home

curl.exe

The cURL executable

Kuzma Safonov

The application curl.exe by Kuzma Safonov has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program FVD Suite 3.0.2 by flashvideodownloader.org.
Publisher:
cURL, http://curl.haxx.se/  (signed by Kuzma Safonov)

Product:
The cURL executable

Version:
7.19.7

MD5:
bcdb6972ad1bb3e08c686d82bd1b62fc

SHA-1:
efd0b5a8475826c190f38bd1185cf844ecb82d3c

SHA-256:
cefe1b3c79213c86ff9543b4a8a571295b872e8f32bc887727797f5725738b4d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/25/2024 7:34:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.KuzmaSafonov (M)
15.10.21.16

File size:
335.5 KB (343,576 bytes)

Product version:
7.19.7

Copyright:
© 1996 - 2009 Daniel Stenberg, <daniel@haxx.se>.

Original file name:
curl.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\fvd suite\curl.exe

Digital Signature
Signed by:
Kuzma Safonov

Authority:
COMODO CA Limited

Valid from:
2/15/2012 2:00:00 AM

Valid to:
2/15/2013 1:59:59 AM

Subject:
CN=Kuzma Safonov, O=Kuzma Safonov, C=UZ

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00D5508D7420AEF0F616CAA5346E80B7E0

File PE Metadata
Compilation timestamp:
11/16/2009 5:01:56 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
2.56

CTPH (ssdeep):
6144:HqtEwz0yaAdCkOr3VdvjHyuJCQZP4j8HDbawCyTnYb3WQTBgA:HqeO0z77yuYe9frBTnxQTuA

Entry address:
0x1280

Entry point:
55, 89, E5, 83, EC, 08, C7, 04, 24, 01, 00, 00, 00, FF, 15, AC, 33, 45, 00, E8, B8, FE, FF, FF, 90, 8D, B4, 26, 00, 00, 00, 00, 55, 89, E5, 83, EC, 08, C7, 04, 24, 02, 00, 00, 00, FF, 15, AC, 33, 45, 00, E8, 98, FE, FF, FF, 90, 8D, B4, 26, 00, 00, 00, 00, 55, 8B, 0D, E4, 33, 45, 00, 89, E5, 5D, FF, E1, 8D, 74, 26, 00, 55, 8B, 0D, D0, 33, 45, 00, 89, E5, 5D, FF, E1, 90, 90, 90, 90, 55, 89, E5, 83, EC, 18, C7, 04, 24, 00, 80, 43, 00, E8, 2E, 59, 03, 00, 52, 85, C0, 74, 65, C7, 44, 24, 04, 13, 80, 43, 00, 89...
 
[+]

Entropy:
6.8535

Packer / compiler:
MingWin32 - Dev C++ v4.x (h)

Code size:
215.5 KB (220,672 bytes)

The file curl.exe has been discovered within the following program.

FVD Suite 3.0.2  by flashvideodownloader.org
The setup program uses InstallIQ to bundle additional software including potentially unwanted programs as well as adware. "InstallIQ™, which manages your FVD Suite installation. Additional software may be offered to you via opt-in ads during the installation process."
flashvideodownloader.org
44% remove it
 
Powered by Should I Remove It?

Remove curl.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.