home

unipdf-setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
4949be47b98b2cd8ea96016194658a17

SHA-1:
298f41ee98b8c01f615a8039fb9fe0a13c22a0ae

SHA-256:
474c24674cabe3bc9cabaf680ecb2834aaf44cd63f231afc98d853dd7d634742

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/26/2024 12:27:20 PM UTC  (today)

File size:
5.7 MB (5,979,208 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\unipdf-setup.exe

File PE Metadata
Compilation timestamp:
12/6/2009 9:50:46 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:z6l8FeK+38Xeq8UQEDqXWs2zIzdw3ZeqawmPyULhH9Svv8N7BeB0R2C9UZirEjEh:z6mD88Oq8Y4Ws2/ZeDbzGMei9EirYE6K

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9626

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file unipdf-setup.exe has been seen being distributed by the following 17 URLs.

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1422368510&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=BnkwW2Xohz~IiGqQY2~PXz-hj0KC9c7jSB37CNwMda-6s6zDGdJcuRtj-Mewhm9KWenDCHa93FWaUHNgU--UQawlfv06rz3taGUr1bs8sJrBTxnEIm3IgchFpz5~z~llw1VWliODkTvUYBpBdksfjLoxSmJOFbIICmw0R1k80To_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1421977159&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=EkO92tnLlW~Ti0iVK2yNVrTnYfLhtoJ~WgAqWYss1j~C54uwPfcc0rLxhG-ULB~o2uyn-MeWNha~G1DRwvPIfXnyTzdNByRalWyqtpywtFQ3tfDsDxYCAn7vO6sadMxLsGB~jiCvyKNusrmeVQzP4TfMTR9b5KcHOwUKLy5tkck_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1423588399&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=i0F2HGVEogBtnVqyFsMyFJ-eDxGwAfS0tRoaGO4M5r2d7WIp5LLqzbBYC7RpWTNB8P8dUxYcxXOKCoiJkYian5ByIi75t5X~Z9f~qlFIeLLPWMM5dek9Qn98Uk1umMc7kQCRYHB4aMDuZm9Uc5m5~FJZd7JpIhCErsXL-qzkt8M_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1424891411&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=iszmLTa3EpO6GjE-6TbFoPiRjYpqb-BMMZvBdP~-6blDTc0ir7cK34B2KfoZGcMH8wTZEPcuiHvsN9Yjdua9Y~eZW3656jmt4dY2QfqHq4oEq1w-KaIMc6GQlv7-Iuv3NFCoAtFoixUG4o3KF9XxMVVfK0Gd9lQPscfSfA4wiZY_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1422575127&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=QPc~Jk1M-LXL4qQZjxdjYSscL64mowkedFIrfSJP2~35jbY7cJlS66VO~Z5btBfAYC3ROnJvCNXQFArDoW0REi-ST0p421c9ou67r2ImQp~oOsy~I1I9adoJOZtFeQJakI-tgKojYHCTL~dPfL8XowP5hkKCcLpZQSOViopMBUM_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1424231886&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Iu~dBLEQRdlwI~E2~xM2rbg3Ow37s3becLY3RJhICDVVr5SLAAO1yx-PyxQfznNx5ZJ4rDyJtjnJKtPtLJdeJDm4j87D8Qwi0mjz-zGBTVtrO1yQtD2CF2GkuHGqmujuYMRCKIXkaVo9Vw7gmKJ5PwSKbNjtX5XWcD8ewp2DMSg_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1425597502&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=PMkjqrsAc8780AqyETPuAaBQD4Vfe4PKYQAntYBu3Rm8Wv62Sz56A3r75bO0eoC4RhG1VDgCJN9ykPkI48iXS7niTNo-IY-sb-nQKmTPk~MgsPielNp0~YK~xdSYXhTQMsJeX9U6RT3F8p5P5gGCPyNt2E-vanMURouXVNOrfwI_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1422861091&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=bHgavN-nfi94~itXf2JHYRvSXZGqyiE2XEBltDYtV~TFZJxJkUCUjnLwgCOmeRJhnvZDVgMJMdY1WKth~Zvu6x2P06xeGB5rsOdpwvZzslUqebLDWS2tDdZY87AAYKOkO7YvHSx-HSB-V-IcicpZaj6PdqirRZJJJvLz4wTt6OI_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1424734694&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=NV36MYEjOpyeTzgSRfxIn5yxxXmEtfaRI~0jeUJZx4aFN-XVR3ImNHgxI3M1aEd3RAnivawaz~J-NNVM27MEKIdTlzIwegnp17vQVhmPIlNRAOkUiBseQwDEH9Lp898sKwBdWe06EgK1GlRYCXFkc8cnj0jMKPrMvj2PTncTidc_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1425908539&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=BIRG-voaVZzIMi9RBDqFsyrvZt8qFboQ1teH4tnYMxhLHOrIzQTZch-9onmn4Mxk6cBxG84netdxjuStkiNAiHKgXKNr03CioB82vX4QxjQrg9XqkBdXgkg-Dhhnca0XrStbBvz2e8iApkxI57Ev8gPcT2UTDDx699YcO4a5y3w_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1423006048&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=SeaJOf~EK6dxJRlQkZ9UU0Lel23JuJRnX9Y2QdIY4OiCR5iY5UC4UrFlzR5UTd83CpTxIm-mKXv~AXgsB-M4h1k8yAkd29x12f-OMfwzxnfC684OrRA9yR0-KmrYzYeLVJ5zwVnaahyEIs53Ui5hYA2AywL-fXQKI5ICd2WozwE_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1421351488&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=KFwiJWNrJvarAdznm3LC5UPjJwBhxHytapfaQdDsUERxThFRxPSOTZlvlYiPQRWp3KfapKVu1X8wW2ZNTaYg12NgIYW9vtkEY01HyG8ues05itLQbwu3Mr7Lo3rcevzeN42W4ux6UEErprZJ-zXCYZACSR~SI-jmsv-mt44j-ZA_&filename=unipdf-setup.exe

http://gsf-cf.softonic.com/298/f41/.../file?SD_used=0&channel=WEB&fdh=no&id_file=6651076&instance=softonic_es&type=PROGRAM&Expires=1425567933&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=FLmD3Nl759plez5TPfWSaM8C7GeeMKx3uzrQvnMR3KYxCSlAx06VKQoR2tBlTPesSC14iMsVTRb8SsqEFjr3RlQ~dMSTmOfdhaRKFmquiHkJBfJlWmq2mc3eaYKJVzcYi3ci9Qrjbh1NoEmtJdezIV8YuMc-nSnsECKjFXZpkEU_&filename=unipdf-setup.exe

http://www.ricercami.com/.../unipdf-setup.exe

http://software-files-a.cnet.com/s/software/13/11/13/.../unipdf-setup.exe

http://www.sharpnight.com/.../unipdf-setup.exe

http://unipdf.com/.../unipdf-setup.exe

Scan unipdf-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.