home

freesoundrecorder.exe

Web Software

Prog Lite Installer

The executable freesoundrecorder.exe, “Web Software Setup ” has been detected as malware by 10 anti-virus scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from www.cleanconecptdl.com.
Publisher:
Prog Lite Installer

Product:
Web Software

Description:
Web Software Setup

MD5:
6b838260d66c391eaa5b28df1cbed000

SHA-1:
a2aff9a58f62cf64326ff027536fb695d9e1120e

SHA-256:
df22b8bb1943e1fbe13a375d3b2798e0ac44bbbcebddc11d248e2663ff64ced4

Scanner detections:
10 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
5/11/2024 1:59:59 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160310-2

AVG
Win32/Sality
2015.0.4530

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.15.21

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Trojan.Artemis!DC81366C1A09
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.215.1327.0

File size:
980 KB (1,003,520 bytes)

Product version:
5.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freesoundrecorder.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:btjlmixVYPchE3nUeRAJv5H7puxtqvVQXldh8:blXVtAUeaJvxkbs8ldh

Entry address:
0x9C40

Entry point:
FE, CC, 24, 7F, C6, C2, 24, 46, 86, F2, 29, D1, F2, 69, FD, 3B, F6, 9A, 88, 23, C6, 71, 04, 89, C0, 29, EF, 6A, 00, 5B, 31, C8, 81, F3, 95, 9A, 00, 00, 0F, B7, FE, 81, C3, 18, 06, 00, 00, 85, D1, 71, 02, 84, FF, 8D, 05, C0, B6, 14, D4, 8B, F1, 1A, F8, 57, 8D, 1D, 08, 73, 7D, F8, BD, 40, F3, 13, F5, 20, EB, E8, 00, 00, 00, 00, 5A, 87, DB, 68, 6C, 7A, C8, 00, 0F, AF, F9, 84, CC, 8A, DC, EB, 06, 69, F3, E5, 9F, E6, D0, 53, 68, 44, B9, CD, 00, 71, 06, C6, C7, 30, 87, FF, F3, 0A, E4, 2C, 2C, FE, CB, 28, DD, 29...
 
[+]

Code size:
37 KB (37,888 bytes)

The file freesoundrecorder.exe has been seen being distributed by the following URL.

http://www.cleanconecptdl.com/c?x=b2qx81an co qdBdiFqyKfIaMwH s4prb4fwsTFn1j8=&c=09gqc7Nc4Xl9Me9AIJz6YjJsY8eWe8AlzRRmNv 57y m1YFOl9ndVoVjVpMQsKXYj N23gS9ZEnUQjzwfy1QL3Qb0sw9aroR/jPt0tQ3qNDSvHX/9gv4kgtWuCnfSKIy&downloadAs=FreeSoundRecorder.exe&fallback_url=http://.../

Remove freesoundrecorder.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.