home

anytogif_setup_ad.exe

Any To GIF

zxt2007.com

The application anytogif_setup_ad.exe, “Any To GIF Setup ” has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.softonic.com and multiple other hosts.
Publisher:
zxt2007.com

Product:
Any To GIF

Description:
Any To GIF Setup

Version:
1.0.2.0

MD5:
2172071c09e69e4116484e03edd78a6b

SHA-1:
10fe94b14e6b93203ebd71d556e274e402b52d97

SHA-256:
9fd949debcf59002db7f2beb2c9e8148993e1d685a8331829fceb442f1fae0b5

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
4/23/2024 6:36:44 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
NSIS:Relevant-I [PUP]
2014.9-151007

Baidu Antivirus
PUA.Win32.BundleLoader
4.0.3.15107

ESET NOD32
Win32/BundleLoader.C potentially unwanted (variant)
9.12256

File size:
1.4 MB (1,422,989 bytes)

Product version:
1.0.2.0

Copyright:
Copyright 2013 ZXT2007.com.

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\anytogif_setup_ad.exe

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:RGT0HoB21/lxnVagVMSlAYwxTNMOSzvXABBVu2n7LC3RhhJq1DmWudw98DU5:RbHoB2z/5l/giFvXAB9LC33hJODWy+C

Entry address:
0x9B34

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 66, 95, FF, FF, E8, 6D, A7, FF, FF, E8, 98, C9, FF, FF, E8, DF, C9, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, EB, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, B4, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, C8, CF, FF, FF, 8B, 55, F0, B8, F4, CD, 40, 00, E8, 17, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, F4, CD, 40, 00, B2, 01, B8...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file anytogif_setup_ad.exe has been seen being distributed by the following 5 URLs.

http://www.softonic.com/sads/tracker.php?ev=c&co=AR&sid=536b2417348373acd8baedc85ec89dcf&upv=9d4d03de19056839be1c381bc9494bfe&z=results&sk=0&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAC9B15663BFCC32A4B420C96190DC24F2B4DF1BFC96A568E3F48CAAC0E47F2F99E495D926D1AC02CF47E609087AE07BAF00DBA99257B57C77C1AC7D9A5DFABA1419D06EDA51AD1AC842DF55C95210931BD0CB9237106FD616CCDECA1E8DCF89E7A65191B03698F5C975409F70F8B9171116A95D2E98935F0180EE640F74C1D89A09B0E3CED864CC1D221EE533D4D468B07F9717014B51A2852E7536CD882E0F48&h=21AB4B972A54107D7DD3E2C7CC5C71E1E2AA6D26C46E2956D15EE30BCC41580D&directdownload=1&f=69667320&d=http://en.zxt2007.com/.../anytogif_setup_ad.exe

http://en.zxt2007.com/.../anytogif_setup_ad.exe

http://any-to-gif.softonic.com/descargar

http://fr.softonic.com/sads/tracker.php?ev=c&co=CA&sid=9cd72177d3cb5e412257aea66ccd96fa&upv=0734502dd5bb68469a1549507cc3d34c&z=results&sk=0&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBA6CC51E5F2F1CC0781D87EC9BB0C214C631E233541EE5EDA1BB5B7AFF02804CBEF88DCA95269106E2E545856BAEEF40FF4819612E396186FF68AA75CE9AA3B71F60162E67DA24F1E3C51FA2D2A82A1E8763B1F3D10B4978A6C9F210504AF8C6B67E939CEC378BABE521B80D525E376B6B9249FC549B4C28AA32ED261639C4C0F1E0AFA33170FA8561AD392FA77991842B&h=C929D966BE4DD98F6A1F5FD845E96C541ED1E92D9BD7F8E8D92B64617ACA0B6A&directdownload=1&f=69667320&d=http://en.zxt2007.com/.../anytogif_setup_ad.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=TR&sid=805c798160783d412fcb197f6ffa72a3&upv=b10743795c048436df0e50c6e1b4a586&z=results&sk=0&abp=0&params=F39B2A32BFC101987B1458170C278E0313858C8F8C1052086E0A941149460CE7510D1990FA7950706077490C398CB5F8EB74548A279F55707338CC3D68610D9E2ACC009D6F568D1DC66EDE74886A3C62A21C6EA019FF9056E8E81CFEED574BB82C34B6080A9205AD2CEE82B6CCCA77EA335158353EBBC25DD7E3B076D10F212500CC68ED58E1F24C4979D4EA07B05BA087044228CB3218927C56B56C3DC67445&h=E38CE9034FB05E934BB74A607029C3B01DA847C4342FE03C8A13253EA13A5376&directdownload=1&f=69667320&d=http://en.zxt2007.com/.../anytogif_setup_ad.exe

Remove anytogif_setup_ad.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.