home

ffsetup3.8.0.0.exe

Format Factory

chen jun hao

The application ffsetup3.8.0.0.exe, “Format Factory Video/Audio/Picture Converter” by chen jun hao has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from format-factory.he.softonic.com and multiple other hosts.
Publisher:
Free Time  (signed by chen jun hao)

Product:
Format Factory

Description:
Format Factory Video/Audio/Picture Converter

Version:
3.8.0.0

MD5:
663dcb683807199b6019d10a3ecbcd98

SHA-1:
42697b3b2a0fb929e4d76bf33e023456c014a071

SHA-256:
b7d5f8ea76372437ad1c846e8c31d87556bdc10336360146da235fd8b829941a

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
4/27/2024 2:07:52 AM UTC  (today)

Scan engine
Detection
Engine version

Comodo Security
Application.Win32.BaiduWrapper.DA
23459

ESET NOD32
Win32/Toptools.A potentially unwanted (variant)
9.12448

K7 AntiVirus
Adware
13.211.17616

Reason Heuristics
PUP.chenjunhao.Installer (M)
15.10.22.13

File size:
53.4 MB (56,021,632 bytes)

Product version:
3.8.0.0

Copyright:
Free Time

Trademarks:
Format Factory Application is a trademark of FreeTime

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\ffsetup3.8.0.0.exe

Digital Signature
Signed by:
chen jun hao

Authority:
GlobalSign nv-sa

Valid from:
6/25/2013 12:09:13 PM

Valid to:
6/25/2016 12:09:13 PM

Subject:
CN=chen jun hao, C=CN

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11215F9DDE67138EA8C52C9F6F1901954DE8

File PE Metadata
Compilation timestamp:
12/17/2013 8:46:05 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
1572864:qEbz75Xxt/zr9aDtKp8IkhYSvqkAUnw89:nTPt/zpaDtKp8XvpAUwO

Entry address:
0x3A0A

Entry point:
81, EC, D8, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, DB, 5E, 89, 5C, 24, 18, C7, 44, 24, 10, 40, A2, 40, 00, 89, 5C, 24, 14, FF, 15, 90, 90, 40, 00, 89, 44, 24, 1C, FF, 15, 34, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 90, 40, 00, 53, FF, 15, 30, 93, 40, 00, 6A, 08, A3, B8, 3E, 47, 00, E8, 2B, 2A, 00, 00, 53, 68, B4, 02, 00, 00, A3, D0, 3D, 47, 00, 8D, 44, 24, 3C, 50, 53, 68, 84, A3, 40, 00, FF, 15, A4, 91, 40, 00, 68, 6C, A3, 40, 00, 68, C0, BD, 46, 00, E8, 0D, 27, 00, 00, FF, 15, B4, 90, 40, 00, 50, BF...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
30.5 KB (31,232 bytes)

The file ffsetup3.8.0.0.exe has been seen being distributed by the following 50 URLs.

http://format-factory.he.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmqGLpKSmk5c=

http://dl1.afterdawn.com/download/d2b8de2f9affaf18b80a60347dc326e5/57e49763/.../FFSetup3.8.0.0.exe

http://filehippo.com/download/file/.../

http://soft.mydiv.net/win/dlfiledd4a5_284097/.../FFSetup3.8.0.0.exe

http://ftp-stahuj.centrum.cz/dl/defb6a51098bb984b512841bdf51b063/5766d4b7/stahuj/download/software/secured/f/format-factory/.../FFSetup3.8.0.0.exe

https://download.heise.de/files/FRSfuNuD_8mXXpQGspZkxw/.../ffsetup3.8.0.0.exe

http://lb.cdn.m6web.fr/d/c/a/231b72ff88405c4a245f4e509f512eb5/56d5ac68/soft/.../formatfactory_3-8-0-0_fr_223920.exe

http://format-factory.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmqCInqCkk50=

http://lb.cdn.m6web.fr/d/c/a/da7890b0055bf2204d6fcd51f43f4064/571a0e5a/soft/.../formatfactory_3-8-0-0_fr_223920.exe

http://www.filesetups.com/windows/multimedia/.../download

https://download.heise.de/files/yyc1Dh7e9yeR7lHSI5HfDQ/.../ffsetup3.8.0.0.exe

http://www.tuinformaticafacil.com/descargas-gratis/utilidades-windows/reproductores-video/.../download-format-factory?task=verify

http://filehippo.com/download/file/.../

http://ftp-stahuj.centrum.cz/dl/5feafeb1bb21ea17b4d73c17314da78d/56eadb41/stahuj/download/software/secured/f/format-factory/.../FFSetup3.8.0.0.exe

http://format-factory.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmqGKp52hmpc=

http://filehippo.com/download/file/.../

http://lb.cdn.m6web.fr/d/c/a/f471fc1606336a66150eb124bbf6dc22/56e86a7b/soft/.../formatfactory_3-8-0-0_fr_223920.exe

