home

sylpheed-3.2_setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
b54c98aad3ff9e358a94343570479db7

SHA-1:
c13284b9f2eda2eae6b1aeedd2471b22c20deb5e

SHA-256:
f194a75aa74c77cbfae8b8038ec3525c290d8aca8520501bb6adb384dcbbeacd

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/26/2024 12:09:10 AM UTC  (today)

Scan engine
Detection
Engine version

Rising Antivirus
PE:Malware.XPACK/RDM!5.1
23.00.65.14304

File size:
6.3 MB (6,585,630 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\sylpheed-3.2_setup.exe

File PE Metadata
Compilation timestamp:
12/6/2009 4:20:46 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:++LgH+5MkbD4mI2ovtu+Bk9RmkSfDpmZWL:+9HmMkbD9Uvtu+G5UDJL

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9992

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file sylpheed-3.2_setup.exe has been seen being distributed by the following 4 URLs.

http://gsf-cf.softonic.com/c13/284/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26728&instance=softonic_en&type=PROGRAM&Expires=1451076132&Signature=RnZ-AG3rtCs7Ozt0FpyxgxbR4nOTSP-bGxWnungR904jgP5LJlCbqtG4hWGtLiqXycTYhikQqRr9EwxX4blwUM9cQny3ksD~njplHWRlsNe2yyhx2lXrkNkFXjD0c3P-rvNqJlt5pZEeuj-fCxbZNPN1qCluooDo0vC~zULEirY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Sylpheed-3.2_setup.exe

http://sylpheed.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAMUnhv/i0wj45rzFtj1WTDheZ0spcbUM5sCuJpTvcPoYxcQITUYVWNTOaRwOHGcBP4VfIf2LjKAlac NMiTPHHuwiZ5JVZ2w3oCX0Szd c2YAwrbqXM6skT9X9uzWsvPvZWQphFFxTokcpWutQ8yLEHNLXXtt11favShlUgbNXhbDc0l7UaSZETwxb1W5Pw9fsY8/0AmEb q97KQXu6i3z3cBPWu3vtoz4Lp4a5uOgmrisykwROySkzbP6ZZz51nlUmjVbHljqTvth3ZzAqjpmXHlNGttCyeZOM9V/plZs9ZW39iX3WbMssBqjPlnS li6lTSAqyCz1Wsk4azOUgolIAE4LCskBxTkpS 74ZHKN90iemmigFtz2Ob D9VwuOZe9bsbXzrJskKbi w7rMpFE2x587S1lv9/rpTXcKNn6s3Ggy88UcY6lJmya29WiMJ9K/4cL6a6a51B mufFipHgh9ScxeKGphBt9fBNI8nCitDeHOU23esDD24WUbu0oflGUU5M7nvTYOzY85h6mM6MpYE4WVia29Mzlmuhy3z7c7L6gDwsPi/NNz9wkVwrAFWkxtQ3zPJpKlxWLOFbt1uxVfS 3oQ4A4hxi/.../VZViIPEY=

http://gsf-cf.softonic.com/c13/284/.../file?SD_used=0&channel=WEB&fdh=no&id_file=26728&instance=softonic_en&type=PROGRAM&Expires=1448853587&Signature=TNoFXZcEj5h7SwJmgO8r8Ii2WJvUVY5YSLEtdHOkgH1hUinsLGb0oZHiQVIidetY~4q-nBkV8zq7nhEhGg62UQy2Ql2IB0JPgrN6UuO4eZWVhyuVOLwMf2trdoLAsVn3bripmXtLgibnbvRMRdDk3fiiFcAOeTAasnUufPKb15c_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Sylpheed-3.2_setup.exe

http://iij.dl.sourceforge.jp/sylpheed/.../Sylpheed-3.2_setup.exe

Scan sylpheed-3.2_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.