» foxitreader544.1128_enu_setup.exe
Overview
Analysis
File Details
Programs (1)
Downloads (6)

foxitreader544.1128_enu_setup.exe

Foxit Reader Setup

Foxit Corporation

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from f51.y8top.net and multiple other hosts.

File name:

Publisher:

Foxit Corporation (signed by Foxit Corporation)

Product:

Foxit Reader Setup

Version:

5.4.4.1128

MD5:

9829f7e7ba31121f45a9788f02fd5fed

SHA-1:

ffd3e03755dc6f6e444e99db836ca25df531f220

SHA-256:

5e1b082bd2347248e3b7f4f3399b70a71a8f966e86f1fe178d5c633370319c40

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

4/27/2024 3:56:18 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/Bundled.Toolbar.Ask (variant)

8.9477

File size:

15.2 MB (15,952,832 bytes)

Product version:

5.4.4.1128

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Common path:

C:\users\{user}\downloads\foxitreader544.1128_enu_setup.exe

Digital Signature

Signed by:

Foxit Corporation

Authority:

GoDaddy.com, Inc.

Valid from:

5/3/2010 3:33:52 PM

Valid to:

5/3/2013 3:33:52 PM

Subject:

CN=Foxit Corporation, O=Foxit Corporation, L=Fremont, S=CA, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

64A7A038A7B2

File PE Metadata

Compilation timestamp:

4/10/2010 11:57:59 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

393216:I+pV5M1aOp1FfiI0FaK6uMxcC5WxAnB9sgdOF9fR:Pn6w+fOMx35WxAnXsgM9p

Entry address:

0x163C4

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 54, 55, 41, 00, E8, 70, 04, FF, FF, 33, C0, 55, 68, 91, 6A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 4D, 6A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, A6, EF, FF, FF, E8, B1, EA, FF, FF, 8D, 55, EC, 33, C0, E8, FB, 87, FF, FF, 8B, 55, EC, B8, B0, D6, 41, 00, E8, A6, EA, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, B0, D6, 41, 00, B2, 01... 
[+]

Entropy:

7.9745

Developed / compiled with:

Microsoft Visual C++

Code size:

85 KB (87,040 bytes)

The file foxitreader544.1128_enu_setup.exe has been discovered within the following program.

Toolwiz BSafe by ToolWiz

www.Toolwiz.com

About 9% of users remove it

The file foxitreader544.1128_enu_setup.exe has been seen being distributed by the following 6 URLs.

http://f51.y8top.net/2107tmp/cf/soft/2013/7/.../foxit-reader_544.exe

http://taimienphi.vn/.../get.ashx?sid=71E4EF4B4719E0FAADF48FFAB0AE1245&type=100&t=12449E678FAA7D21D84E60456C617E98

http://cdn04.foxitsoftware.com/pub/foxit/reader/desktop/win/5.x/5.4/.../FoxitReader544.1128_enu_Setup.exe

http://69.4.238.159/FoxitReader544.1128_enu_Setup.exe

http://dl1.filehorse.com/dl.php?f=4oQKLgnWDglSMBz1nh90FQLjjv8ZFU3C3c3Eu6TOoVbFptm__HP_w-s2-4WGZdY73ftSiyDeqeW5HjPfpJXUsTpM830t8wOqqjmiZ3FDbtVaTByKniK8fdQf9JRFmiyQ,fje1bvcQe_9nkbteYVrUpeH3t8QMd8IEA8cbBIdV23-fVlK7jU6HAOb4NbmlNhEKkVENlFsFCn1bnmrw92AMaA,mlDzfcmNR36Q5edsepsUfLucdsMdtRX8VIJUpNCMzz0

http://fs40.filehippo.com/1303/.../FoxitReader544.1128_enu_Setup.exe

Scan foxitreader544.1128_enu_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.