home

bf1942_mp_demo.exe

The program is a setup application that uses the Wise Installer installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
75692d4a96bc8165cf2c430a9a50d5cd

SHA-1:
27f9a1ccc98095d352fe16a7aab0800dfd185887

SHA-256:
8a8044e32bc793da05b432404d59a6f71a4d8d01cf18153036691cb6f66435cf

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 11:08:27 AM UTC  (today)

File size:
130.2 MB (136,512,494 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Wise Installer

Language:
English (United States)

Common path:
C:\users\{user}\downloads\bf1942_mp_demo.exe

File PE Metadata
Compilation timestamp:
5/21/1999 10:48:48 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3145728:e75ms/ydEaOy7wWHO1y/qWEAksYkBv/LZTRd2/mccE9lKerOHs:Ums/yaaOy7w8YlWtkshhB2VcE9lKeqM

Entry address:
0x21AF

Entry point:
55, 8B, EC, 81, EC, C0, 04, 00, 00, 53, 56, 57, 6A, 01, 5E, 6A, 04, 89, 75, E8, FF, 15, 50, 40, 40, 00, FF, 15, 4C, 40, 40, 00, 8B, F8, 89, 7D, F8, 8A, 07, 3C, 22, 0F, 85, 90, 00, 00, 00, 8A, 47, 01, 47, 89, 7D, F8, 33, DB, 3A, C3, 74, 0D, 3C, 22, 74, 09, 8A, 47, 01, 47, 89, 7D, F8, EB, EF, 80, 3F, 22, 75, 04, 47, 89, 7D, F8, 80, 3F, 20, 75, 09, 47, 80, 3F, 20, 74, FA, 89, 7D, F8, 53, FF, 15, 54, 40, 40, 00, 80, 3F, 2F, 89, 45, F0, 75, 28, 8A, 47, 01, 3C, 53, 74, 04, 3C, 73, 75, 06, 89, 35, F8, 52, 40, 00...
 
[+]

Packer / compiler:
Wise Installer Stub

Code size:
8.5 KB (8,704 bytes)

The file bf1942_mp_demo.exe has been seen being distributed by the following 16 URLs.

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1471585992&Signature=N9ZJ8DBt0omOLFI4IwZaNI-9Pv4riQOTmLI91xzO9uWR5lkdid7BNUV1qnqC4z8IQDmi1JrlQx1FNNEzdY38qhyPaBItBnQP07F9ulMlNpb5sPs8dex7YKfU7pnldcoG0DGDP94GhwN9xVlEUnugsqE5UIN7eMzX5RjPzbEUv5Y_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

http://www.brothergames.com/pc_d.php?soft_id=301553&url=http://lfiles3.brothergames.com/games/new/shooting_games/.../bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1477267543&Signature=g2mpDNIJ7s33sTkCYO3hIEE4UO3rs3T7RLucKSnCtt4ZNoibK1SWvqvY3Gj69pZ9kIgcmB9ATOiF7tOJ7M-W4vv5N-XSM4sCe47Agvhy8TuBFsR7s5XD5UCd4PLey4k-93l46SxJ2nDbG9VVjdrir5LpY-gyEwURBoUjYyhaquk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

