Malware scan of installplus500.exe (Downloader) 180164cec6b13c8e78e16e71bb3d27cd9d05f248

File name:

installplus500.exe

Publisher:

Plus500 LTD (signed and verified)

Product:

Downloader

Version:

24, 24, 24, 24

MD5:

9fe4aca1099cdd4c5d3e8b97393a84d7

SHA-1:

180164cec6b13c8e78e16e71bb3d27cd9d05f248

SHA-256:

b9c874b66a9d971d84b5f2aab947869135ed9ed8868bc15b8c086cf0421d8607

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

8/5/2025 5:37:36 PM UTC (today)

Scan engine

Detection

Engine version

Trend Micro House Call

HV_ZYX_BK08273A.TOMC

7.2.299

File size:

375.5 KB (384,488 bytes)

Product version:

24, 24, 24, 24

Copyright:

Original file name:

Downloader.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\installplus500.exe

Signed by:

Plus500 LTD

Authority:

Thawte, Inc.

Valid from:

7/10/2012 2:00:00 AM

Valid to:

7/11/2014 1:59:59 AM

Subject:

CN=Plus500 LTD, O=Plus500 LTD, L=Haifa, S=Israel, C=IL

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

7C6F587B1B767D3EAEBC9DFC59AD9FB8

Compilation timestamp:

2/24/2014 1:25:52 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:jbr4/Uu59fyzp+V7uYQshpFT9Si2o0Yo+1557x:X8/Uu59fMpQ7LQshpxxz0D+15v

Entry address:

0x30D7E

Entry point:

E8, 10, B5, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 28, 53, 56, FF, 75, 0C, 8D, 4D, F0, E8, 4B, F6, FF, FF, 8B, 75, 08, 33, DB, 3B, F3, 75, 28, E8, C5, 26, 00, 00, 53, 53, 53, 53, 53, C7, 00, 16, 00, 00, 00, E8, 10, DC, FF, FF, 83, C4, 14, 38, 5D, FC, 74, 07, 8B, 45, F8, 83, 60, 70, FD, D9, EE, EB, 61, 8B, 45, F0, 83, B8, AC, 00, 00, 00, 01, 7E, 14, 8D, 45, F0, 50, 0F, B6, 06, 6A, 08, 50, E8, C6, A8, 00, 00, 83, C4, 0C, EB, 10, 0F, B6, 0E, 8B, 80, C8, 00, 00, 00, 0F, B7, 04, 48, 83, E0, 08... 
[+]

Code size:

287 KB (293,888 bytes)

Program Uninstaller

Program name:

Plus500

Uninstall string:

C:\Program Files (x86)\Plus500\Plus500.exe /uninstall

The file installplus500.exe has been seen being distributed by the following 3 URLs.

http://download.plus500.no/DownloadService.svc/InstallNewDownloader?bid=0&hl=no&id=2093&tags=g_sr NorwaySearch_cp Stocks_ag oslo**børs**aksjer_ks Phrase_mt c_de g_nt &refurl=http://www.google.no/aclk?sa=l&ai=Cz6V_lbw1U8e1H8K8ywOZ94CoDNmo48sC-dG35nzm94T8NAgAEAEgyZiiCygDUK32_vYBYMPcpIWYGKABz_rs7QPIAQGpAmD1-GNwErc-qgQiT9B4aq8TlySe-ATtcs8FrOGPgppt34Sq_uSGID0i4GraTYAFkE6AB5mFkxKQBwM&sig=AOD64_3V4jK0F_qGCMedrp1auRUswvA5yA&rct=j&q=oslo børs aksjer&ved=0CCwQ0Qw&adurl=http://.../?id=2093&tags=g_sr NorwaySearch_cp Stocks_ag oslo**børs**aksjer_ks Phrase_mt c_de g_nt &א