home

fbdesktop-1-4-0.exe

Troy Technology Co., Limited

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Troy Technology Co., Limited  (signed and verified)

MD5:
3478512f7168ec8699821140237f243b

SHA-1:
e570bda8bd69ddda719d2a175e4ce03400f6e30a

SHA-256:
fc4ff04a6769b9ad609c26500779114775d029393818814749708e90336fd589

Scanner detections:
3 / 68

Status:
Clean  (3 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
4/19/2024 2:13:29 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.DownLoader10.19828
9.0.1.0364

McAfee
Artemis!3478512F7168
5600.6901

Trend Micro House Call
Suspicious_GEN.F47V1123
7.2.364

File size:
3.4 MB (3,564,072 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\fbdesktop-1-4-0.exe

Digital Signature
Signed by:
Troy Technology Co., Limited

Authority:
COMODO CA Limited

Valid from:
6/5/2013 2:00:00 AM

Valid to:
6/6/2014 1:59:59 AM

Subject:
CN="Troy Technology Co., Limited", O="Troy Technology Co., Limited", STREET="Rm 1205(S01), 12/F, Tai Sang Bank Building, 130-132 Des Voeux Road，Central, Hong Kong.", L=Hong Kong, S=Hong Kong, PostalCode=1000027, C=HK

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00D1ACFC928C7819C2581BCEC7D0F8B504

File PE Metadata
Compilation timestamp:
2/24/2012 8:20:04 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:jKmfhEE7xiIFck6NrA1ZwEF3x3Thoc0eJY7w:jKmfwIMt+lThlJqw

Entry address:
0x38AF

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 90, 40, 00, 55, FF, 15, C0, 92, 40, 00, 6A, 08, A3, 98, EB, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, EA, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, A2, 40, 00, FF, 15, 84, 91, 40, 00, 68, 4C, A2, 40, 00, 68, A0, 6A, 47, 00, E8, 18, 27, 00, 00, FF, 15, B0, 90, 40, 00, 50, BF, A0, F0, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
29 KB (29,696 bytes)

The file fbdesktop-1-4-0.exe has been seen being distributed by the following 11 URLs.

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1468605525&Signature=UGCFqPp-4QsyGyC1ZZCPCoF9Qo40jkNlr1hjSChhbu-8l8kpzGPdho6BN2hkazWl5WY1b-BkBKzrFy2JOfmOhst1dy3SyOwgBpM7gvviLK5dBoqs8oFDYzIbDJMHg4xXNdsNvECt3Hs2v-xf7nHf7uFZSB4QJyN65nqhwHiTriU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1477436033&Signature=MCYDzbMUW2B2h7A3RrTzS2r15s21bWfeP1U07TkSs8pfyeLqyzukzdSgHNzd4NpbBo2o9h4vE5n2Q34cklLYBpfgNkwjSVCm5u6hwoFhapJrs6rqxXYf3yM2Zz3ndDFgAU~rY~x5lu8P~DGRriork3qynr18tjJQCP5BL8Ucl3k_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1471778911&Signature=H1CNZMlkoC1T825IQsoKgMz~bSCZxJUJwUnZfm2ZFgnlDrsqX2gv5mFk2Ltgm5CBcSE0TygKXwaHEY1PVxc7HuBg4PbZnBPh7gT-dJcW2PNU04S7oGK7ldmGaPlfOxsxqVeB6nSFq4R4m9-bAvB34F-gHPdt1gK8VBzEnjQrmKE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1476838443&Signature=gP-KQ--cYWBKnp0oLJOY4-ZJrecLquXR2w~wWEWpA4lATGbvJF2v5vz9Abmhsp0NXbRdrxKnvOTzUSTxa9dQzWVoloYSmed9VadUC8OdLb9-MGWMSPV9GgKt5UGW1uZTp0EMICzIzYiQB0OTwcOVBJlNlb~RLjZQ~qqMUK6nx6o_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1434319055&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=bQXCVVtlW1Sjm3OgRsDO8~zaS9pgbc4t5VeV4orf~s2JZsS1771IAmYch2Ft2L760~xDxPK31k8V~dKoHda2Af-~eZ~rYvsSKxvEI3OkrbfjsyY16V3rp-ZLIxKZLZWPu3qEvzPyIQqIi6XB1uALBVU7-EWAhxyNwES6DpIv27o_&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1466624611&Signature=Imskf14gEePRaQvfwFUM3WngN1eO-93YP~IEvghdX8VOc1NkoeV1jk-2KQlq6FwoanZU6rP8G3wKtm5W1BvbczuxX9cp7ZXAmwDYVQXDpXvioGMN5MLu9L4RlazDUZmphbB-N9jxCCyRy~O5G2LhCFShI81GAK5xAi34GmNBiYE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1458709927&Signature=U9qL6Ev9wXoh7VqwtT6zwyhK29lmo8swpTd6qlmifvHeMEl4W9RQXmy~enX3wsizm007ANtdkYrbtAMFZR9NooLkGmMjmwytbocMeeIGVRbhqIlTiSHI41UdwQWfBcC5r38AlHJMnbu~SV9Pnk68qdIwVkxO7OX9JainS1-HG6w_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1450605972&Signature=AqmaiZE9D3dPjw5u1uwoIQGhyoaHeiy04Kzkine9q84LrmLbxTJxate4GqTHz7cTbBHiiSQtYzI4drTQPYSwqVeqhC1OFkayJjujNljq-BQiDv8cnUzWN5t-1KsOF1XBkTUK9NfLNY0d2z2wo8ytzVMnbG4cKiCISj3XIwR3U4E_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1463801720&Signature=RzV~DcUQr7kj0kaJE-Yb53ggAbltV3EqHmhO38PNRlxM-NQ1nEb2Mg7dRxYv4MLI5RtRuwbsIydzw5gorHB-8RmKojTE30syCKDa-EPQ0YRNnuzzpyxV05FbdARvc~p7hh9pRj0n2FgoLMvDGmiqBJGuwuEXA5ucSQnhCIZjwZk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1458429707&Signature=JwQqqC6jg72AOw8TIoKSBT25kRJGg276slZ6KMtWdJliHxvHchg9ObV-z7BI0Cj7hQOL67bg9LnT9lPCVfAYvv01WyvorbR0szuxwb3NRMxb0mtlrdEwHLknw4lm7oqNr7V4tysLVtITW4weLdRpnj9AiIWdKbglJrZB0TiVxmo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

http://gsf-cf.softonic.com/e57/0bd/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69664855&instance=softonic_en&type=PROGRAM&Expires=1458411189&Signature=OTs1~UrSttwMjCdwW5I6nxs5xOw0XBmB4ZPdVJcJHDpWGL7owrj9M6G2b9qIt6wXVo6IUgWwHJyzYuUWChx7L0wYlL~JpR5gPXuzRWvR6JXCwwsfah~KtBFjjULAmXiRoZAWn83EloH~TJPOdhWa6of6-Mf0FA~acDCG~i4WYTM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=FBDesktop-1-4-0.exe

Scan fbdesktop-1-4-0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.