» z-zipsetup.exe
Overview
Analysis
File Details
Downloads (17)

z-zipsetup.exe

Generic Software installer

Colifile SLU

The application z-zipsetup.exe, “Generic Software installer Setup ” by Colifile SLU has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.buildworldfiles.com and multiple other hosts.

File name:

z-zipsetup.exe

Publisher:

Web (signed by Colifile SLU)

Product:

Generic Software installer

Description:

Generic Software installer Setup

MD5:

d5e6496fa764f1e155ec4de6de125669

SHA-1:

42a4cd97a2edf45aa24b2e534eb5bf9c0ee9d9d8

SHA-256:

192a0e4a83441174fb800d910ab5f61a5078c988be1c4539c4d8e985b85d9a78

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/23/2024 10:52:39 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.ColifileU.Installer (M)

16.1.11.21

File size:

908.5 KB (930,312 bytes)

Product version:

1.1.5

Web Generic installer

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\z-zipsetup.exe

Digital Signature

Signed by:

Colifile SLU

Authority:

Symantec Corporation

Valid from:

11/18/2015 4:00:00 PM

Valid to:

11/18/2016 3:59:59 PM

Subject:

CN=Colifile SLU, O=Colifile SLU, L=Guia de Isora, S=Santa Cruz de Tenerife, C=ES

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

1D8228BD3D6A0EADA24B1453F4593406

File PE Metadata

Compilation timestamp:

6/19/1992 3:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:7kpWCSaJ6ypSIBU8Al5s4mKz5vdLKvm2V0ZzXJSya0P:7kWaJ6uBDAlQ25JR2V0Zja0

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9351

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file z-zipsetup.exe has been seen being distributed by the following 17 URLs.

