdyYWZpY2EgYWNjYXR0aXZhbnRl

http://it.win-install.info/songr/download/.../13526

http://gsf-cf.softonic.com//19f/256/.../file?id_file=88221&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=yes&SD_used=0&Expires=1406774465&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=GnB-53ViJOhrLYu8fl-DuCjmdUf-6IfQEl9No89gMMJ65mS487K72UZLtXiviRUtVsK1UpgpY-CXcEzI0QghazEhYoEIU~285p6sF96aoFb67Obcp2ukIppF8uZ-z8R-T7SCfZPUIJv35MLlQVr3tM21ZMKU9wLgNRffiziDCCc_&filename=Songr_2_0_1977_Setup.exe

http://songr.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWvzmIuNYSzsW6iVYaWbJ/YKN7miffXHvG3/Q7vjRjgk2WQTfyktDnVEu5N5KU6Js6g ZaRxd085orR17pYQdklLdbugyQ8 vp18CIhTBrrAadtj9X3D5Qbc6TNyDZ4pleN8bqOPiMMLmI2FJsH2VMTrStz5HppPeWHU7MnLnw 2qdLjh1RyIc0hIOTZuIw859wK93R LCwFRctoL8h3rbGC/vypy6z6Eya1kS fSbnx8jQICMQ1CIDNK2i TA23Jtuubfdm2IwtQMd6N36d/OMCg0X/Ajy0h7toAuw24OSzu/YNm4EKNoRvNY88x9gslEa6uGNkCJ9Hi8WirONiiNvtB6nBOU2SBvNySVIXWmD00ztO3j9YehY4kFA2Q8iBGccefoUhczo/.../LkYOsBMZWClr6VSs7gaMA5rzw==

http://songr.softonic.it/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAOpGwrLp/IeWX2HxpdQXkclSyo66DjSuRKzMP3LrNVCXBEumZE/7nhzVjvGDWp1ZXfiBUJHxoWm0umnfMVmNhvWZQxfWvoQS5tsqn/1CQDn/809hNuw BO99xft2KdxRBIkWJN8lFp/DYKLnKIJuDf2b77HFP8TklrueyZS26zkPek8WE cJZ0kGqbAbfQilY3kVW36FX04 aGzfCFHif15psIVNsFzTozeLNFH39Sf6W9LiBXXzyEOMIivqBBZZZNIzINsatiCrgyjWzmf0fBTk4BW3V2b3xNvj119qE2Wp8n1SSFyNSjADeWU7K72j4GleX9u1j PrKxwyVnoHK0Y8If5YCkmE6HZarW/VCnPn2gOG5pRCIEdomj4NnRHvSEg1TYkFYDwRdjumnb91nWk2r67Yh9MqfRPZxEng3wE8dyAoZAXJ sDhBVbsfjfl/uv4k1Uan6hojawDmfxdRZ2o4ht3V9f7t71ky0oWS/.../Q6 V8leqNEnmrK0uxn577RIFGku qO5iCagFqp4yvRcZSRcgTu6pTP0Lio 65YxQLlvlrCCtY fJsVOAyOT4Uv80tk2SF1U0YNLyEPJwGfi3dhT1W0=

http://gsf-cf.softonic.com//19f/256/.../file?id_file=88221&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=yes&SD_used=0&Expires=1406995114&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=QUofGc6deH0Tk-bP92tW9kN6NEjttg96SRJXTolAg5wDlysAQ2E0pLE7cIBwLpnvVMqURv130zoXbvbxrG3kQE7BUE~jC9a3Jw6gJHjo0GYsiRHPux3kL3YH6tO~Aj7LrJQ5nMqwGegObFpwmGHSst~qkahZYEHP1AxQvK-bheY_&filename=Songr_2_0_1977_Setup.exe

http://gsf-cf.softonic.com//19f/256/.../file?id_file=88221&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=yes&SD_used=0&Expires=1406701619&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=QdXu5RvEaH62Ane-U8-f4Cz-YWcbWA3ugF9z-u-9xYPTqwDN2uk-8Ac3VzyXbq9UyX2kEZCjlxQWrskB-361ENRFnX-C4CD-b-9GP3Awqz6YKVKjozjHaD88KrgJc~CD6hw8BkW19AT6wPFzjXeVq2ZJefvH7Lxw~GFxR~BsFkM_&filename=Songr_2_0_1977_Setup.exe

Scan Songr_2_0_1977_Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.