home

18555201_stp.exe

Sony Windows Installer Preloader

Sony Creative Software Inc

This is a setup and installation application. The file has been seen being downloaded from drive.google.com and multiple other hosts.
Publisher:
Sony Creative Software Inc.  (signed by Sony Creative Software Inc)

Product:
Sony Windows Installer Preloader

Version:
Version 5.0 (Build 50)

MD5:
b4cc9dcb455a6cfd8e3c4b1d3a201077

SHA-1:
08f5eaeaeedbd7587e3314710e33be8d609a5eff

SHA-256:
7493247164adfb6f92cd72e2e5a98121b6ce09e43dbe8913f88d24fed9e46d99

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 11:40:12 PM UTC  (a few moments ago)

File size:
209.4 MB (219,615,224 bytes)

Product version:
Version 5.0 (Build 50)

Copyright:
Copyright (C) 2011 Sony Creative Software Inc.

Original file name:
SETUP.EXE

File type:
Executable application (Win64 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\18555201_stp.exe

Digital Signature
Signed by:
Sony Creative Software Inc

Authority:
VeriSign, Inc.

Valid from:
10/9/2009 9:00:00 PM

Valid to:
10/9/2012 8:59:59 PM

Subject:
CN=Sony Creative Software Inc, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sony Creative Software Inc, L=Madison, S=Wisconsin, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
763032CE869EB50C396E26D0BF3B11F6

File PE Metadata
Compilation timestamp:
4/2/2012 1:00:21 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6291456:/BGDwvPjUDnnbrPC+8a0uHiy99CYjRtoHizX1t:/BRwjn3C+XjTRtZr1t

Entry address:
0x131B78

Entry point:
48, 83, EC, 28, E8, EF, A4, 00, 00, 48, 83, C4, 28, E9, 1A, FE, FF, FF, CC, CC, 48, 83, EC, 38, 48, 85, C9, 75, 26, E8, CA, 47, 00, 00, 48, 83, 64, 24, 20, 00, 45, 33, C9, 45, 33, C0, 33, D2, 33, C9, C7, 00, 16, 00, 00, 00, E8, A7, 46, 00, 00, 48, 83, C8, FF, EB, 12, 4C, 8B, C1, 48, 8B, 0D, 9B, 9E, 50, 00, 33, D2, FF, 15, 5B, 69, 2C, 00, 48, 83, C4, 38, C3, CC, CC, 48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 48, 8B, DA, 48, 8B, F9, 48, 85, C9, 75, 0A, 48, 8B, CA, E8, 7E, 30, 00, 00, EB, 6A...
 
[+]

Code size:
4 MB (4,152,320 bytes)

The file 18555201_stp.exe has been seen being distributed by the following 8 URLs.

https://drive.google.com/uc?export=download&confirm=lxKo&id=0B5u3ASX1ujBISFFaOXhXVzN0VzQ

http://sony-645.vo.llnwd.net/dspcdn/.../vegaspro11.0.683_64bit.exe

http://mujsoubor.cz/download/uprava-a-strih-videa/vegas/dhh3bppjfr0ktl8cqfeom1dnd6/.../vegas_1164bit.exe

https://drive.google.com/uc?export=download&confirm=88V9&id=0B5u3ASX1ujBISFFaOXhXVzN0VzQ

http://www.ex.ua/.../24901526

http://get.toowapp.com/1/44/35/.../sony-vegas-pro-11.0.700.exe

http://dspcdn.sonycreativesoftware.com/.../vegaspro11.0.683_64bit.exe

http://software-files-a.cnet.com/s/software/12/54/38/.../vegaspro11.0.683_64bit.exe

Scan 18555201_stp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.