home

glview412.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
e90f57ddb09b1c13791780e2f518a3c0

SHA-1:
5462fe7b1ba36ed16041145f69d9d5589d3d8018

SHA-256:
f766869c759b184292d9d409e26e48a8638e86e0bfcb335d79a615eebe271357

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/23/2024 1:39:50 PM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
TROJ_GEN.F47V0905
7.2.329

File size:
7.2 MB (7,536,640 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\glview412.exe

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:xD7vID8BeNrzo23xWFMZ46mp3lNCXsZzv9cD5:x7vsb1o23xW76mFCcZzlcD5

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9986

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file glview412.exe has been seen being distributed by the following 12 URLs.

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1472801529&Signature=YjQLqSJIsnEOAuHAIKkl11eLZmPd9DSAAybg8Rezz1YsR3GE429zkC-Ovt243B8pzdnnFLZeqDXGiyk9fA~d9deV7VKKwMghuMbveklT2sXb97I8SNSPv~zCk0AXCQN8CNlNqGPoBObDjDyGl8lB9nu5TV57EnJ~3NLYSaep8AI_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1424199538&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=JlTUR6nSdFYlGKZ3Fl6mpflol-JojXCGU5NBl8OgV36I8-izk04PpXVcevOUR7eAnW-fClzuMK01ki1Mr~YoFbFinvcHLuh~0mqAW96Q9Y~2bGXK8dQ71eGAZvn8p9umS5kzrkyRyni3TKh1tPpCk02FEd6Q4Br59ALbvcakTso_&filename=glview412.exe

blob:http://sd-web.softonic.com/c2525ab0-57a8-4373-862b-2128783cd849

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1458959874&Signature=KxF8zE~kCsyCR-ZglMCJSOfAkZsh0LWn6tQd45gDgqV~TixFTksFImCSkENYmUQkNwHhabLyuUIGcZzuSU-oA2OBgaFAKVXvsMNyrThi0sHgq8kcYl7TmTu7-JYpWgeKoNrJdWpBd1ixULbGfKx38WsO9zFlASsaztccKOBpyOQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1460465900&Signature=RSEfEcO-~mG4ELP7TzJiPWZGz3GLiDg9i5reqpoWNo38Xu8uNHOQec522uNDbcUt53TFlDFHmDW~Iw3XGc2KnL8wkkmK5YCEglaiBXRdwccXEpIHTYXyVrmohTLHHrTZKo-jAoZUQTQHe6mg5W~zNAc~rN6j34M3dBaVLDsewPg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1456617371&Signature=Q-iD0MV1uVPmSttuy0lkW3FhH0za3d75T8et6y-czNLeB~lBwknW3lMt-UXVFiXiI3GXq8KSEx2wdB4BdO8QXj~eYiQBIhp7rVRCwDNDnnj4iEwrxTnmKP~fnnsOOEtt9OZMIxaN5YWLr5CvhoZOPgoCIe4a2Wka24scSGSd2fg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1459116235&Signature=Km8ceNlgv8wqPWri4pfKhwU~wbFEHvh9A9XlkqjkpAfuq8jAqUbkiL-ZJ4yrDPrGvS4vbVPfB6KN6KVOP9cfoAbMmEHvy8XEzePMe0LyJbnHC7tdOucJIjbG12Hk2ev~pNyOTCHf2wFD0nDibpDYO8ggVOlg9dAHKFElZeQqXU4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1456391905&Signature=cZzZpVgK8nS3cbYveDRd0CH2PU1Ii9-8MSbP9GXZ6fpZQ6qepIGQ97SSStrhTJHkFJi8RIOAlxm9TPlDa8-l2PhhdQLWMih4z1ETz~7u7If-hoIiRZJJivuSS5BOr0WPH5fdqqJoaHZfp5UC~6oa6-2eefS4595yZVS14JcaFvU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1453823259&Signature=Bm8hUZGKwCvwWTN5TExfS9iDix8itDFU-1d6ocqRdqgtMFSsGWGius4KBe~puD6tC7sB3z4vMeXs9b-rzVF5ZxqZsvSClSHXA1KpT14jyXjCyLGQTwV~-538vYuvNfHzcl~1hseja9r6JjK0lws4DKwXCAl4RxZzU2eKKV1nOHo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1438972898&Signature=Xj3fLuOtZJyYGtFdDwDX~~GPMQAsj3Wpj4TaDDf5DR4JCyIV9zuX3gz95o5C-SN7-mU-r~cfrpP-rwMxAkhtRUT9yLtzpwMoX162zAE55olY~Qd9yg5b94XEeVCfXKNWvqMwOb2VOJKgsdrEdMWhT9jl-bXdKOv~rqia0QmPNdE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glview412.exe

http://gsf-cf.softonic.com/546/2fe/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69103&instance=softonic_en&type=PROGRAM&Expires=1433637328&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Wxdx4fxN94jl6FY5JOfI5rc9aiBl4nsybHebV1tF94~cVvAN1urZUwcrkmVVtOIKGOhYOi7eDUz~TaQ6tmd2Jb~yG4usuuYW6tLA8i-hcfxcnkKaBB5qu2AVPYfvKVyZB9w1RguDsy7C0Gt-i--qWbpQ4HSk-8cKnL5AAWI~YEE_&filename=glview412.exe

ftp://ftp2.realtech-vr.com/realtechv/.../glview412.exe

Scan glview412.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.