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://ftp-stahuj.centrum.cz/dl/7041a54550613fd0bad52936c5c99558/572b1fa4/stahuj/download/software/secured/f/format-factory/.../FFSetup3.8.0.0.exe

http://filehippo.com/download/file/.../

http://lb.cdn.m6web.fr/d/c/a/623ef02d9bd4ed1ec76be44b9d404e48/56953d0c/soft/.../formatfactory_3-8-0-0_fr_223920.exe

http://telechargement2.pcastuces.com/temp6bs2/.../FFSetup3.8.0.0.exe

http://lb.cdn.m6web.fr/d/c/a/f71062eb055761a09a6173740fe25106/56e5a2f6/soft/.../formatfactory_3-8-0-0_fr_223920.exe

http://format-factory.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmqCLp56kkpU=

http://filehippo.com/download/file/.../

http://telechargement5.pcastuces.com/temp6bs2/.../FFSetup3.8.0.0.exe

http://lb.cdn.m6web.fr/d/c/a/4c405a306e212b59854d472d14aac73f/56e59703/soft/.../formatfactory_3-8-0-0_fr_223920.exe

Latest 30 of 1,797 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-52-49-170-39.eu-west-1.compute.amazonaws.com  (52.49.170.39:80)

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (199.58.87.151:80)

TCP (HTTP):
Connects to ec2-52-30-150-214.eu-west-1.compute.amazonaws.com  (52.30.150.214:80)

TCP (HTTP):
Connects to ec2-54-207-11-184.sa-east-1.compute.amazonaws.com  (54.207.11.184:80)

TCP (HTTP):
Connects to ec2-52-208-40-227.eu-west-1.compute.amazonaws.com  (52.208.40.227:80)

TCP (HTTP):
Connects to ec2-52-67-230-187.sa-east-1.compute.amazonaws.com  (52.67.230.187:80)

TCP (HTTP):
Connects to ec2-52-50-196-247.eu-west-1.compute.amazonaws.com  (52.50.196.247:80)

TCP (HTTP):
Connects to ec2-52-206-2-43.compute-1.amazonaws.com  (52.206.2.43:80)

TCP (HTTP):
Connects to ec2-52-214-247-42.eu-west-1.compute.amazonaws.com  (52.214.247.42:80)

TCP (HTTP):
Connects to ec2-54-154-109-8.eu-west-1.compute.amazonaws.com  (54.154.109.8:80)

TCP (HTTP):
Connects to 92b91b35.rdns.100tb.com  (146.185.27.53:80)

TCP (HTTP):
Connects to ec2-34-198-225-71.compute-1.amazonaws.com  (34.198.225.71:80)

TCP (HTTP):
Connects to 92b91b2d.rdns.100tb.com  (146.185.27.45:80)

TCP (HTTP):
Connects to 50.115.122.45.static.westdc.net  (50.115.122.45:80)

TCP (HTTP):
Connects to ec2-54-191-59-48.us-west-2.compute.amazonaws.com  (54.191.59.48:80)

TCP (HTTP):
Connects to ec2-52-30-226-196.eu-west-1.compute.amazonaws.com  (52.30.226.196:80)

TCP (HTTP):
Connects to ec2-54-186-199-44.us-west-2.compute.amazonaws.com  (54.186.199.44:80)

TCP (HTTP):
Connects to net-inst-ash.opera.com  (37.228.108.239:80)

TCP (HTTP):
Connects to ec2-52-45-150-52.compute-1.amazonaws.com  (52.45.150.52:80)

TCP (HTTP):
Connects to ec2-52-39-235-174.us-west-2.compute.amazonaws.com  (52.39.235.174:80)

Remove ffsetup3.8.0.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.