» v1.10.2-4159.torrent.exe
Overview
Analysis
File Details
Downloads (1)

v1.10.2-4159.torrent.exe

CamStudio Recorder

TOV

The application v1.10.2-4159.torrent.exe by TOV has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from s118f.storage.yandex.net.

File name:

Publisher:

CamStudio Group (signed by TOV )

Product:

CamStudio Recorder

Version:

3.1.0.0

MD5:

cc92ffb4ab336ce171203535b49f13d1

SHA-1:

b9fd841ee07e96ebcc9b8871b08aedc5b63773ae

SHA-256:

9d940574d41b1b00f8eb952c974a32501d4b153e008153b09c815cee968634f7

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

12/27/2024 5:36:55 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

Adware.VTFON

17.2.2.9

File size:

3.3 MB (3,417,056 bytes)

Product version:

3.1.0.0

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\v1.10.2-4159.torrent.exe

Digital Signature

Signed by:

TOV

Authority:

COMODO CA Limited

Valid from:

10/18/2016 3:00:00 AM

Valid to:

6/7/2017 2:59:59 AM

Subject:

CN="TOV ""Smart PIPL""", OU=IT, O="TOV ""Smart PIPL""", STREET="vul. Zolotoustivska, 30", L=Kiev, S=Kiev, PostalCode=01054, C=UA

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00CB9F84F0BE4D752CCD2D047E2BB5500E

File PE Metadata

Compilation timestamp:

1/24/2014 1:07:32 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

Entry address:

0x7C1196

Entry point:

57, 58, 33, C9, B9, 50, 69, BC, 00, B8, 07, 00, 00, 00, 03, C8, 51, FF, 24, 24, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 64, 20, 7C, 00, C0, 20, 7C, 00, 00, 00... 
[+]

Code size:

649 KB (664,576 bytes)

The file v1.10.2-4159.torrent.exe has been seen being distributed by the following URL.

https://s118f.storage.yandex.net/rdisk/46248c2346669c7f81ca3594b1aa28912900977fece2619bb7ec0f6445a70254/580b1c56/kCBNab48i_OsWu3blWo5YCIs9BsXjHmeRozMDHzgpzJhfcGy987-cV4kds2ZDeWnK4sSypMsy8mkmYLjqJX1tg==?uid=358708380&filename=v1.10.2-4159.torrent.exe&disposition=attachment&hash=&limit=0&content_type=application/x-msdownload&fsize=3417056&hid=d0b885ee9ce198a82536d8c5d7f77239&media_type=executable&tknv=v2&etag=cc92ffb4ab336ce171203535b49f13d1&rtoken=liBUBNVTMrTJ&force_default=yes&ycrid=na-cb6653d0b87cc9a6b3dd85d116e8cd0c-downloader11d&ts=53f6f891f4180&s=110e31a91a8e081664fc76ed083d620456f56b1a069e6167568b1998b8f03f87&bp=/16/.../data-0.23:47122355412:3417056

Remove v1.10.2-4159.torrent.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.