home

webdumper_us_setup.exe

Max Programming, S.L.

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
MAX Programming LLC   (signed by Max Programming, S.L.)

Description:
Web Dumper Setup

MD5:
2a569f9f4f5e1c9b6016f652b2838120

SHA-1:
eaef526fd986950ac40240cd6d3ae2fe0bdc1329

SHA-256:
94dd3dac7d1f499f50415a349f0af1a3b5ec81e0b8e1bb42a3b48245fd7e490c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/9/2025 11:23:25 AM UTC  (today)

File size:
1.7 MB (1,735,400 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Digital Signature
Signed by:
Max Programming, S.L.

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
3/1/2007 2:00:00 AM

Valid to:
3/1/2008 1:59:59 AM

Subject:
CN="Max Programming, S.L.", OU=Secure Application Development, O="Max Programming, S.L.", L=Denia, S=Alicante, C=ES

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
3B2FCCF134B43DB9B10DB3826FD2087B

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:5G/CXvYSKKCtnB4T/8cetYuNQXBHY5sffukVaO34:8Kw7KCtB4oXjNQXBmsffuAaO34

Entry address:
0x98D8

Entry point:
55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, EE, 97, FF, FF, E8, F5, A9, FF, FF, E8, 20, CC, FF, FF, E8, 67, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 82, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 38, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D4, BD, 40, 00, E8, 9F, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D4, BD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9927

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36 KB (36,864 bytes)

The file webdumper_us_setup.exe has been seen being distributed by the following 5 URLs.

http://gsf-cf.softonic.com/eae/f52/.../file?SD_used=0&channel=WEB&fdh=no&id_file=32675&instance=softonic_en&type=PROGRAM&Expires=1440862119&Signature=YdB-5ItNhM7fa-4yn3E-Phjfw5IOoVimHIXfTuhRVZw0f1~FfeeJ5Xq~pjmCCtBqGZ~2-KSzsEScoGN4FntDMdgrmLbhFhctNoq-ELQzeK37GNFrv-yH6eLDdKOnFUGzaWiAyQlqfJ3YY-QxKNh-IfB~-dtoiHeOrsrwGbq6xkU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WebDumper_US_setup.exe

http://gsf-cf.softonic.com/eae/f52/.../file?SD_used=0&channel=WEB&fdh=no&id_file=32675&instance=softonic_en&type=PROGRAM&Expires=1426886789&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Kkx~chiezsxQA6FA2H6mGzp7wcu3OU~w7pBmT1IKot6TtNYYM-o0CA-mkE0mzHcTvi1TCaTuAYRlNRcXg7htTD-zvyey9jwzubVDpmIok9iyCjaDw5ZGWY0ekLP3NMDooBJam7dsDWoTW5IjaeLYlYibw1HHjYfN65Z6~rhuVVY_&filename=WebDumper_US_setup.exe

http://gsf-cf.softonic.com/eae/f52/.../file?SD_used=0&channel=WEB&fdh=no&id_file=32675&instance=softonic_en&type=PROGRAM&Expires=1432693654&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=fwgEuVgmD7CVcrhi51LhA3U6-IMCT70oHeKP~hoDCGBd7S-OPPM7mU7Bh0ZG2l~xBZk5ZmnJoygc7Bo5xbYfchwIudpgjIhdmfiaiBSbAxEyfy9T-ZBGAn2VeuasBY9LgTL~je2930VIh4i-iKe3Aoz5Dn6AlfOmRevfxKBpEDE_&filename=WebDumper_US_setup.exe

http://gsf-cf.softonic.com/eae/f52/.../file?SD_used=0&channel=WEB&fdh=no&id_file=32675&instance=softonic_en&type=PROGRAM&Expires=1429817851&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=MSY9~MdRBd2a6YfqOfDl8UQ5~KM-dB3lgH23g~~zlQO4lu689om2HX0UAugmFj2Mt0b9nk0seiStg~OC~cVGXzETAXqQEOdHT3zJe8McfCD3tBEcdx0jtcYBKO5d8unaPjoyUKGp793U8qjxqaYoUofLRIjlOGhTaFhO4MrXU68_&filename=WebDumper_US_setup.exe

http://gsf-cf.softonic.com/eae/f52/.../file?SD_used=0&channel=WEB&fdh=no&id_file=32675&instance=softonic_en&type=PROGRAM&Expires=1423766472&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Rt4MUDPkDrFQDnWShoJkprVa3iKIAKY60~oDqEnnEzGW5EZycuJzdy9yLWP45u4WzWw6OdsSCt2138FlxLq-pPc3WRon0hnY1l8QsOWIhRYG0pxig7Wb11n0wuZkExogaSfc7XfRHaCKHHLtxjz5diFUd5x5-QY9edQ9jg0D460_&filename=WebDumper_US_setup.exe

Scan webdumper_us_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.