home

imageconverter_softn.exe

Best Free Image Converter

zxt2007.com

The application imageconverter_softn.exe, “Best Free Image Converter Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
zxt2007.com

Product:
Best Free Image Converter

Description:
Best Free Image Converter Setup

Version:
4.8.0

MD5:
f850bd3416b3c9d6e6a0ba6165657307

SHA-1:
e3b98b587ef50999965553b81648dd42f1706153

SHA-256:
b7ea4cb1a52f78ef013beda882f17713da5f8ca20e42265cfef2c65d0ef9693e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/23/2024 4:27:38 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Downloader.zxt2007.Installer.Meta (M)
16.7.8.10

File size:
1.9 MB (1,994,922 bytes)

Product version:
4.8.0

Copyright:
Copyright 2009-2013 ZXT2007.com.

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:RFoPVYFZSL9bt4kkH8ztXTEYWNpf4vugqBqy+C:RFzFAZIHUGbqO

Entry address:
0x9B34

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 66, 95, FF, FF, E8, 6D, A7, FF, FF, E8, 98, C9, FF, FF, E8, DF, C9, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, EB, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, B4, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, C8, CF, FF, FF, 8B, 55, F0, B8, F4, CD, 40, 00, E8, 17, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, F4, CD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9897

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file imageconverter_softn.exe has been seen being distributed by the following 5 URLs.

http://gsf-cf.softonic.com/e3b/98b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=329910&instance=softonic_en&type=PROGRAM&Expires=1441138937&Signature=TUFDR62IigwOkbMQPxkfP9wWpccBgHJ92LwqxW1Vj1x7u69O2GAdVVDmd9ZXyn8D7Vrj6u1lGBtmx7XA431AGpqvTzMuVyowXHMlikdpv~~Xd6bYsVTsKa9OvXF6hpfy5EIaiZn6TSP9n6VUCELHUhaz1FqKuExcMNBRTmlDQaE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=imageconverter_softn.exe

http://gsf-cf.softonic.com/e3b/98b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=329910&instance=softonic_en&type=PROGRAM&Expires=1438380564&Signature=ZPebSL73Uggcj3ajnlbjOqZ1~LPoB8MxuGeSXO200ttAt-2ZwgDMo9h7v8N7XYdcDFdl4ueCB9Jyu8NwKVfz-n9hvog1k25j~Wbd6Kgtromivt4ZYMXLLbzfDfSAjjfgHLC0WiqPxNo0OG12iFe-V01AIVaPmTmQam39xZtCmAE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=imageconverter_softn.exe

http://dc501.4shared.com/download/.../Best_free_image_converter.exe

http://gsf-cf.softonic.com/e3b/98b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=329910&instance=softonic_en&type=PROGRAM&Expires=1433834087&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=hMix1TDOdBw8bvEt9ByKqOhZiSVnWshkohh1Fs6vdAK-NO-Q4wMgiqKHcvDpi2DV6Y5SYOq04aQyzplu4Gp37b7axG4mkc5MevMyFBxmzopr~4Kpk3PGSlCa0OkOOIyrHoL3Pb8K8j~PBBp5mqqvPn~wy7jQnkZKqEzYLAEV9-U_&filename=imageconverter_softn.exe

http://gsf-cf.softonic.com/e3b/98b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=329910&instance=softonic_en&type=PROGRAM&Expires=1438795410&Signature=fX37fR3ad8ZDCUDDpNWYfW68LurUdzOwHt~ye1BN52hbZ4FjPVmco5xHqTRh4Le5UImebfal5GsG6OJHEVK-gqNHisqOZuH3fL2Uqt47LHEoFcVxOqPfBKJGBTpzMXSOINDDO-VLVUm31O42IesqGEM4jN41GJ3sCQ~V712nFI4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=imageconverter_softn.exe

Remove imageconverter_softn.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.