» att_settings.exe
Overview
Analysis
File Details
Programs (1)
Downloads (4)

att_settings.exe

Yahoo! Inc.

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from sxp.yimg.com and multiple other hosts.

File name:

att_settings.exe

Publisher:

Yahoo! Inc. (signed and verified)

Description:

AT&T Settings Tool

Version:

2012.11.14.01

MD5:

616db797dda19f2cee18cfee1004f2dc

SHA-1:

d0edab55b60c2ac35190ce5736b51d0216e8d494

SHA-256:

e9e91964d08572436be59eb80879821e453b4ee4e699451815fbfd7148c0328e

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/25/2024 11:02:19 PM UTC (a few moments ago)

File size:

1.1 MB (1,126,408 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\att_settings.exe

Digital Signature

Signed by:

Yahoo! Inc.

Authority:

DigiCert Inc

Valid from:

11/4/2012 6:00:00 PM

Valid to:

11/6/2013 6:00:00 AM

Subject:

CN=Yahoo! Inc., O=Yahoo! Inc., L=Sunnyvale, S=CA, C=US

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

021FF715E9FBA4D508D1AF38122916B5

File PE Metadata

Compilation timestamp:

2/24/2012 1:21:51 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:lYzTyeaeU443YWgC3TzjlLwIn6h0JAQOkt+rEnOdPCqROgkGPgoix9vAH:lYzTyeaeU443YWgC3TzjlLwInvkrfCwJ

Entry address:

0x36AE

Entry point:

81, EC, 84, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 1C, C7, 44, 24, 10, C0, 8A, 40, 00, 89, 5C, 24, 18, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, AC, 80, 40, 00, 53, FF, 15, A4, 82, 40, 00, 6A, 08, A3, 38, 89, 44, 00, E8, FD, 28, 00, 00, 53, 68, 60, 01, 00, 00, A3, 48, 88, 44, 00, 8D, 44, 24, 3C, 50, 53, 68, BF, 8A, 40, 00, FF, 15, 70, 81, 40, 00, 68, B4, 8A, 40, 00, 68, 40, 48, 44, 00, E8, 24, 26, 00, 00, FF, 15, A8, 80, 40, 00, 50, BF, 50, 10, 47, 00, 57, E8, 12, 26... 
[+]

Entropy:

7.4909

Packer / compiler:

Nullsoft install system v2.x

Code size:

26.5 KB (27,136 bytes)

The file att_settings.exe has been discovered within the following program.

Quicken 2013 by Intuit Inc.

Quicken is a personal finance management tool developed by Intuit, Inc.

www.intuit.com

11% remove it

The file att_settings.exe has been seen being distributed by the following 4 URLs.

https://sxp.yimg.com/gj/att/ast/.../att_settings.exe

https://rd.software.yahoo.com/.../att_settings.exe

http://xp.yimg.com/gj/att/ast/.../att_settings.exe

http://rd.software.yahoo.com/.../att_settings.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.