home

metrotwitsetup.exe

Pixel Tucker Pty Ltd

Publisher:
Pixel Tucker Pty Ltd  (signed and verified)

Description:
Setup

Version:
11.0.51106.1 built by: Q11REL

MD5:
3bdc69c14b40188fb29e2d2b2e73d3e1

SHA-1:
09448b1ed72988fe418a56d596ebb27da1566c64

SHA-256:
039a2e7eb4fa666535a97835328bf12aff3e49f9de472dbedf5d5312e2b29f02

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 5:57:21 AM UTC  (today)

File size:
484.9 KB (496,584 bytes)

Product version:
11.0.51106.1

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\metrotwitsetup.exe

Digital Signature
Signed by:
Pixel Tucker Pty Ltd

Authority:
COMODO CA Limited

Valid from:
2/13/2012 5:30:00 AM

Valid to:
2/13/2014 5:29:59 AM

Subject:
CN=Pixel Tucker Pty Ltd, O=Pixel Tucker Pty Ltd, STREET=4 Hoad Court, L=Mulgrave, S=Victoria, PostalCode=3170, C=AU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00A646B1CC0E3EB82B15E8785F789CB885

File PE Metadata
Compilation timestamp:
11/6/2012 10:43:51 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:uDYOXGn0LX0AqXLKZ1iNEON53jYgVMr1w3pyiStUoVWQYSk8AWDSbqWoKHhDGnt+:uDJGndAcWfgSrq389s6jlWoKqu

Entry address:
0x2F964

Entry point:
E8, 4D, 65, 00, 00, E9, 7F, FE, FF, FF, E9, CF, 31, 00, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 7E, 32, 00, 00, C7, 06, 84, 64, 40, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 84, 64, 40, 00, E9, 89, 32, 00, 00, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, 9E, 6C, 00, 00, 59, 85, C0, 74, 0F, FF, 75, 08, E8, FF, 6B, 00, 00, 59, 85, C0, 74, E6, C9, C3, 6A, 01, 8D, 45, FC, 50, 8D, 4D, F0, C7, 45, FC, 8C, 64, 40, 00, E8, 12, 32, 00, 00, 68, 6C, 0A, 45, 00, 8D, 45, F0, 50, C7, 45, F0, 84, 64, 40, 00, E8, 1E...
 
[+]

Entropy:
5.9816

Code size:
322 KB (329,728 bytes)

The file metrotwitsetup.exe has been seen being distributed by the following 7 URLs.

http://gsf-cf.softonic.com/094/48b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=97546&instance=softonic_es&type=PROGRAM&Expires=1432618680&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=IgbLm~Vbwh3XrR2s-f0~-r7b0fTUVzCQxJH6MD6VLWfMHtu1uW0SkZTJXlWvbzQkifx5YDhu2ykDh0DiyxWKwcAKx3X7RMxafBNtHUNB3soiX9cetBDOAwjgKEJ-qa~B0C51sEQ0dNSmghqeE4UJDzPNVXx1f4enNxNix4JcL98_&filename=MetroTwitSetup.exe

http://gsf-cf.softonic.com/094/48b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=97546&instance=softonic_en&type=PROGRAM&Expires=1479190871&Signature=dYDR8xKRFrUVbLrlrqGNz5SmqjBVSiYRtctSKLdcGTR8SfcPcwg6q~e2n-agrO3KRDN-MLSXi8Lb6XGTPETdiOse2os-0H31Er8tzwzQsH3iguCx9opE3LYnDULhXd0Zi3t89bwTozfctazgqrOVpqBlba4VyJnyJinYZAirjso_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=MetroTwitSetup.exe

http://filehippo.com/download/file/.../

https://dl.dropboxusercontent.com/s/.../MetroTwitSetup.exe

https://www.dropbox.com/meta_dl/.../AAK3xoJWrqGNR1I7zsdfmaTR9HiWX0T7MF2Cs8kD_-_lYg?dl=1

http://dl.cdn.chip.de/downloads/.../MetroTwitSetup_1.1.0b3075.exe

http://www.metrotwit.com/.../MetroTwitSetup.exe

Scan metrotwitsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.