http://www.buildworldfiles.com/c?x=uYmWvmY7v tXwQF0/sh5xtpM2K54DsBwOeWFCGYQmD0=&c=9KqeHBATkvDB8Eu08GMY3Xpd94 HvJ6q15dFUFiCUmYMqU47Jec6zmi70svp4YvJvNG3rIA5MQlTMPQh2EJloDaEjF/Y4pI9wrK6O2Pehhrd3WK7XamkoLkfrLuqWiaB&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=B9zxOywRrGAjDG8y1Wx/lT9irVAv8jnYXe7YkHyO76s=&c=qdAsR3i4OpL7UVb 6euaANmOCwGGQD9VeH4/UgelgAgY3sIV14W7zt4NyisSD8XsGG4vb0IaOwpBuwYJBnZ/Epy0GAEE NjsG6mOe0Yxdq8lPre33STFEezaTZI7U6S &downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=YFk7xIco1HH/tZZc3mnh7 1l2qsD 0lKsxgtALVNIpQ=&c=THMGM/9 CA4uxTAZ4naDZDB8X8aa3zMKVVAtR9vuLMPoyRpEhuZBTAcBJdkky6pxiMFdRbEcy8dbGE0K9V81dwC8CrCovv 85qd410WXy85fVoBEINTo6xyric0vP5KX&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=4UjRaJxm4pTlj0KROR1M7ZaM1CneDR0mjYEImpJfSms=&c=58ye nxeM4hEh vGfFaAKmKUYjvss9z0IYRJgbxKHgTKAj4pn4sSXMY3s8e140yIJmxgQGXmMjIQE1NZf4DeXD57VXxFsCCB4 /Nr4IBShEXh/7KqRCFK4rEFYdDz3Vy&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=5AHoBn5SEgbvXUFQaSezXP6Qc2D6QapSIT15MCbr82k=&c=vSCsbUBaDUoo/whsZTl0oRfAKflz58yyZfVifyDJ4 K2cnUFHVBwcxON Kg2z50uJV5orqZwiDtElVIOvBXz2b2n00ZZnctjDVIyflq/9B9d28NVu2hJAM b4kpIsUJY&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=opruKPgZKGanck9AUjS37hs2Cufk3JaW5v1vyRROoFo=&c=BUnIQLs4Syf7q 1GZawS4xmVZOcVBSSA90kQNKbOd9KTNk/u1jTpWEcxTlGJwmmUWt7W861iBMxqpst5WXb2FdOevjnlB/Na20EaduFFhv9Rk GLcLYKNOJl2PlSSY91&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=blGzfqeOUlRtUKUPnELnQ59lkisVkmOJ4rqS3pJd0nI=&c=Na hdf63fZyOAVdpj3CHlF91fcQg0fxYVz5y7fmWBCvBFP ZQ5w 7q8iT/5NF9IHolrPjavudawyUcIE4/q9xujL4uY4ciXAjNMdnAgwMG/eti10zEKN9G2XKpe xExz&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=kgLbeZX1pmL9hr46ecWiDUVXSevJ583/3DgsBCT8hf0=&c=wrubaAupjncT3siyUdX/qcR5HUDmW58GOonWACq95yOR0ONJkhLTg8DoFKUSoIdpodomXRD2heFBY7TlIA4xC7RQiwI0428EOLvu3bpQmJYYXKVAsiRWMXTwIB7JHK8k&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=95zRuI2jcMYj0teR8HWdZpEp9ZuSQeNTbYjOTM eWLc=&c=JiwDftyZ4KCSM/xJU5CvAbNs mRPqC yux/w8BQukO5JOd2SFjIdNI4SvmLo6bQbSWLMTewTM7NyowOvr9Ae1omucD6rTJc4nfZ890aGEWMXUO3 /EwYIHGwAyZL08 k&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=sn8mgmTb9XNwROmf1KgmbrbxT7sLVQE 8ccc0B3Xvuk=&c=eGIcX9HGbxurg6TxwessWzNt9CUholeb5hvVbV9w9kR3CMMzaxkKfKxnp2axOCOpegbpocLA4TwK/Wdk21 0YYpKrOZNuDI2aFTF QGMrCKAiSAcwnGN7UeFaBipil/1&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=xBbXjyiE2aDqD2ayTJ4cB6tnwMK41zeJOGRp4Ekb4Sk=&c=HFH/w8BSdatdcmQVlSlio/MKEGOs68 WhrkIGfeIvzPlfJqFxqQwA8Rt2Cuz4sPkjkYKFZQeH881Vm2ZgHiuf8LGuhjBsBur2oqajFEtVzls08sqEzSNaAMVCST6PyFJ&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=ZzfBmg89y4p1GD/xg6xDMdzmDS2pBCmcUG0wHY7F7zY=&c=xa/pch1t51IuEeSKCrKWnRA/zWnuLmp0K0V0o5AFcdo4x8gBnqAsHXC2S2OLaZvynwYgTDFd0UudxWduNKZLn6tcqiKcsSnR1bA3GD3U4DO5tm MJGIm8oG63vhvLO6m&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=cz00nNOaV34eP xg67FLtYuxf3l4PFeOnjZDkR rF78=&c=K/kgIrFbEgnANPpgT7JI4FNxIqF3NaCA6 M/409h rBnHoNsYxp4JIDQ8qi0WYjU NYwq2gcfYRftlbXAM71gScseRmvAj88FPrFj6GYrW5hbdk6ZEetGEXKwlwHiYq3&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=BLVwp3ZLeeF2dDOukXHjRg6Rne/ W6FLEGG smAWsD4=&c=yLulLE6FIbL42v3wCEBXXvKTx88VNMQYLxOvW04dt UF4mBckANfxEOZEMS2uSu6W3YSQqYy87tMMMF6UqB2gLSmiZH0bqDUbuRj p/ThvdoxBcjVyfMeT4DTAs /4Dp&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.buildworldfiles.com/c?x=7cn4UzmcL1SutWcdEW82auVITnjFGe9MJJJnjuGFX0U=&c=4GWNu0 E0P/xIZE2nPG4iiA5myyxwSNayWEJ/4pnP74RS7m6Lp0cRz5GIEz76W7Vlz1/AI6MX37SpGqDMBONxvMETtthiBE09g7Z84l23ZNQaN7Hf3bdb CrexvArfto&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

http://www.roblox.com/.../setup.ashx

http://www.buildworldfiles.com/c?x=LjgSkeoFr03FKEjZvkjwz UzpWUAn8rBfaq43cIJk6E=&c=H5feLx9y5OjQMi5sd2lGbuu152W2p25OBJtO5X6Kj7pmGpV7P6hC8c9TBuKZESJocRbW7fdIE gN5aNrWoNurOLP3hk5hHol2dLIKWINF5Zq2VwCvHICalqiptfOdxBh&downloadAs=Z-ZipSetup.exe&fallback_url=http://staticrr.z-zip.net/sdb/.../Z-ZipSetup.exe

Remove z-zipsetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.