» uTorrent.exe
Overview
Analysis
File Details
Behaviors (1)
Downloads (166)

uTorrent.exe

µTorrent

BitTorrent Inc

µTorrent is a free ad-supported lightweight BitTorrent client. This is a setup program which is used to install the application. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘uTorrent’. The file has been seen being downloaded from cfile21.uf.tistory.com and multiple other hosts.

File name:

uTorrent.exe

Publisher:

BitTorrent Inc. (signed by BitTorrent Inc)

Product:

µTorrent

Version:

3.4.5.41821

MD5:

a91ced397a1e576a2b2a53c3fc0b939f

SHA-1:

0e45589bb9d62d7393eabafaadbe5c17ccf73d6c

SHA-256:

22abf012ed8a3ce308c27bad1ce3f7eb26932562d9be6559643aac06776e346f

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/23/2024 5:07:46 AM UTC (today)

File size:

1.8 MB (1,927,680 bytes)

Product version:

3.4.5.41821

Original file name:

uTorrent.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\roaming\utorrent\utorrent.exe

Digital Signature

Signed by:

BitTorrent Inc

Authority:

Symantec Corporation

Valid from:

1/22/2016 12:00:00 AM

Valid to:

9/4/2016 12:59:59 AM

Subject:

CN=BitTorrent Inc, O=BitTorrent Inc, L=San Francisco, S=California, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

59123D60D39E60127D6B456A62C9DEAC

File PE Metadata

Compilation timestamp:

2/12/2016 5:46:24 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

24576:UsqPFTh/oMIX9nBIKlRQ4SKov7UJXUAKvOeItTKVuR/4DRLXb8G41JYDrmQyf+wx:UsC34hBIKM4EICTvgTeYwVe1Jermx1

Entry address:

0x4D73F0

Entry point:

60, BE, 00, 30, 72, 00, 8D, BE, 00, E0, CD, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 97, 5B, 4D, 00, 57, 83, C3, 04, 53, 68, E6, 43, 1B, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A... 
[+]

Entropy:

7.9832 (probably packed)

Code size:

1.7 MB (1,789,952 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

uTorrent

Command:

C:\users\{user}\appdata\roaming\utorrent\utorrent.exe \minimized

The file uTorrent.exe has been seen being distributed by the following 50 URLs.

http://cfile21.uf.tistory.com/.../250AFC4D57D565B4080F8B

http://www.2016delivery31.com/c?x=XE9cI2zaw/7Jrph2AaeOijiJLAR27ZKSpXAMaxIM05w=&c=cyGm/bJiT2bp5Hmwp5fRUH3zStRecxNhf4pf0YTK5YC YtakDOaWr6h/cGlfQ6sPiHQhl19fSmE HNb0mLujSEULdG9maPoLIzlOedFj1zGVclgczgzBs2a2jpcHNw XsnEIap8/tiGhqtDdR6IzQaPHbbiX6MLgpsPR2ddE00Q=&downloadAs=utorrent.exe&fallback_url=http://utorrent.fr.downloadastro.com/.../?utm_source=ira&utm_medium=error_generating&utm_campaign=utorrent

http://filehippo.com/download/file/.../

http://download.ba/load/.../

http://filehippo.com/download/file/.../

http://fs33.filehippo.com/9620/.../uTorrent.exe

http://filehippo.com/download/file/.../

http://filehippo.com/it/download/file/.../

http://dpcdn-s09q.pl/.../uTorrent.exe

http://fs12.filehippo.com/3513/.../uTorrent.exe

http://filehippo.com/download/file/.../

http://www.tamindir.com/indir/MjAxNi0wMi0yMCAxOTo1MzoxNw==/utorrent/windows/.../

http://indir.gezginler.net/i/4088/.../

http://www.2016delivery31.com/c?x=lrD5Oe8H nB4UEAjvfZ6hw8TdiiMBKGr5MiXTyNf390=&c=Bt44r45ABwVfwAfL3L1zHNNK4NVaMkN3ZZsgmotQvgG4PkSPPWgUZtbQwvhM5yHZevJWtl41Bh 5l7YFL6PMrm 6/izUI/IzJR2eCwSV0cOCNuzsebT3vD4yY6WQupn67zTGjk5SQOljUx5O95Iy6g==&downloadAs=utorrent.exe&fallback_url=http://utorrent.en.downloadastro.com/.../?utm_source=ira&utm_medium=error_generating&utm_campaign=utorrent

http://filehippo.com/download/file/.../

http://fs34.filehippo.com/9110/.../uTorrent.exe

Latest 30 of 166 download URLs

Scan uTorrent.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.