home

data-recovery.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
751ffb88ae971135127f2cd0981fcb98

SHA-1:
bbb73bd1bc96a9cdccd6c51d1175c184d3704379

SHA-256:
5afdd13d6b4cf0c728aba5ea476c9bb201fde4b621e94169059d2d3541649cd7

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 3:16:24 AM UTC  (today)

File size:
6 MB (6,269,629 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\data-recovery.exe

File PE Metadata
Compilation timestamp:
2/24/2012 8:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:QiXaD0Y/CPoqBjHGYQ1LwrGwchyVQ8ZM6XkoMMBFjjKhEt2k98jL:XXc0nPoqBjq1OchyurRoTjKhEEk98jL

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file data-recovery.exe has been seen being distributed by the following 10 URLs.

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_en&type=PROGRAM&Expires=1479849590&Signature=GnxxS8hrbSWJWY~ckcO87PHmbS93uVUQOrXbo3ycc2UeyGzFWJZFwzNJM14a8tEo2ccUaHn7fBDVltJuLinjJAI~8TiClljWLOGNTQ-WKKOIOMSwMkLgWQ4RndIJk0r3u4PSNYkcvtVp~hfU0nfMtPJRYQm6ep5BIIi7xmUIWBQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=data-recovery.exe

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_en&type=PROGRAM&Expires=1424860680&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=M-370M5WkqOM3G8G8gZ5wLGc455QIUwvZ~ycqlqPT28uSvCCNEpgNJSgzhOnq7ic0HlP~RK4JVdFRtAzQ7VSez7D~7iGAbA7S11lmUxNEVVbAZfjk885IEl~sFkg9ivsfBL0Z42oRRGtDXoieOP3j0OoryUF0psJ7QdqayB~nEs_&filename=data-recovery.exe

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_en&type=PROGRAM&Expires=1443161010&Signature=OHcJ8Wx0p~pcX~0UUgWn~IPnOYS8fPV1CvgUcdONCtKtSNdIHQzJ-MT3r9r6WF~dJlrZWb8OoFtbWK6-EgM7Dl0NzpjLrSKT~zohG~sem~aBL38lCKYJrbwYHjnJqD48fzDtom6CI~p8oVOH1tb71svzDFwT6what7PbvGjlbWg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=data-recovery.exe

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_en&type=PROGRAM&Expires=1423962113&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=E9lX1SQ7x4A1Zaf4QFLs3NKPzk9--vZrfA~aVPqUUkDxfSkLlxcu8UobacTYR16BcaYRZDk4tHsj7XK-012hO5~uDHT0zkOMHPDC1bg3d3DSwtX1ut7g2MaeUOGaj4tRY~rGuoq0VNwuI8GAOeqQhRV4erk413gyM2Ggq0167Sc_&filename=data-recovery.exe

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_en&type=PROGRAM&Expires=1448553432&Signature=YxfD~6iWbYjWvMlRBgGNg21bNW33Q8-kzlEwtm7n89z4wpZO0sGvduNYM9o30hSnEiF3CqZCNlBmShxXO6WjLm28syndyx885UYcq37uzhE7FOsMS-zyU-1EV0ljmN-0f6NrTKpOaeFqISSN~TyiKkYvYARSa4K~CaURwvS9B9Y_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=data-recovery.exe

http://global-shared-files-l3.softonic.com/bbb/73b/.../file?nvb=20141201100617&nva=20141201220717&token=0e0f0782a0db2c0bcf11b&instance=softonic_fr&filename=data-recovery.exe

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_en&type=PROGRAM&Expires=1453079565&Signature=KPFwLDD4wHMCqymGFjJH3ICGjlGLwBmqCpQfGVxdcEq0ZmfMZMj-Z3Z9wSNZh1PGlgSwp7bIMzzWQLVtC-sA9Tvs15B7HTI~reyDGwatBxDD78rOXhZIL3R6ao~zyRSxkQSVph4Gl8OzNikDXFIDtjrSh1HZNjsf6pU~iwt3KW4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=data-recovery.exe

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_fr&type=PROGRAM&Expires=1445220778&Signature=Io45wk5lcY7~qFrSi0mIa36KiQ7bZX8wh5JLOdmus~VtmSN24s2AdWXmINZh3Clyg6385NShWg1mP0tgmFstbFxHhCFT6UbbbDQNiB9J5wioTjk4ephxegEVind5AcntFNdFmcl-9QTr22l1-mzVNNruXb9LooczuPX4ZZA51oc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=data-recovery.exe

http://gsf-cf.softonic.com/bbb/73b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69654817&instance=softonic_en&type=PROGRAM&Expires=1424666885&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=ioGjRG13jrJaARcsvnRPimdDmVKRL05wmXc4uM-e08lm2q9bxjE1NGeLT8FGeN6wkF~tVS0YrHvBZZBfpc4AbXpR7YhiquO53YH1tTED4-7F8bOXeJDpf4s1th9vwQX3xUi-4XbMdELFRTIz0wtnTPenWUWoc9ElBxBI3wr4X1M_&filename=data-recovery.exe

http://www.byclouder.com/downloads/.../data-recovery.exe

Scan data-recovery.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.