home

unlocker1.9.1-x84.exe

The application unlocker1.9.1-x84.exe has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
15ec2c9da6d4ee8f4089f9b00f923640

SHA-1:
4b2bba40eb768132cc25820a9d3e22b9bf9ba8ee

SHA-256:
19c975dac068e803d72626bb5d44169ca07660810f091ed32683b78455bc69a9

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:
11/15/2024 7:59:40 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Malware.Win32.RiskTool
4.0.3.1421

ESET NOD32
Win32/Toolbar.Babylon (variant)
8.9363

Malwarebytes
PUP.Optional.BabylonToolBar.A
v2014.02.01.04

VIPRE Antivirus
Babylon
26002

File size:
1.6 MB (1,681,749 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\unlocker1.9.1-x84.exe

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:+gIGv1UlRIpefopdvS5uCnJnwn1fy9qH0JfcmvpO8ikla0CDghz10LDIdwQ:/Unrfobe/Jws0HwvpOcDCDghZEDIdwQ

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file unlocker1.9.1-x84.exe has been seen being distributed by the following 49 URLs.

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1434151834&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=MTrOrN4OEmpV0G0mMih7XUzeGrRG7VKh0THVqLQvVOpLlwszKa3DmXIkiR8QVdoqCnv5NUKgDSzkby0y33UqgqXjCWzWWDlWkiS4SIdCusAuOhZHMo-iFeXTGON95IlGbXoQsfUiDvBXvW5xe-u~guJJvYYTZtV0KvzfC5FBvkE_&filename=Unlocker1.9.1-x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1457743711&Signature=OY1muDwf7sIdHfOKOD9IY6XO0GXvSpFzIw9Gp4FRc6tBZT122Avnfz9UxJbisCcXlkUXjnHVMGn-Yx99O8278FSE6G1pWdYdrUTdeiopmBjBlSR-FSUUzTssyApfvUa1CFgDL1tnJFUVd5P5WKrZ-rCFpcJGwlumVPwLxkb4Ip4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1482283382&Signature=PX4HczJF0OMwKWYT0f0fgRB-aHKVOksum3gcGd8Clac89bouaLe5ssqQjEU~FvBeZVom4~25~gPb8BBLnoWrbHQQzyc4FiBVrXNEIp6HCJ3wd353MzZo~p5cdDch9ZTNNB-k76JxyLnUHR3mVmwVvOvoxxjGSxsGN517Yqtjt1g_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

https://mega.nz/persistent/.../AMwHQaYC

http://megasoft.uz/.../8889?1472063762

http://usfiles.brothersoft.com/internet/.../Unlocker1.9.1-x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_fr&type=PROGRAM&Expires=1452383293&Signature=LCt39e5OK8ivJZUtSCBHxG8h3wN5j-1JtZ32qsomI3rx2wPFwfVeTpSSE-QKSoGCqUDGHl5x3FRQ7czd41Q2QG62DSrHMucsSlZzADimQLjeTHq0VXg2FMok4eGRrcWo54W19asrHE~Pro-nzs7QKH8COGyj5hMBp9M74O6pj7I_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_br&type=PROGRAM&Expires=1453046665&Signature=ekl4JQKEoCgI4OFjLA9B55KKEy4CGUnzE7AsuTnNk~cluknatrU5jeJwQ3DaSOyOkAmLziON6oYR4LRUvpGy4KCL139F7CMv3PK49ZLP~625tdBFU2~HWyqyECz2pIAY6yx8iAktnpPtDIt75lcEHkeaEIovC3G-G3CqBcKrSIk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://download32.mediafire.com/zj9cbld9bmig/.../Unlocker1.9.1.exe

https://doc-0c-4k-docs.googleusercontent.com/docs/securesc/v2r610ajhgknuo3cenn55mh4k13adqul/j7griqc9d9ijqu8pfdjo8am6jalurmr7/1446148800000/05235964883807249826/.../0B5Wxunm6jgbRdHVkRGlIVnlmdFE?e=download&nonce=6isnmcvb87gd8&user=10604926251617629829&hash=hnehrbo0cj9p7aobovbu1n1iadb5dq5e

