home

42045-653305-ganttproject.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dw4.uptodown.com and multiple other hosts.
MD5:
40910e6d715a3afbe4835f5f9323ba56

SHA-1:
18eeef3e184db044f28d1e20a153a6db9f36ad46

SHA-256:
9836bcc74b8593ff8c98989e9323e8b79c0effd295268b394b3a0ca8db81af7a

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/25/2024 7:13:57 PM UTC  (today)

Scan engine
Detection
Engine version

Rising Antivirus
PE:Malware.XPACK/RDM!5.1
23.00.65.131228

File size:
8.7 MB (9,092,396 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\42045-653305-ganttproject.exe

File PE Metadata
Compilation timestamp:
8/16/2008 3:26:20 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:9gTzgBQlZYgyCfXUY+bO7rjFRlBd76NSXENiZwnIp:9gwmQgy4Wq7rpRlz622iwa

Entry address:
0x30E3

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 58, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, 23, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 90, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 4C, 91, 40, 00, 68, 60, E3, 42, 00, E8, DA, 27, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, C8, 27, 00, 00...
 
[+]

Entropy:
7.9993

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file 42045-653305-ganttproject.exe has been seen being distributed by the following 9 URLs.

http://dw4.uptodown.com/ic/.../gantt-project-2.0.9.exe

http://gsf-cf.softonic.com/18e/eef/.../file?SD_used=0&channel=WEB&fdh=no&id_file=49498&instance=softonic_fr&type=PROGRAM&Expires=1460103253&Signature=Swy~HveB9cDn4ymOrDx3SLYXtkyv-h2bhlApUlGPjGH63aVnwasr~RBbZiQaRn4lyO1k430O-a3L7SlxlR9uajw2KR2kY~rZQnBzZWK5aRII0Z7UsRNZA~kGDYyO8rpOAs~bCuWl5h0fQDiUJW6DXZ44t9jJbfXj4UCqcTzbylk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ganttproject-2.0.9.exe

http://dw.uptodown.com/dwn/pwFaP8r1v6dgFolWokNL5lJEC1agwziCleH9a12slpAxIn-FJrKJ03UdSQkUf7TqcMcE7gZmg8MJ0jhoi8JLC2sfHBdZ3YfUNGhDVJww2SbTYl0zJILUia1oV7JBAW80/i2ZTYEJ_ZDJbG1ii_Wk6fSo1lrp_KxqolJPD6YLTsWdKLMjuys6Q-z-SrpYRGjCiOsNLtTYTc7DnGUO82x6-ST8sKIcM30OMM9kRidEjdYuwIA0mXwARAad_SxTtUde9/p0g6pCl8kEUez5WyXr3F59Wy5gr30aKEx-9LjBSvHSxSmmkAZCPJ7rvGCVaNMnuKLm8as0vrSHgdg7jjQXO6UjExipJFR8Gpt2ETzjVsA5mN_LEeTyNmkdgpxJulylEM/.../

http://gsf-cf.softonic.com/18e/eef/.../file?SD_used=0&channel=WEB&fdh=no&id_file=49498&instance=softonic_fr&type=PROGRAM&Expires=1441749367&Signature=hR~8rcBvGRiQ1u8waSRt-qF~uyDZv4K2dKsL1tNXX4vodAzW4zxXhsr1sTtws8BCddJTtDDFHps5nrMqpoh2uIJIOaUFapyJSDlSKiOG2AmXK0JNJXdk0z9H5GurdR6ubdeVzAGjsLBF9R9A9-r4nPdfuU6hBOG5xlt30nHQQtU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ganttproject-2.0.9.exe

http://gsf-cf.softonic.com/18e/eef/.../file?SD_used=0&channel=WEB&fdh=no&id_file=49498&instance=softonic_fr&type=PROGRAM&Expires=1456221125&Signature=AMdkiqRec5UNHp8YkZQN~V1hnIfcCrJnrnW1A7xkoYzJZBOJB1fs8ZFGV3IIujzskDpdRyZGJzF9vD3oLH1xhvw6MlObxd7muNwTAK0EK2FOqOnq32A~puBi1dQSDsc9oneYAWZsqlHN-iK2Y4o8WX4p66ygh2WydS9rmKXkYrU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ganttproject-2.0.9.exe

http://gsf-cf.softonic.com/18e/eef/.../file?SD_used=0&channel=WEB&fdh=no&id_file=49498&instance=softonic_fr&type=PROGRAM&Expires=1446978227&Signature=Qdwo2-lD82Kea66VGCXZcncg3ZcSAz8OoBl7fS0yq36tWz6SMCYaRY1nqmcHPvnCRvkUYMqeoLjp6N-tJtZup-jVH7iklj7aQR3en36mrlTheEHkskUpg0jXTdl5X7mOrM-h25gsJh1qPnINQWRVjewQiU7rVC~--M9eybCuyg8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ganttproject-2.0.9.exe

http://gsf-cf.softonic.com/18e/eef/.../file?SD_used=0&channel=WEB&fdh=no&id_file=49498&instance=softonic_fr&type=PROGRAM&Expires=1447372824&Signature=CJzV9ECKQY-yJ3SxYKo0aAoghADNXLmUekil~lWJDlMMPhnxjSwxHbq9R8jkCHbwVb~l5OnF03X85wHh8ekYHfdICBo0kg2pHARt6qLNElEcBj-9Z2x9detscncxINWBD5tplMbuo4biXjStbHyQnKOzigwtLgSM2DW8kS3WHlA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ganttproject-2.0.9.exe

http://ganttproject.googlecode.com/.../ganttproject-2.0.9.exe

http://gsf-cf.softonic.com/18e/eef/.../file?SD_used=0&channel=WEB&fdh=no&id_file=49498&instance=softonic_fr&type=PROGRAM&Expires=1455052366&Signature=COgW8lChhJoYoHaq2J56bqbnWEJG3nq5HXPewd1YzGTOoLuFc31MhQgG4o55QH6c0g4xaNhWOMJkIU8mFAwTtzunYHcUPsoA0Od~fIxJ2xd97w~oPkMKHM4R~9Wqs0sBE9hSZ0zgF0KcR6H6KluAmuUv0ojyAiMvNgJgawt4Glw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=ganttproject-2.0.9.exe

Scan 42045-653305-ganttproject.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.