home

magic_partition_recovery.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from t1.softonicads.com and multiple other hosts.
MD5:
3d068d9b0cb2f392ae9e9aa824172cf1

SHA-1:
bd5205c601f516a088f0df0d1cd56f059ac521b4

SHA-256:
fcc79767e98057f0db3decfbfa0dfe8229349bb81b2670b7af5814d437f46766

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/26/2024 6:14:10 PM UTC  (today)

Scan engine
Detection
Engine version

Zillya! Antivirus
Trojan.Kryptik.Win32.807709
2.0.0.2554

File size:
13.7 MB (14,397,577 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\nueva carpeta \magic_partition_recovery.exe

File PE Metadata
Compilation timestamp:
2/24/2012 2:19:54 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
393216:Z3iNR/LMYdEzQBNG5H2KqK1qS8wYQVoJt4U:BApyzQHGAKj8wxA4U

Entry address:
0x3883

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, 92, 40, 00, FF, 15, 84, 81, 40, 00, 68, 4C, 92, 40, 00, 68, C0, AD, 46, 00, E8, 18, 27, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
27.5 KB (28,160 bytes)

The file magic_partition_recovery.exe has been seen being distributed by the following 14 URLs.

http://t1.softonicads.com/tracker.php?ev=c&co=DZ&sid=3e72a174bbd08f8d682c3243e4163b43&upv=6e5cbedbdd46376f450f46ec383eb4fc&z=results&sk=0&abp=0&params=32BFEDE632474BF73FB6571EF67B57F43C4B2CE9CADEC151C6982ED91B896EB70EA1A32B8F98120DD5961245CA13EA211F25EDF74F46102913F91169601FE031A967F438D8B1C737A702502F41463E32DCFBA1BAF950B07A2FF647EC8B0782DB7290EFED46D3BBF789ADF3CC0F2A034241E40A86294641FE149FCEBAE7C49F7ADB43212316D98A2249B65AB1A9ADB5D5863E52913051F963F7386E6AF1E39B62&h=A5175F18489A5E1F6024A6A3E0271CC6864A64C8252DA1E6B19E7C5613EC42A4&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=CO&sid=a07a22212144041ba27847fdab41cb21&upv=c7420034468a0e931a7bce8e2bf5c271&z=results&sk=0&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAE1A16743FECF3EECEB4DC3D7B3E7AEFB73F2ED3B170DB1A6DF715318E1CA89EB77F6F219C6988DD0EC1F368B275886F8079ACE7E48781F9BE028B5204B40E0BF1053F862F32CDEDFA7A63D469B994FDF8059257C3AFD14D9193A4264F2C8C502C1DC32932934C33DDD05DDCFA07BB9FD483B7B05F25E2412CBE617E15720091230A170D99F53B5FE42BF5BC6649C66F0C57AEA557F78C81B7C515B491BE6EC9F&h=3B9DFC9CB20AC32694CFE38572E8D2E3E4B9B62FA0192C555C023EF3B06F3443&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://de.softonic.com/sads/tracker.php?ev=c&co=AT&sid=043bf69c745dd56ff81c80fbd2fd14fa&upv=6b8cd39d695e5aa3227e6f11a35e0c75&z=results&sk=0&abp=0&params=E58A21D548552342230FD9D405D3DC9D87AE0DAD9E5B8A6D8970800317B0CBC68DDAF93E9A4F74A63A269EFCC4D901AB40FAECF33D3FFF46E131980A644A4DA8696600A7B30CD6F4DB095F594CD082F11950055629FF56BCF8DA709728B529B39D1E79533778F47C8B66F495750DD1570A9F2B6A6795BF596181AE74EAC6B6DCA610D3C81B4E2ED4950703B4307D318DB4B162AFD1A6149D41EC26212672F10C0F3CD12A3526AB1B279ED9D6AB9A65B1&h=2F7FD727E1406F68B9A473C922C4C27281D0E46063B2E005111CE81F1A5FCB81&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://fr.softonic.com/sads/tracker.php?ev=c&co=FR&sid=33b22facc15cea234bc42d15f98900b1&upv=ef74ec46320c6afe13691d64a7af60e6&z=results&sk=0&abp=0&params=32BFEDE632474BF73FB6571EF67B57F43C4B2CE9CADEC151C6982ED91B896EB70EA1A32B8F98120DD5961245CA13EA21C9DC92173C1BDEB8C873E6EF8CFB87435D16192079B7B68D71F3C842DFCDC454A13F94732BB619BD29A7389132AA9A4875BCEEEF06D718A6A10DACF97CDF84172E5C2FBA9EBF826620EE2BA2B6052CCCCB4716DEFEB2B7AC2E12B161EE67C4C998E1665577DB2D59B94BB9F6BE2DF516&h=E19E43F5CEDEFB7844939F9B51708A799D00B1020FE278B3D90E6F469834DCE4&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://gsf-cf.softonic.com/bd5/205/.../Magic_Partition_Recovery.exe

