home

androckfree.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
174d945c383bcbfbbfcea27d4c6c8f61

SHA-1:
cf93d70cc860d60b9d901429baf78e8135b8d1db

SHA-256:
2faa19e1966f8e942ff95dcb3817e6a4a0a41fed2bf630510b117d1ec27d40c7

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 7:50:26 AM UTC  (today)

File size:
159.3 MB (167,023,986 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\androckfree.exe

File PE Metadata
Compilation timestamp:
1/31/2011 9:44:13 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3145728:8vWhWidYOPg2g7R66YIpxfxi5rXNj3ikQE7f2AZWijHXcl43hCcUNPYJkZ:HhBdlPgBzdpxfxitXNFtDMijHXhUNEkZ

Entry address:
0x1D20

Entry point:
55, 8B, EC, 6A, FF, 68, 28, 21, 40, 00, 68, A0, 1E, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 88, 20, 40, 00, 59, 83, 0D, 54, 35, 40, 00, FF, 83, 0D, 58, 35, 40, 00, FF, FF, 15, 84, 20, 40, 00, 8B, 0D, CC, 32, 40, 00, 89, 08, FF, 15, 80, 20, 40, 00, 8B, 0D, C8, 32, 40, 00, 89, 08, A1, 7C, 20, 40, 00, 8B, 00, A3, 5C, 35, 40, 00, E8, 10, 01, 00, 00, 39, 1D, BC, 32, 40, 00, 75, 0C, 68, 9C, 1E, 40, 00, FF, 15, 78, 20...
 
[+]

Entropy:
7.9999

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
4 KB (4,096 bytes)

The file androckfree.exe has been seen being distributed by the following 8 URLs.

http://gsf-cf.softonic.com/cf9/3d7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69684578&instance=softonic_en&type=PROGRAM&Expires=1447561748&Signature=UQ4tOKq~UQj9OtsKCNrlHOv6uH2MoiFb46tPY19XZsx58wMM4LdccKOa-~ohayL6bEJTVobEBz1oVick2SbIXcjOkq24Y7U0Gg0PtXdTVOZZ3mMqLwstvXbdtyAWg~Qpa5hPcPhJeBpdij~gArcD-BwZZ1qCUHQfkjVlnhai-Cw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=androckfree.exe

http://gsf-cf.softonic.com/cf9/3d7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69684578&instance=softonic_en&type=PROGRAM&Expires=1442637633&Signature=AnStZDP3tdvu8dRFo~8s7igCSNb71phz-5iW4BRpP5rKVSug4s~znFNj0wFRpWPO4BvRWwDH1~3gO2rkPXSXi4vr2a7zNHMgakAnKtkTmNm-xH2YctshiCRwamTxwSaqSSsnMio2BkVYQ6DaaDHFizI3A-9Tpurq7Wu1lcgtxS4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=androckfree.exe

http://files.downloadnow.com/s/software/13/77/91/.../androckfree.exe

http://www.weebly.com/uploads/5/9/3/9/.../androckfree.exe

http://gsf-cf.softonic.com/cf9/3d7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69684578&instance=softonic_en&type=PROGRAM&Expires=1450668624&Signature=i1y6NuH6gH1YTAi2vfHmtTbnRyyKO-YWToK08KfGSAF076Di1L2OV0-WwB~OZEGGtBU9ct0B-8mAC16MpRhTt3~9o-FOc4STUY2jkYPIYo3fbKF8guvp4olxMGyNJ9soK~1qB1c6TGQEkaxLHwGzFnA0JBaW8k1jzLOxkip-yuM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=androckfree.exe

http://gsf-cf.softonic.com/cf9/3d7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69684578&instance=softonic_en&type=PROGRAM&Expires=1450298743&Signature=fT1TH2zMkBDY5VMj7ftOWHcNnfy3f8155P2Lw-eEgRv4J4Rb8ZYb7lzRebQVufGG2XfZEzke9w9LnuQqrpweHA9Kl8r2zxHSVaBTsGZw9kvN~E3-W~sMAnINZ7kfUX0JW7q-0CA2Xe2~cnmewR93YxHDwfBC4rkgmpnT-UC4-AA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=androckfree.exe

http://gsf-cf.softonic.com/cf9/3d7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69684578&instance=softonic_en&type=PROGRAM&Expires=1448783902&Signature=dEMJQAGEnCjXT3IJ5bB4aUL0W3ZB9tdqSDmxN2xUZXQ0hHAbUOKKB9mFyWiiXIpZnX6JTgf7JylkYBok2EQ5HlJUIkbjbSsTKiKYoD6orp0CGdB-wpY9sCGD7qyfglHMy~dC1Zbe4qJoOE2nOSkv70C3nYISbjWRFqU8vkVwqQA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=androckfree.exe

http://www.ps4em.com/uploads/5/9/3/9/.../androckfree.exe

Scan androckfree.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.