» winzip195.exe
Overview
Analysis
File Details
Downloads (35)

winzip195.exe

WinZip Computing LLC

This is a setup program which is used to install the application. The file has been seen being downloaded from cdn.vipbundleslake.com and multiple other hosts.

File name:

winzip195.exe

Publisher:

WinZip Computing LLC (signed and verified)

MD5:

7daaf1756b4fb874a95d76c497c761b2

SHA-1:

0cfa9226ec194d49769509df1eb2a03d4af2ba69

SHA-256:

53987a57d39ce1f7a96a48003c99a90c6b0356283bfc6c72dcc5facd26d3bb5e

Scanner detections:

1 / 68

Status:

Inconclusive (not enough data for an accurate detection)

Analysis date:

11/23/2024 1:21:54 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/Systweak.L potentially unwanted (variant)

9.11602

File size:

122.3 MB (128,247,520 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\winzip195.exe

Digital Signature

Signed by:

WinZip Computing LLC

Authority:

GlobalSign nv-sa

Valid from:

4/17/2015 10:05:21 AM

Valid to:

4/17/2016 10:05:21 AM

Subject:

E=help@winzip.com, CN=WinZip Computing LLC, OU=IT, O=WinZip Computing LLC, L=Storrs Mansfield, S=CT, C=US

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121D1D8286B82393399C853E44FF8AA3854

File PE Metadata

Compilation timestamp:

11/2/2009 3:24:29 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

3145728:SCussXnkdldI3uiinK2nHyU0p3LgrNszslI1:SCuzkdldjiin5Sxp0rNjlI1

Entry address:

0x1479F

Entry point:

E8, 02, 67, 00, 00, E9, 17, FE, FF, FF, 3B, 0D, D8, C9, 42, 00, 75, 02, F3, C3, E9, 82, 67, 00, 00, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63, FC, FF, E0, 5B, C9, C2, 08, 00, 58, 59, 87, 04, 24, FF, E0, 55, 8B, EC, 51, 51, 53, 56, 57, 64, 8B, 35, 00, 00, 00, 00, 89, 75, FC, C7, 45, F8, 18, 48, 41, 00, 6A, 00, FF, 75, 0C, FF, 75, F8, FF, 75, 08, E8, 54, E6, 00, 00, 8B, 45, 0C, 8B, 40, 04, 83... 
[+]

Entropy:

7.9999 (probably packed)

Code size:

144 KB (147,456 bytes)

The file winzip195.exe has been seen being distributed by the following 35 URLs.

http://cdn.vipbundleslake.com/c?x=GWlta8bZa2 691PcI6AetqVSR2ZExYZNFziI1KP0UnI=&c=AIoNv9p6mqrwz70J3K8Egb6scQ9dMozlHAoaDRCHNNkn51RpnGBWsreY PH5kq9 RKojURCfe0zzGnM6gA3q JCSbo8kgx91WV6uFg1oq99VwdV6whSFEIl7Ugqr48Ed&fallback_url=http://.../winzip195.exe&downloadAs=winzip-32-bits.exe

http://dl.cleverbridge.com/852/.../winzip195.exe

http://store.winzip.com/852/.../75285952-hMmPsttQVaHfozgqeJfQ-1-2-1

http://dl.cleverbridge.com/852/.../winzip195.exe

http://store.winzip.com/852/.../74450646-kWsi5qgZb8ANAOgfIwMA-1-2-1

http://dl.cleverbridge.com/852/.../winzip195.exe

http://store.winzip.com/852/.../76949304-FfnGHeicbxhZztpEDFBU-1-2-1

http://dl.cleverbridge.com/852/.../winzip195.exe

http://store.winzip.com/852/.../76520628-LezJE8MyWsblwmDoi7xk-1-2-1

http://download.winzip.com/winzip195.exe

http://dl.cleverbridge.com/852/.../winzip195.exe

Latest 30 of 35 download URLs

Scan winzip195.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.