Malware scan of hotspotshield-setup_540.exe 66f59f946b116d84b2787ee2010ce6d1cc2635d9

File name:

hotspotshield-setup_540.exe

Publisher:

AnchorFree Inc (signed and verified)

MD5:

8e38237be03206708bbf275d9f936ae2

SHA-1:

66f59f946b116d84b2787ee2010ce6d1cc2635d9

SHA-256:

ef8879160c79854088782228330aa68064dc798efe2f0c6fc4e65758bef9417a

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/24/2024 6:53:16 AM UTC (today)

File size:

569.9 KB (583,584 bytes)

File type:

Executable application (Win32 EXE)

Installer:

HotspotShield

Common path:

C:\users\{user}\downloads\hotspotshield-setup_540.exe

Signed by:

AnchorFree Inc

Authority:

VeriSign, Inc.

Valid from:

3/28/2011 2:00:00 AM

Valid to:

4/14/2014 1:59:59 AM

Subject:

CN=AnchorFree Inc, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=AnchorFree Inc, L=Sunnyvale, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

68A4A0CC448443C288A22A91D7F82126

Compilation timestamp:

6/22/2012 8:07:51 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:jOjcUX7Hb1Jj6noPT0utIxA+Uj3AeX7X0Af4qIn4lEAggFJzhqWf7SYcPmwOBi:6jjn2oPTuA+UbuAfrk4yAg0bqRPTOA

Entry address:

0x333B

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, B0, 73, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, C0, 70, 40, 00, 53, FF, 15, 88, 72, 40, 00, 6A, 08, A3, B8, 3C, 42, 00, E8, 2C, 25, 00, 00, 53, 68, 60, 01, 00, 00, A3, C0, 3B, 42, 00, 8D, 44, 24, 38, 50, 53, 68, 43, 74, 40, 00, FF, 15, 64, 71, 40, 00, 68, 38, 74, 40, 00, 68, C0, 33, 42, 00, E8, 1D, 24, 00, 00, FF, 15, BC, 70, 40, 00, 50, BF, 00, 90, 42, 00, 57, E8, 0B, 24, 00, 00... 
[+]

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file hotspotshield-setup_540.exe has been seen being distributed by the following 30 URLs.

http://snow-apps.com/?dl=1&pi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck1o 3xzcrW0UXNoIKVBDkD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWiLLm7dREhKVuvmAWASDChTMm7dlChV8zNZM0NzaRNZnm7K2pDZ1fAjczNZMyNTi4Ag==&pd=2323UmDyDKLtDdWP HAu7dWt&campaignId=9jn0Ajg3NTL0AZMq

http://bestdownloadme.com/?dl=1&pi=Ajg4NzcyAzi3Ai==&osos=VdluDrW3cw==&dr=cHaWck1o 3xzcrW0UXNoIKVBDkD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV80OZCzNzaRNZnm7K2pDZ1fATi1AzgRNTi4Ag==&pd=2323UmDyDKLtDdWP HAu7dWt&campaignId=9jn0Ajg1AzC0AZMq

https://s3-ap-southeast-1.amazonaws.com/.../hotspotshield-setup_540.exe

https://doc-10-1k-docs.googleusercontent.com/docs/securesc/1nr0bv2f9cefqo6tt3rdipv0r8ibe441/drg45padgpq69m0cmb7u3btqljls966e/1411192800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?h=16653014193614665626&e=download

https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/77mlvqsdrjchai50f6cg90tk04mqnvn9/1409529600000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&nonce=lsfh8jhohalda&user=14793849345403396851&hash=532rrg9m797gasp7p60gk7v2pn3aplq1

https://docs.google.com/nonceSigner?nonce=lsfh8jhohalda&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/77mlvqsdrjchai50f6cg90tk04mqnvn9/1409529600000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=so90rkktavdod8pgd1bob3756dnrqvc1

https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/77mlvqsdrjchai50f6cg90tk04mqnvn9/1409529600000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?h=16653014193614665626&e=download

https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&nonce=sb299n4nc0p26&user=14793849345403396851&hash=2aetg49fs18ou1f4dja4f4mgqmtgco8p

https://docs.google.com/nonceSigner?nonce=sb299n4nc0p26&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=feg1u9q6h62sdleh1ciko0fs46nhb97i&pli=1

https://docs.google.com/nonceSigner?nonce=sb299n4nc0p26&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=feg1u9q6h62sdleh1ciko0fs46nhb97i&pli=1&auth=DQAAALkAAADtux2xG3u9N6TtPm8sW4TkHOvFNHrDU9mcK1zCf0Um0OqSuNWepnSzOzHg5dVtgmEgl2zZIx51MPskUuS05LdTavZSD7rL7lonEdibyIXAjeYgBj4OxzHPVWHXkfxSRDtqXZKHUXvX3KmlxQDSL8V1NpnrH5DqpecxT_3ufJ1a7XwxwLSQkOQCNyLVJh_gv3uNC3Dw_0Jt-HZblYvkEK9_yvWqWs4Jpzh7nlLFTRx8drTMKEga_LltX0jUwMKFvC0&authuser=0

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=sb299n4nc0p26&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=feg1u9q6h62sdleh1ciko0fs46nhb97i&followup=https://docs.google.com/nonceSigner?nonce=sb299n4nc0p26&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=feg1u9q6h62sdleh1ciko0fs46nhb97i&ltmpl=homepage&emr=1&authuser=0

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=sb299n4nc0p26&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=feg1u9q6h62sdleh1ciko0fs46nhb97i&followup=https://docs.google.com/nonceSigner?nonce=sb299n4nc0p26&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=feg1u9q6h62sdleh1ciko0fs46nhb97i&ltmpl=homepage&emr=1&authuser=0

https://docs.google.com/nonceSigner?nonce=sb299n4nc0p26&continue=https://doc-0c-54-docs.googleusercontent.com/docs/securesc/5d3dgtv2ke76e8ffa2kepi4bqvfortur/nh3laqf9vu6ovu8s19utqd4ciof7665t/1408996800000/16092547177565562282/.../0B0RFLzzTuwqrbmJRaWxmc3ZZOGc?e=download&h=16653014193614665626&hash=feg1u9q6h62sdleh1ciko0fs46nhb97i