» winzip170.exe
Overview
Analysis
File Details
Network (2)

winzip170.exe

WinZip 17

WinZip Computing

This is the installation and setup package for WinZip, a file compression/decompression utilitiy that has a GUI to zip interface. The installer might bundle additional software offers during setup including the AVG browser toolbar. The application winzip170.exe by WinZip Computing has been detected as a potentially unwanted program by 11 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. While running, it connects to the Internet address inst.avg.com on port 80 using the HTTP protocol.

File name:

winzip170.exe

Publisher:

WinZip Computing (signed and verified)

Product:

WinZip 17

Description:

WinZip 17 Setup

Version:

1,18,0,2949

MD5:

eef2f3835b4aa7aaaab220dbc36c0dc7

SHA-1:

2f57546df4849f7710fb4325328b8fab789de6b4

SHA-256:

ecc376bdcb5fb02f9009d108ebffc8f1526bd4150be363c5098c460695dd041a

Scanner detections:

11 / 68

Status:

Potentially unwanted

Explanation:

The setup program might include offers for additional software during installation.

Analysis date:

11/23/2024 8:02:37 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

PUA/OpenInstall.Gen

8.3.3.4

Dr.Web

Adware.Downware.1348

9.0.1.074

ESET NOD32

Win32/OpenInstall potentially unwanted (variant)

11.14825

F-Prot

W32/S-ca8455f6

v6.4.7.1.166

K7 AntiVirus

Adware

13.2422210

NANO AntiVirus

Riskware.Win32.Downware.dszcbf

1.0.70.14475

Quick Heal

Trojan.Generic

3.17.14.00

Rising Antivirus

PUA.OpenInstall!8.270-pobBd7GNTeD (cloud)

23.00.65.17313

Sophos

Open Install (PUA)

4.98

SUPERAntiSpyware

PUP.OpenInstall/Variant

8534

Zillya! Antivirus

Adware.AlteredSoftware.Win32.67

2.0.0.3182

File size:

360.3 KB (368,904 bytes)

Product version:

1,18,0,2949

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Digital Signature

Signed by:

WinZip Computing

Authority:

VeriSign, Inc.

Valid from:

3/16/2012 5:30:00 AM

Valid to:

4/14/2014 5:29:59 AM

Subject:

CN=WinZip Computing, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=WinZip Computing, L=Mansfield, S=Connecticut, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

5E4842AC9691630B45F8266C0ADB1206

File PE Metadata

Compilation timestamp:

10/19/2012 9:04:54 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

7.10

Entry address:

0x1000

Entry point:

55, 8B, EC, 81, EC, 18, 04, 00, 00, 53, 56, 57, BE, A4, 30, 40, 00, 8D, BD, E8, FB, FF, FF, A5, A5, A5, 6A, 7E, 66, A5, 59, 33, C0, 8D, BD, F6, FB, FF, FF, F3, AB, 66, AB, BB, 04, 01, 00, 00, 53, 8D, 85, E8, FB, FF, FF, 50, FF, 15, 5C, 30, 40, 00, 66, 83, A5, F0, FD, FF, FF, 00, 33, C0, B9, 81, 00, 00, 00, 8D, BD, F2, FD, FF, FF, F3, AB, 66, AB, 8D, 85, F0, FD, FF, FF, 50, 8D, 85, E8, FB, FF, FF, 50, C7, 45, F8, FD, FF, FF, FF, E8, 0F, 01, 00, 00, 84, C0, 59, 59, 74, 15, 8D, 75, F8, 8D, BD, F0, FD, FF, FF... 
[+]

Entropy:

7.7399

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to oi.cloud.avg.com (204.193.144.33:80)

TCP (HTTP):

Connects to inst.avg.com (204.193.144.89:80)

Remove winzip170.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.