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1454884957&Signature=DiCnRYpeCjNo1184QmWkMVJOnubMyYCCL4aK7YQXlHkquZesjQfMkP3lLvnM38R1JeyCWkPPhIuh50FmLxllHTFtJTRHpvugfZwO6Q9rSEn4XA3q1qxERo7E2Kt~XrbGcVYK4Nmf5jG4uu0g7CmEEGBV~6JTMxjtI2vD5MIEd9U_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1441506246&Signature=YzlEEM5NzkUlDUywLvhW3N7whFMlrojhTtTtnYSurRdAVJkcesgPQfYFJFJDaPBeOER-pUdrceRkT5vH3NUVr24dA7sJawA2i8CHDoGKEX4EogHVEPb1hN7~fE4ThHrPlS59AYx5rhs1EF5~CFtfvFB2M7P9fRKDzLEK13C2zu0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1451729234&Signature=Pf14E2YW4sKxNZbXsLfdxyI2Uyguse7gnYAOipWB1OkxwyJFcE6bVBy~Z0tODlEctmGeEwVmimC0fniBNGrFAcysKK2NvRqcwGaXT3I4Q3japkeWF5DxTenaXT~dHpvFQt52ClHza33XZhzVUagzZ82xzw379W890qIwa4dHick_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1435120332&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=bYsIXVnwPTiD-NBXF7xjg528xyQ3xL1jKWV5ScQQF9OroXMrud1hRb9asQyabhOd1NiNOVxaCScAxII16MtdRo6ksYB9JBzwvM79xgEOgiviU5kmaDeKCcMlx6bpyszYpb9cmxa1L2~iv7EprKlq1k-46NMkAk0QlweCJwgI9~4_&filename=Unlocker1.9.1-x64.exe

http://205.196.120.221/46dptnylrpog/.../Unlocker1.9.1-x84.exe

http://cafeattach.naver.net/6efb72c2d28d8a56789affcdf0146c16bde01ff9f5/20111231_30_cafefile/.../unlocker64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1450174596&Signature=IpNh8Om5H6gjcT43g1O28SLWAJn9IM0rHbbkHEBx7Thz9MyEb5o9eByLYWh6cOu1WIIqWyv97HRuFPtN~Uap5QfUOfvkIeY7rbV6Wd9v7mzZsBZETwaAwiOMwIjQd8yNNCpYo9kq0qOTcCKC~4u046-Rgu5HKCc9LVoK3Rp9NSA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://cafeattach.naver.net/6efb72c2d28d8a56789affcef8136a12bce51bfefc/20111231_30_cafefile/.../unlocker64.exe

http://ysoftika.com/.../download.php?id=292

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1449717665&Signature=Lm1jhV96JqrezUi2up48aN65jWHGEGUnNpSwmA-2VrWiHN1Q0SExTeEiRP1ss8n3N~0vTLCROybBcxvUcSbG1h7A30-49BxV0VFckjWlpsAEYLNOO2A3YNcNKErC6psSmGFWT5lrgqqx37MRql8UjGvz0E4u1A-Sf2buLmhdQiw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

https://mega.nz/temporary/.../AMwHQaYC

https://mega.co.nz/temporary/.../s54yDQJa

https://mega.nz/persistent/.../HZM2zbKY

http://www.bdjh.kl.edu.tw/web/phpwind/.../index.php?c=attach&a=download&aid=229&submit=1

http://cafeattach.naver.net/6efb72c2d28d8a567898fbcef3156f13b2ee1af8f1/20111231_30_cafefile/.../unlocker64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1440655969&Signature=Uq50x4AJvfh7jsZJcqnMixg2XWoDMARPfRFddNiyevkkWLXheQw-NreYbf5mlEZ~xnGB5Op17oj7jPjJkAQV78saa6vM9rVt8hm0SoHUjIWvBHoGghLcetbV2N4prK5MpEhQ5RdkNndepIEwjxsfBxa5gGw33QD0Mxs6CMGIp0I_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Unlocker1.9.1-x64.exe

http://unlocker-ru.com/download/.../Unlocker_1.9.1_x64.exe

http://gsf-cf.softonic.com/4b2/bba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=321226&instance=softonic_en&type=PROGRAM&Expires=1431461630&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=gYe1fCQblTyIGefmt8LZwqWyumKaehtZ7uG-~S2NLN1kaBiZmQOCm7jaN4k7e3mXT23ec0jlUtt0Xs4icEf97CNXtl44lrN-rCphT5YO5iPblVSPrJQGP~YcaDmQdgTMZfSYOLWQo-blFZHF4rYHjaHER~VeLZwYmCCGRHHl94U_&filename=Unlocker1.9.1-x64.exe

https://doc-00-50-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/41utvhj3prinbrup48qkhipi9gr2g3u7/1425434400000/05235964883807249826/.../0B5Wxunm6jgbRdHVkRGlIVnlmdFE?e=download

https://doc-04-1o-docs.googleusercontent.com/docs/securesc/5be9015va9drufeqs0ddm1vh5erbnjti/631hl4ac19vgnr3fqu3g8r12gtk6kvsc/1410580800000/05235964883807249826/.../0B5Wxunm6jgbRdHVkRGlIVnlmdFE?e=download&h=16653014193614665626&nonce=vmmcnngbamg0e&user=06943562531578405978&hash=9p6sofvdjj5eldjevhkvhrm76leal8l2

Latest 30 of 49 download URLs

Remove unlocker1.9.1-x84.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.