home

bru_setup_winntx86.exe

Bulk Rename Utility

TGRMN Software

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from s10429.chomikuj.pl and multiple other hosts.
Publisher:
TGRMN Software   (signed by TGRMN Software)

Product:
Bulk Rename Utility

Description:
Bulk Rename Utility Setup

Version:
Bulk Rename Utility

MD5:
6093e8df1bb297ff43872d32895920c1

SHA-1:
991158ac833d02d38d9af1bfa15a8b86a145ad22

SHA-256:
73c6ccd2c15f9c035bbb4447a81dd29b5b7a5054578e6eb591d640e78dcb4257

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 1:40:59 PM UTC  (today)

File size:
973.3 KB (996,640 bytes)

Product version:
2.7.1.3

Copyright:
TGRMN Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\bru_setup_winntx86.exe

Digital Signature
Signed by:
TGRMN Software

Authority:
COMODO CA Limited

Valid from:
8/15/2013 5:00:00 PM

Valid to:
8/16/2018 4:59:59 PM

Subject:
CN=TGRMN Software, O=TGRMN Software, POBox=PO BOX 568, STREET=PO BOX 568, L=Fullarton, S=SA, PostalCode=5063, C=AU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E3009FCD996805636A77A6E4B63492D4

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:f2U5aK35yjLZ0U4ihhrbSQS6/1G2Sm8jy8wkAYU8YaXa9:f2TKJbho1uQXam8wk0ae

Entry address:
0x9A58

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 6E, 96, FF, FF, E8, 75, A8, FF, FF, E8, A0, CA, FF, FF, E8, E7, CA, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, 0B, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, D4, A0, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, AC, D0, FF, FF, 8B, 55, F0, B8, E4, CD, 40, 00, E8, 1F, 97, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E4, CD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9808

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36.5 KB (37,376 bytes)

The file bru_setup_winntx86.exe has been seen being distributed by the following 11 URLs.

http://s10429.chomikuj.pl/File.aspx?e=Dvzlwsbwve4atHduSLtd8jZ9WqlOIoOck9CygQC0aKrHetsIzszDYUfjutHINvjZ0YrGlKkJqai2aqCk90Cya5jT7O_rbySApHYDHK0M8YOU-gabbdAPP1XdRbEsLq6Nlcrc1I_DBhRXtjAn2thj5WhLGMRGX19TB-j4aWrYH2A&pv=2

http://www.hostingsoftwaredelivery.com/c?x=qiAMBak0FVBsucMfVVuChhlDuPy8cp5/tFewnrjvZN0=&c=Kol8cHH4nQPHA34MGdhvGYxebEJXxS8x49KbbhxbTcHyFkEcGqc8R/JdX7eTOSNuKGenZxCs8ojs4ns1nuPW3/PLLUpodpNjT11ngZ5bph8oQ6mhPLIwkDwrDhyO1K4A PBGSbL6idqrX6SgcIYnzA==&downloadAs=Bulk Rename Utility Downloader - JalanTikus.exe&fallback_url=http://files.jalantikus.com/dde/3284/.../BRU_Setup_WinNTx86.exe

http://dw.it.uptodown.com/dl/1444069578/.../bulk-rename-utility-2-7-1-3-en-win.exe

http://dl20.filekicker.net/private/$adv-rgn3$1448862395$fe30075db0d6ba49bfe58b131faa2958$/id/$FK15913$215925-Q0LO$/cache/.../BRU_Setup_WinNTx86.exe

http://www.bulkrenameutility.co.uk/.../BRU_Setup_WinNTx86.exe

http://dl21.filekicker.net/private/$adv-rgn3$1432535580$b00f628397015d34f1c1a422ddb42ff4$/id/$FK15913$215925-Q0LO$/cache/.../BRU_Setup_WinNTx86.exe

http://dl20.filekicker.net/private/$adv-rgn3$1419976907$85e1bc1dcad5f2651752b08043398992$/id/$FK15913$215925-Q0LO$/cache/.../BRU_Setup_WinNTx86.exe

http://dl.filekicker.com/send/file/.../BRU_Setup_WinNTx86.exe

http://bulk-rename-utility.software.informer.com/.../

http://www.nonags.com/plus-get/d.asp?id=/.../&fn=BRU_Setup_WinNTx86.exe

http://www.bulkrenameutility.co.uk/.../BRU_Setup_WinNTx86.exe

Scan bru_setup_winntx86.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.