home

winsplit-revolution-v11.04.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
b7417d3e1db10db8e6c19caf69dfcc88

SHA-1:
0f724101c1a3a8e678a2c188fa2fac4db5aa68b5

SHA-256:
1d5b5b362eb5951a41dcd276f108c580a201d551e9acf478b04d8e4dd64f1ba0

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/25/2024 12:55:46 PM UTC  (today)

File size:
1.5 MB (1,569,097 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

File PE Metadata
Compilation timestamp:
2/4/2009 5:59:43 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:NeFad6+fwTUJFXEvqxjV7ppZIkv4LGKhtrkKKQM6RvnzcRfPThSdWl57Tix6n:NeFv2wTC2vqxjVfgGWkQ/RmPMWP72sn

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, ED, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9828

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file winsplit-revolution-v11.04.exe has been seen being distributed by the following 19 URLs.

http://gsf-cf.softonic.com/0f7/241/.../file?SD_used=0&channel=WEB&fdh=no&id_file=65089&instance=softonic_en&type=PROGRAM&Expires=1469842859&Signature=abI004lC3KSGHGktpwV03VfKVfFnUVZJHMqOvUWcvneRSEePErKpkA4YViX~LWp0kmKTojdLxtFrtcqK9KsOKGcqQbhVJMWU69ZSKf~xTsHHZ4xbW5V4SZXAUaFxEefjyxjKCTIdoyFfDKVnzEpsXd7rUJAJIiAs9i8Fz5MDmSY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WinSplit-Revolution-v11.04.exe

http://low.software.dn.naver.com/d00e255d5c780d0107d421265db1e6a7/.../WinSplit-Revolution-v11.04.exe

http://www.techspot.com/downloads/downloadnow/.../?evp=1629daf3d9277d03dd3eca8e69fae876&file=1

http://gsf-cf.softonic.com/0f7/241/.../file?SD_used=0&channel=WEB&fdh=no&id_file=65089&instance=softonic_en&type=PROGRAM&Expires=1477375220&Signature=XB6g-GuB7AK3e1wdJ507uA1pWUeqVPx3xV5gthSqQB63L-ZA~a0ZGLA49ya4SeZih5-R1PLNMacGgl8BLLyo5nWOsuzPNQb5XwH7Z6ojhg1fa3RE4Vu8FTLOtiV6qVXJYLKQ51igM0KILezN2Y3c0FewJnx4jSxGoZVcGN-dvzE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WinSplit-Revolution-v11.04.exe

http://www.techspot.com/downloads/downloadnow/.../?evp=3115be3dc4f0f02c34329181d024cb49&file=1

http://gsf-cf.softonic.com/0f7/241/.../file?SD_used=0&channel=WEB&fdh=no&id_file=65089&instance=softonic_en&type=PROGRAM&Expires=1464845004&Signature=B6NSUmpeOftvDfYXuEcsOPX8gxFXricrdippBE9Faez6C74WgZ~95DAk4E29ebHuMiFf4hUc9c4PpgsdOujEYPdp6Cgquib~iKDG5HmUk6ktQG~KYnE7ESvnGwdqvIQYFYc6i-mQn3PDxO2Uakll18J2QMEkpICXkeLxM7I4SAg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WinSplit-Revolution-v11.04.exe

http://dl-vip.appstore.baidu.co.th/.../WinSplit_Revolution_11.04.exe

http://gsf-cf.softonic.com/0f7/241/.../file?SD_used=0&channel=WEB&fdh=no&id_file=65089&instance=softonic_en&type=PROGRAM&Expires=1428976311&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=N~jr6vQhYvPbN96TmDiR1pgl5gfzRAuI6aMU5sAZ--QNPNlooW25Ju6LRbOWPcXu8dVw0~7lv7qeOhFOF384-Mpdv3yiayvLCRPKhqBHArtaBdGMsGClntDpqw3OXRFTZD8kuWc3y4KsdtFUKNc-ZaAxm6InVcCYaPKK2VtAYto_&filename=WinSplit-Revolution-v11.04.exe

http://winsplit-revolution.software.informer.com/.../

http://gsf-cf.softonic.com/0f7/241/.../file?SD_used=0&channel=WEB&fdh=no&id_file=65089&instance=softonic_en&type=PROGRAM&Expires=1447606802&Signature=G7KyQ9xPtTOIZS576E75AczPKioeNhy05~jcq-VeRdk65TtHIKKDYqMxZ4c7H~NH8irH5WI7gkKZS11bXDlJuNBdeDlrTTPwov2cdszMblvmOUvD1wv~NxHaCEV9zhzq5NvTbAV-34VR1x4P2mJr6s9qeqx-HSx-cjBc5zm5jmY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WinSplit-Revolution-v11.04.exe

http://gsf-cf.softonic.com/0f7/241/.../file?SD_used=0&channel=WEB&fdh=no&id_file=65089&instance=softonic_en&type=PROGRAM&Expires=1446175260&Signature=MZP04LMLtZParwD3rSMRQ7TWctVad7gOthbSNgK-5qOm0kCiMPzwBGznMl-l4cG7WYO3Xepjsp7RgJxEmUnukdPaXPQ8Zkws7iB~73pCTxXBAy8dHX-vwIbkLgl1X9Mc62bQhhytR4nRmA~ciYje4TVIZrvaFxyafWbaLr4ik1s_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=WinSplit-Revolution-v11.04.exe

http://download.cnet.com/.../?appid=10971915

http://files01.techspot.com/.../WinSplit-Revolution-v11.04.exe

http://www.techspot.com/downloads/downloadnow/.../?evp=75dc656166d0aa797fb0fdde1f367237&file=1

http://dl.cdn.chip.de/downloads/.../WinSplit-Revolution-v11.04.exe

http://soft.archive1.clubic.com/files/730231c2c62484c45e36edb2b92936be/5304264c/.../winsplit-revolution_winsplit_revolution_11.04_francais_422955.exe

http://downloads.pcworld.com/pub/new//utilities/.../WinSplit-Revolution-v11.04.exe

http://winsplit-revolution.com/.../WinSplit-Revolution-v11.04.exe

http://www.winsplit-revolution.com/.../WinSplit-Revolution-v11.04.exe

Scan winsplit-revolution-v11.04.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.