home

sosintwr.exe

Steganos Online Shield

Steganos Software GmbH

This is a setup program which is used to install the application. The file has been seen being downloaded from www.softonic.com and multiple other hosts.
Publisher:
Steganos Software GmbH  (signed and verified)

Product:
Steganos Online Shield

Version:
1.4.9 Rev 11082

MD5:
6187f4a3b908f2d81f5b014df4beb7f7

SHA-1:
0b794fe109c0a6d3ab7340d617dfe356cc62ca83

SHA-256:
3acf6010dcfac0df7b2e155a32c8d5678f737bb01ae62e64fc80c45558e0075a

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/6/2024 4:53:42 AM UTC  (today)

Scan engine
Detection
Engine version

NANO AntiVirus
Riskware.Nsis.Adware.dqabed
0.30.24.2086

File size:
35.4 MB (37,143,560 bytes)

Product version:
1.4.9 Rev 11082

Copyright:
Copyright (c) 2014 Steganos Software GmbH

Original file name:
setupwrapper.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\sosintwr.exe

Digital Signature
Signed by:
Steganos Software GmbH

Authority:
GlobalSign nv-sa

Valid from:
9/10/2014 6:10:01 AM

Valid to:
11/3/2017 7:55:47 AM

Subject:
E=certificates@steganos.com, CN=Steganos Software GmbH, O=Steganos Software GmbH, L=Berlin, S=Berlin, C=DE

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112127389AB528A3A8EC995621C824069818

File PE Metadata
Compilation timestamp:
9/17/2014 4:08:33 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
786432:1kf2+9tMIhSN8TSIcnLPDNR6Im9ghA66rFE28bSPCv1dXxkVc:62lIhSqT6LPC4A6GFE2oD1dhkW

Entry address:
0x10746

Entry point:
E8, 3F, 8B, 00, 00, E9, A4, FE, FF, FF, 6A, 0C, 68, 80, 85, 42, 00, E8, A0, 44, 00, 00, 8B, 75, 08, 85, F6, 74, 75, 83, 3D, C8, C5, 42, 00, 03, 75, 43, 6A, 04, E8, 29, 8D, 00, 00, 59, 83, 65, FC, 00, 56, E8, 51, 8D, 00, 00, 59, 89, 45, E4, 85, C0, 74, 09, 56, 50, E8, 72, 8D, 00, 00, 59, 59, C7, 45, FC, FE, FF, FF, FF, E8, 0B, 00, 00, 00, 83, 7D, E4, 00, 75, 37, FF, 75, 08, EB, 0A, 6A, 04, E8, 15, 8C, 00, 00, 59, C3, 56, 6A, 00, FF, 35, F4, C2, 42, 00, FF, 15, 74, 40, 42, 00, 85, C0, 75, 16, E8, 2E, 28, 00...
 
[+]

Code size:
138 KB (141,312 bytes)

The file sosintwr.exe has been seen being distributed by the following 6 URLs.