http://fr.softonic.com/sads/tracker.php?ev=c&co=TN&sid=34d131a8eaeec351621f8e0d80350d2f&upv=d706ae4ab2a05a270d7145b67175cbe0&z=results&sk=0&abp=0&params=32BFEDE632474BF73FB6571EF67B57F43C4B2CE9CADEC151C6982ED91B896EB70EA1A32B8F98120DD5961245CA13EA21214FCA442115E4F859E37EF3F632EC6319A9FCA67BFBE1BDE208BC96D62A85B65E69FC1AA0BA80CD348008A922EF8AFCE60A503806354DF87754DAAF44A61575C2770B1D41B3C56F41570275E3C7825C0AFAAC363CB1DAD241D64509A4B66C3499C54EB741B0C8A8E44FE5C9BBDA611A222A90B25E4F85CFE31AE0D9A102421B&h=04FF562CDC1898FFC8E613ADBB1D4DEDAB622AFE41318186E6A0984E12E696BB&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://magicpartitionrecovery.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAP8H3OMTgXJzFu/IPX5wqZixhBeibpo6fnk0V3NYM/XUSPFe6MuNvE8lQsNm g9EaCYG5WTOej7l6cDbxzJs4YjhYQ/.../qu2QE7JHckTWBJf7sy9b0iUa7gWBzvostJ8fcB4E8IFAsYtQ3OA==

http://dl.element5.com/d/5eec647c76342c17/569E7D91/.../Magic_Partition_Recovery.exe

http://www.softonic.com/sads/tracker.php?ev=c&co=PE&sid=9d8631443f8ff812fc244c3cc554c220&upv=4751e54aca370a295135f8545932578b&z=results&sk=0&abp=0&params=F24F8F4D368AFA5D32C8A90D9EFD1CBAE1A16743FECF3EECEB4DC3D7B3E7AEFBE6028E0404818BFEF7BF95DFC92CFBFFBF47440C175186CDDBA80E243584EA09351B45C2D7F2D342856D31F779BC7C1733FF3D8BAF80A41BF0D25B41C93B016EB7EF95FD5E49685F81BD645488BC1ECEBC982619B97B84C39206558E1B5978E735869DDCBDB049464FE91C0E747E049ECB00445736A15DF072ECFA635331C84877F7A606A1538DDD7AA4D98385F84599&h=B080A035DB3D094F3899F55EF86822E400C761FDE0EE0265238777BB496AE070&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://magicpartitionrecovery.en.softonic.com/download

http://en.softonic.com/sads/tracker.php?ev=c&co=CA&sid=df667c463780bfbcfc5384871abedcae&upv=b69ae469580b154f62bf408ab95d925f&z=results&sk=0&abp=0&params=F39B2A32BFC101987B1458170C278E033D6A37BF2E9278FA5F7FE127B894607AF41F407DF3BE46C02851D2B005EA7D1AD6768200742410F956610ADB34A876D5EFBB9DE641C8AF6349AF702E72CB866CFEEE2CFAD67CA522E89B3AB165F08BF4CD1859C7E3CED71717F6E282B762F9977DAFA742C1BB0149FF609325BDBACDB09EC6645B13C6CA909AB2E640E6930811E8245424D07E9C6CBDD231C93294CD7C932AED721F78DD9D6096BCE2B28A0B48&h=BF960B1F2E2D5599D8083A65C5FA7FEFD74A24184C3D933C1DC6B57C99047386&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://de.softonic.com/sads/tracker.php?ev=c&co=CH&sid=bf5678c9caac5722a8a94658c3ef29ba&upv=80ade3b7e6c4681350d2e9948ec55d53&z=results&sk=0&abp=0&params=E58A21D548552342230FD9D405D3DC9D87AE0DAD9E5B8A6D8970800317B0CBC68DDAF93E9A4F74A63A269EFCC4D901AB75B7F72C7FAC1DE71BF6953C3BB72384AACEC3B2053AFF79821F82F6449A612E460D719FB4D08B89B2FC2186FA4A695606EDC51949B702C355D5D5BC91FCC8F2BC4E162166AF9BEC5B5B17C4B8C537983B57DD6602E55F1E896D5C99619DD6760DD21C19B4E9BA4A14BE796C6719F8F7AAC872BD66296E61F852959DE5D9FAB5&h=B7C81239ECA78425321A197B335FD51B6350DDC6ECDB6ADEC7A61D7DC6C9F86D&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

http://fr.softonic.com/sads/tracker.php?ev=c&co=TN&sid=2174ce012ef9ad505e4a662441c11d9a&upv=ce72e2f9d6bafec6c1bfe5c9cbae10c9&z=results&sk=0&abp=0&params=32BFEDE632474BF73FB6571EF67B57F43C4B2CE9CADEC151C6982ED91B896EB70EA1A32B8F98120DD5961245CA13EA21C9DC92173C1BDEB8C873E6EF8CFB874309FC3E50C3B29E67B4513AE46559BEADC22C5714C5A0E90BE60F1ED01CCDE59B2C143A35C05DCC30BF916A162BB100EBF09A4F58A484CC0932E8C3DD9346513A780935A1E4781ED6F0D3F169BAA353BCC23622250A5E93049C022FFE4AAEA560&h=4CE53AD380F2C349721DB61FFD6E394BBD2F28C0D5048DEE020AF087FC922F07&directdownload=1&f=3340815&d=http://www.magicuneraser.com/.../Magic_Partition_Recovery.exe

Scan magic_partition_recovery.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.