home

1811344_stp.exe

Avira Operations GmbH & Co. KG

This is a setup program which is used to install the application. The file has been seen being downloaded from avira-free-antivirus.software.informer.com and multiple other hosts.
Publisher:
Avira Operations GmbH & Co. KG  (signed and verified)

MD5:
563917418534a65bcaac2de6bd47f016

SHA-1:
df106553aa7e1119027ac6bbe81b02a189f670e1

SHA-256:
126e69e312e98f3ba6dac68c163fe6def752feed0fdbebd15d138438cfa39d84

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/12/2024 4:15:16 PM UTC  (today)

File size:
123.6 MB (129,564,536 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\1811344_stp.exe

Digital Signature
Signed by:
Avira Operations GmbH & Co. KG

Authority:
VeriSign, Inc.

Valid from:
7/20/2011 7:00:00 AM

Valid to:
7/20/2014 6:59:59 AM

Subject:
CN=Avira Operations GmbH & Co. KG, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Avira Operations GmbH & Co. KG, L=Tettnang, S=Baden Wuerttemberg, C=DE

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
54971FF238D2B866F27FC3FE6C9AD577

File PE Metadata
Compilation timestamp:
11/30/2005 4:08:44 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
3145728:zkJ7GZIp3qFSNQSCCWzj6VOX5G15bo3R1Q:zo7EIpaFSSP6VG5GL0hi

Entry address:
0x1000

Entry point:
E8, B7, 27, 00, 00, 50, E8, CB, 22, 01, 00, 00, 00, 00, 00, 90, 55, 8B, EC, 53, 56, 57, 8B, 7D, 10, 8B, 5D, 0C, 8B, 75, 08, 8B, D3, FF, 75, 14, 68, E5, 40, 41, 00, 6A, 00, 6A, 00, 8B, C6, 8B, CF, E8, 42, 43, 00, 00, 81, EB, 10, 01, 00, 00, 74, 05, 4B, 74, 14, EB, 57, FF, 75, 14, 6A, 66, 56, E8, 1C, 25, 01, 00, B8, 01, 00, 00, 00, EB, 47, 66, 81, E7, FF, FF, 66, FF, CF, 74, 07, 66, FF, CF, 74, 23, EB, 30, 68, 80, 00, 00, 00, 68, D4, 50, 41, 00, 6A, 65, 56, E8, 62, 24, 01, 00, 6A, 01, 56, E8, 3C, 24, 01, 00...
 
[+]

Entropy:
8.0000  (probably packed)

Code size:
76 KB (77,824 bytes)

The file 1811344_stp.exe has been seen being distributed by the following 32 URLs.

http://avira-free-antivirus.software.informer.com/.../

http://download023.fshare.vn/dl/.../SinhvienIT.Net-Avira Free Antivirus 2014 v14.0.2.286.exe

http://www.filehippo.com/download/file/.../

http://global-shared-files-l3.softonic.com/df1/065/.../file?nvb=20140110194645&nva=20140111074745&token=025c169af664187b7a579&id_file=18069&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=avira_free_antivirus_en.exe

http://download023.fshare.vn/dl/.../SinhvienIT.Net-Avira Free Antivirus 2014 v14.0.2.286.exe

ftp://lpc4/extras/.../avira_free_antivirus_en.exe

https://www.avira.com/downloads/.../defaultDownload?product=avira-free-antivirus&os=win

http://api2.tenlua.vn/filemanager/builddownload/.../?hash=5a7def7ee15534421476727e74ac2c8d263af0d0af0df551ec6a9f38c555534e622079f8e76d2fb11522f6ec50390e5d5e3503c8adf40578745dc155ea82c783c49ce3c0df0390fdff222e18ff10857adc028625a9541c6f9e1834ce1c0506f8f92ea32d142f41e5f0d4fc205a2cc11abc6da8121521326a462f549edda8ad7bb28e1f6c6c28a6ce3c37da35cf9968bbfc0a45c7f94b8d9391d749b38dafc68d82d6e8dca6e0&url=0b3da36fa30172185e30306174fd75853636b390ad53eb4da0&down=0b3da36fa30172185e30306174fd75853636b390ad53fc55a0&jump_type=download&file=sinhvienit.net-avira-free-antivirus-2014-v14.0.2.286.exe

http://www.slunecnice.cz/sw/antivir-pe/stahnout/.../?m=b3b2769e20e2c79f526bc94bec4d48ad&t=53704ad4

http://dc703.4shared.com/download/.../avira_free_antivirus_en_2014.exe

http://www.filehippo.com/download/file/.../

http://letoltes.szoftverbazis.hu/bEZOfJO0oycVz0qcMu_NeA/1437640927/.../avira_free_antivirus_en.exe

http://global-shared-files-l3.softonic.com/df1/065/.../file?nvb=20140206154443&nva=20140207034543&token=03a4703ae3dbc9f5db0b6&id_file=18069&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=avira_free_antivirus_en.exe

temp:avira_free_antivirus_en.exe

http://global-shared-files-l3.softonic.com/df1/065/.../file?nvb=20140119143017&nva=20140120023117&token=0c6cc041e1e369545764c&id_file=18069&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=avira_free_antivirus_en.exe

http://www.filehippo.com/download/file/.../

http://global-shared-files-l3.softonic.com/df1/065/.../file?nvb=20140121072210&nva=20140121192310&token=0c57d6991f8cd3f4cc1b2&id_file=18069&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=avira_free_antivirus_en.exe

http://download-b802.fshare.vn/download/.../SinhvienIT.Net----AviraFreeAntivirus2014v14.0.2.286.exe

http://www.avira.com/downloads/.../defaultDownload?product=avira-free-antivirus&os=

http://global-shared-files-l3.softonic.com/df1/065/.../file?nvb=20140201134043&nva=20140202014143&token=0e093478fe5fa6bfda8ff&id_file=18069&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=avira_free_antivirus_en.exe

http://personal.avira-update.com/package/wks_avira13/win32/en/.../avira_free_antivirus_en.exe

http://personal.avira-update.com/.../avira_free_antivirus_en.exe

http://software-files-a.cnet.com/s/software/13/49/38/.../avira_free_antivirus_en.exe

http://download.slunecnice.cz/slunecnice/c0a9aaf0ef851c7e80e205f71f6aba0d/53007b3e/win/.../avira_free_antivirus_en.exe

http://www.slunecnice.cz/sw/antivir-pe/stahnout/.../?m=c0a9aaf0ef851c7e80e205f71f6aba0d&t=53007b3e

http://www.filepuma.com/file2/1391651753c4818/avira_free_antivirus_14.0.2.286/.../

http://www.filepuma.com/file2/1392231052c4818/avira_free_antivirus_14.0.2.286/.../

http://www.avira.com/downloads/.../defaultDownload?product=avira-free-antivirus

http://global-shared-files-l3.softonic.com/df1/065/.../file?nvb=20140115001032&nva=20140115121132&token=02f33e56dc43d070a6f72&id_file=18069&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=avira_free_antivirus_en.exe

http://www.filehippo.com/download/file/.../

Latest 30 of 32 download URLs

Scan 1811344_stp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.