home

hss-3.33-install-e-550-plain.exe

Hotspot Shield

AnchorFree Inc

This is the downloadable installer to AnchorFree's Hotsopt Shield, an ad-supported VPN client that integrates with the browser. The free version injects ads in the web browser. The application hss-3.33-install-e-550-plain.exe by AnchorFree Inc has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the HotspotShield installer. The file has been seen being downloaded from dla.uloz.to and multiple other hosts. While running, it connects to the Internet address 74-115-2-220.anchorfree.com on port 80 using the HTTP protocol.
Publisher:
AnchorFree Inc  (signed and verified)

Product:
Hotspot Shield

Version:
3.33.0.23462

MD5:
d00a74a656c690ed219313d057102e7b

SHA-1:
9a555efc0d58fe042b4cb7710e61ef5f2923bd76

SHA-256:
f8d61e61447427be9a537f0bc652742848850f221eb77bc9df88e5746e340a4a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 10:19:54 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.AnchorFree.Installer.Meta (L)
16.6.10.9

File size:
8.4 MB (8,786,640 bytes)

Product version:
3.33.0.23462

File type:
Executable application (Win32 EXE)

Installer:
HotspotShield

Common path:
C:\users\{user}\downloads\hss-3.33-install-e-550-plain.exe

Digital Signature
Signed by:
AnchorFree Inc

Authority:
VeriSign, Inc.

Valid from:
3/28/2011 2:00:00 AM

Valid to:
4/14/2014 1:59:59 AM

Subject:
CN=AnchorFree Inc, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=AnchorFree Inc, L=Sunnyvale, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
68A4A0CC448443C288A22A91D7F82126

File PE Metadata
Compilation timestamp:
9/9/2009 3:22:54 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
196608:+jPQ6m25H5o1DKtWjdTc0tJySPHnlN5NREpDfm26UFkurruVa+S5hd:+j425H21qODtJySHnlJepDv/Aa+S5L

Entry address:
0x33FF

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 70, 85, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, B8, EE, 7E, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, ED, 7E, 00, 8D, 44, 24, 38, 50, 55, 68, 6C, 85, 40, 00, FF, 15, 80, 81, 40, 00, 68, 54, 85, 40, 00, 68, C0, 6D, 7E, 00, E8, 35, 26, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, F0, 83, 00, 57, E8, 23, 26, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

The file hss-3.33-install-e-550-plain.exe has been seen being distributed by the following 10 URLs.

http://dla.uloz.to/Ps;Hs;fid=44396430;cid=1213958381;rid=1226732302;up=0;uip=213.235.68.217;tm=1471464336;ut=f;aff=uloz.to;did=uloz-to;He;ch=be3dd3e993572e58f7c12162ffca3933;Pe/.../minecraft-unbanip-hack-exe?bD&c=1213958381&De

http://dla.uloz.to/Ps;Hs;fid=44396430;cid=1093356469;rid=689271135;up=0;uip=46.29.224.68;tm=1474203105;ut=f;aff=uloz.to;did=uloz-to;He;ch=8fced6030c5c823a11f4bf83b8324887;Pe/.../minecraft-unbanip-hack-exe/.../minecraft-unbanip-hack-exe?bD&c=1093356469&De

http://dla.uloz.to/Ps;Hs;fid=44396430;cid=547336040;rid=1963349379;up=0;uip=46.234.167.18;tm=1471109529;ut=f;aff=uloz.to;did=uloz-to;He;ch=2d53a39eba7aabec2300a7216340ddad;Pe/.../minecraft-unbanip-hack-exe?bD&c=547336040&De

http://dla.uloz.to/Ps;Hs;fid=44396430;cid=299309045;rid=1416018174;up=0;uip=91.127.139.76;tm=1452184638;ut=f;aff=uloz.to;did=uloz-to;He;ch=8d942ee361957c40a75cb93b1fc3b92d;Pe/.../minecraft-unbanip-hack-exe?bD&c=299309045&De

http://dla.uloz.to/Ps;Hs;fid=44396430;cid=1386168901;rid=1135836253;up=0;uip=37.221.244.185;tm=1463903096;ut=f;aff=uloz.to;did=uloz-to;He;ch=c45d97cacfc4e1434af95a560b557203;Pe/.../minecraft-unbanip-hack-exe?bD&c=1386168901&De

http://dc337.4shared.com/download/.../HSS-333-install-e-550-plain.exe

http://dla.uloz.to/Ps;Hs;fid=44396430;cid=789044392;rid=1430896805;up=0;uip=90.176.229.53;tm=1459533013;ut=f;aff=uloz.to;did=uloz-to;He;ch=f69fabc0b834054aaa1a80509ad6ee29;Pe/.../minecraft-unbanip-hack-exe?bD&c=789044392&De

http://dla.uloz.to/Ps;Hs;fid=44396430;cid=528229464;rid=900280551;up=0;uip=37.201.7.108;tm=1458126373;ut=f;aff=uloz.to;did=uloz-to;He;ch=ff72bbb91b47617fd8bd95f6ceab0d80;Pe/.../minecraft-unbanip-hack-exe?bD&c=528229464&De

https://www.ztunnel.com/index.php/.../6b7c77498146019caa2fcd3c85fa7591911bdcdcb966829987747df55ec11d6419404786f44addac7577f5ff26efd335ebd855353f0b86cdb387b3f8b515136

http://mydati.com/download/.../HSS-install-e-550-plain.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 74-115-2-220.anchorfree.com  (74.115.2.220:80)

TCP (HTTP):
Connects to 74-115-2-210.anchorfree.com  (74.115.2.210:80)

Remove hss-3.33-install-e-550-plain.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.