&onid=7441&oid=3001-7441_4-10229041&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=games/first-person-shooters&topicbrcrm=&pid=10229042&mfgid=113436&merid=113436&ctype=dm&cval=NONE&devicetype=<!--esidesktop&pguid=225173816ef101c3e99b9edd&viewguid=g-ix@QHDU1J5oa8dHgLlCGlZNU44tIt1JF@2&destUrl=http://files.downloadnow.com/s/software/10/22/90/.../bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1473930571&Signature=Bni4kQ6FOtXrP3-r3sFKDtjYJcobUIAjdxgcR9RVI1-Ecja3PreU73IVDiMa0-lkIC2jP9Y87otJ-qnFZI1e~wnSgM7xtln33Tw9ZXkWU0PUPirusY1FbYmWI4tGg0fDG8z2pc9Yni-6dN54WDNdzjYma44l9ynIxeYcq29OKt8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1479871720&Signature=gNkvYOlti4vV3kKuQO75dLzMvUWBrVEUruEk1FUzBNmADdnRznTLW4eHGuJN1W8F1WmNjiCIBp6wTAw7sM2o87zjDg6mhrrW46ByvZ4~jhSBXK63Qn4s6N-s~vHSqEPylqrtp-T9z5KvvesJORlzt8eGEWa~bIq2P980QMQ~o7U_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1475882878&Signature=M0Ttj7xJCfXsNB8IKUOjOSC4BWGXNTXuWPiDRuQMZsJEJFrWLIHJnhDh~EaP3hHeRNXTRdwhjrjCyDmrHRENFGRb1zb4BTuONZKI5P1Ww00FFr8ZVXHieV6UflfcuwnSdYjEEDcB6zZXDsjHrRF5vJ-5D1Yba6ZiJ5Dg9ZPA214_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_es&type=PROGRAM&Expires=1475990679&Signature=L6xFRmIoEwO0qG2poUdugq6vBsgcJPACHchSQHdDYCF2981EwsTlGQdlYAMejhzClp1gpHxPDAODGUY4YUInZHucrQUSZhIkkp9jZrzLS41aBcP8TERNLhUJgPEPsgnMIpW5DmLEmde0EC4p-sezzgj9F6-2dPGknBC1zuAsUmM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1473079980&Signature=BBdEq4ZOBq~mSehOVHhRzDI9XotSJ71Q8ZirnxzM~N-8CabMuQldczFrt1mpO1Bf6q9VdfOO8i5W7vK6iBEA-3kvG5eOyyT3rcvRUGW4jBZTGfb-Yh4VWR9NLgLbkYTD0RuLsF-14X9mWi3VnsAFsslduragdThyzFCHkMo6Sqs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

http://software-files-a.cnet.com/s/software/10/22/90/.../bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1459428132&Signature=gxPlDaAoLW8iQpAjDto7wIkQZdZrUEZotUxV2Nvh7tuhLXVGy144VgZCa7Dx-2TDZrlaM7dSiv-3F2anwLValU8ZvhJL6ivlGeUslxgwoPeDdcoYczY6HmF09hKDsU0g8ZPYCquPOUb6KdA8GU-5mhtHqSHnGva~2YI54T8NLQE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_pl&type=PROGRAM&Expires=1430684110&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=NfLmRHK4yWqGicQy2N8HarnVVqPmZUxjJcDAsmqso788~SdEDhSXzrIpzKb34rhZkLe267liE07C4ZAPR0g2syzbG-nbucoMIirW74e-PSuXxXWYeMvyGMIwJUMyT0MK2ykSv14KKY67safMORST2lhQSBDtpiIqz4QxZSbAaG4_&filename=bf1942_mp_demo.exe

http://files.downloadnow.com/s/software/10/22/90/.../bf1942_mp_demo.exe

http://download.fileplanet.com/ftp1/.../battlefield_1942_multiplayer_demo.exe

http://software-files-arl.cnet.com/s/software/10/22/90/.../bf1942_mp_demo.exe

http://gsf-cf.softonic.com/27f/9a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=22650&instance=softonic_br&type=PROGRAM&Expires=1427629928&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=DKIt6~gSYEK5MPj5dkgYzfdm39r2z2-86VSXmOIDxLilKOVxr~YU9ckicFr44VnxDgyYR6DIdHQHB3jx09YbnIAjet9gm2n6PnRBrXG12gNBl4q3Rg4u22aPlNPyLFB6dAZJYUSmhLdElqdcUcXr1wye2nRmwJaJJLVGuUf3dXU_&filename=bf1942_mp_demo.exe

Scan bf1942_mp_demo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.