home

spotify.exe

AVSoftware EOOD

The software installer uses the StartInstall.com download manager which bundles additional adware offers (toolbars and utilities such as the SafeSearch toolbar) during setup. The application spotify.exe by AVSoftware EOOD has been detected as adware by 2 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from s3-us-west-1.amazonaws.com and multiple other hosts.
Publisher:
AVSoftware EOOD  (signed and verified)

MD5:
9973179c6dcf185e8cc7cc2b46b1d9d8

SHA-1:
b9980fdfde9b1c7ff0da48ed458f15c67c117f45

SHA-256:
0d8ec191e8b3393f79fbf716018742dbe6777180d343382483212b2864af4da9

Scanner detections:
2 / 68

Status:
Adware

Analysis date:
12/27/2024 12:40:30 PM UTC  (today)

Scan engine
Detection
Engine version

Malwarebytes
PUP.Optional.SoftM8.A
v2014.04.13.02

Reason Heuristics
PUP.AVSoftwareEOOD.H
14.4.13.2

File size:
967.1 KB (990,264 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\spotify.exe

Digital Signature
Signed by:
AVSoftware EOOD

Authority:
VeriSign, Inc.

Valid from:
3/4/2013 7:00:00 PM

Valid to:
6/3/2016 7:59:59 PM

Subject:
CN=AVSoftware EOOD, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=AVSoftware EOOD, L=Sofia, S=Sofia, C=BG

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0EB840FECC84AE6DCA7A92109E2314ED

File PE Metadata
Compilation timestamp:
1/15/2014 12:04:01 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:IZ9i5jjzM+Om+RVubr707VWKbtPwUbynsMISv2E:69i5jjzO8bedZmsMTvh

Entry address:
0x2FE190

Entry point:
60, BE, 00, 30, 61, 00, 8D, BE, 00, E0, DE, FF, C7, 87, 18, 0A, 27, 00, 1D, 24, 62, 18, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46...
 
[+]

Entropy:
7.9218

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:
944 KB (966,656 bytes)

The file spotify.exe has been seen being distributed by the following 2 URLs.

https://s3-us-west-1.amazonaws.com/.../spotify.exe

https://dsu7x9k8c43un.cloudfront.net/spotify.exe

Remove spotify.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.