http://www.softonic.com/sads/tracker.php?ev=c&co=EC&sid=6303d03fea638697e067327e6a0bb248&upv=20dc77cd9eb7d475169e1f7c2ad108ff&z=list&sk=3130&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAC9B15663BFCC32A4B420C96190DC24F26BD8E26C5D6F4F4776204997EBA3AEEACB39829447002032987B9E72DDC327B941E32618F899B357F19A2333AFF2C2B70A688B39D34DD8837DA677C71EA53A55A410F15782F90276FFD15F69C1919ACF8B667D08317071F802683641F4B3036E032A293332F2933461FD186EA06A7807B7391396A3483B70408AD1141EAB340C&h=225CF47C02DED33B586C301988B083EB536278CDF2456DB3B4EE3E634C210C55&directdownload=1&f=69687091&d=http://www.segurisoft.es/software/Dwl_portalsa/.../sosintwr.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=CL&sid=b3cf51f81e15e46086a05ac9016e9b5d&upv=0be92eea2914986984a2930d49de466a&z=list&sk=3143&abt=&eid=&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAC9B15663BFCC32A4B420C96190DC24F26BD8E26C5D6F4F4776204997EBA3AEEACB39829447002032987B9E72DDC327B9BF4E575907E19A35222ACA51D26D5F00D9ED3389AC93ACC1950DB29413258A134FF0121FFA755A1E785AE016869397A5C0FDA3C7B1DB2D266EBE3B477FB70C8E1135A2E9B6F0821C45E8E827DF02D07587A2ECB5B78DD7C914815C796BEDBF09&h=197A7E8D0781E84AA5798DCCFBA4F6F19A23CCB6A3CF3E5A83B829A7017037C7&directdownload=1&f=69687091&d=http://www.segurisoft.es/software/Dwl_portalsa/.../sosintwr.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=CL&sid=e9452463e0c0e88d6fc446eab5ee9dc8&upv=0ab2c3aa05d1416619b658e836fcdb55&z=results&sk=0&abt=0&eid=ADC-249&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAC9B15663BFCC32A4B420C96190DC24F29D8DCFC887A6B7D4C37E5565540E7C0D81F88CEBEBE0EE5A2303755FE8BADDD252A14C5D62D0C234A7F8C8282E18587F3E1B4D723918AD2605C7A62F083D1E9914BDFD3EC95FDA2C5E399DBDA6078106C9351E693E6677C69E42F520AC350A5309FC9E479771CFB847B3706A57F829758C4C7BFF73F875694F1E529724C7523C302206B01F9138CFD1F7E7FFD457EB62&h=416908ACE1E3170238BA318627F3598E6A7FAA5CF3538C4534941FDCFF315342&directdownload=1&f=69687091&d=http://www.segurisoft.es/software/Dwl_portalsa/.../sosintwr.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=EC&sid=611c7606e15ab7551739a01de307d812&upv=423f738840f0ad1a20ea7589218bcec3&z=results&sk=0&abt=&eid=&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAC9B15663BFCC32A4B420C96190DC24F2501BE31379982EC6F31D9FACC0B5D980C385DAA670FA791BD51E9F01DD04F143B8E6F78B261746D7A89E194256E98E24647D790000517786BE74F6A217AA3ED80B27A84EAB683475C8783D381D3E528C26DD00FB15C4C9AA31B838AA835B9AC966577F877DB22EE513A10D0DD46FFE8CE8AFDA1B6E3C289121C57708AA0245BF5CCC3B191C83A76879764CC83E9B52EB&h=507C09AC48A6C8BDA6FF79C54B51B0A768D974735AC8205179C3CAFE4F94DDD6&directdownload=1&f=69687091&d=http://www.segurisoft.es/software/Dwl_portalsa/.../sosintwr.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=ES&sid=cf69af51ce9435d1f7f0536b083aa7a6&upv=e424cb138e5c616718833589491d90e9&z=results&sk=0&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAC9B15663BFCC32A4B420C96190DC24F23FDD137ED025627E5C16EFDFB59F84D07CE77273457DEB8C25545A65FB93211C0AC1920534A9774D17F34D9CFD8FB6177E4B1D783AA05A4DAE440C4737DE32CA7F3F5BAABC19CE36E635A7646E71D5D6667748D2A126F6B682FCA866608C82011733771BA0FB9B8FEDB89EA6370741C4AAC63FB4409C7BBFBE9F691F99D10FDB46CD7AFC2F3C1A297428C68851FF3814&h=23C144A229AF7A9CBC87421A520AA2BB2C81D389E649FCE5D934CC6F82E46CD1&directdownload=1&f=69687091&d=http://www.segurisoft.es/software/Dwl_portalsa/.../sosintwr.exe

http://www.segurisoft.es/software/Dwl_portalsa/.../sosintwr.exe

Scan sosintwr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.