» pci_de_smartrecovery.exe
Overview
Analysis
File Details
Programs (1)
Downloads (9)

pci_de_smartrecovery.exe

InstallShield

InstallShield Software Corporation

The program is a setup application that uses the InstallShield Setup installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.

File name:

Publisher:

InstallShield Software Corporation

Product:

InstallShield (R)

Description:

InstallShield (R) Setup Launcher

Version:

7, 01, 100, 1248

MD5:

fab824507c7e1d018b045b7d2cd7400f

SHA-1:

c48d38295792edae7d29fefa3d8921bcc0c66869

SHA-256:

1d9b079e8dc906df90f6c1f5ebe7b1fb96b433cf074721b9aead94364718c40e

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/20/2024 1:04:40 PM UTC (today)

File size:

6.1 MB (6,415,389 bytes)

Product version:

7, 01

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Installer:

InstallShield Setup

Language:

English (United States)

Common path:

C:\users\{user}\downloads\pci_de_smartrecovery.exe

File PE Metadata

Compilation timestamp:

12/2/2002 7:31:43 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

196608:fjh40XbCbMEDypHqsl9l+ftkdQIVQACEbUMatmoIG:fj+0XIMEDyHT/QFEbUMatTIG

Entry address:

0xB1CC

Entry point:

55, 8B, EC, 83, EC, 44, 56, FF, 15, 44, 01, 41, 00, 8B, F0, 85, F6, 75, 08, 6A, FF, FF, 15, 40, 01, 41, 00, 8A, 06, 57, 8B, 3D, 08, 02, 41, 00, 3C, 22, 75, 1B, 56, FF, D7, 8B, F0, 8A, 06, 3C, 22, 74, 04, 84, C0, 75, F1, 80, 3E, 22, 75, 15, 56, FF, D7, 8B, F0, EB, 0E, 3C, 20, 7E, 0A, 56, FF, D7, 8B, F0, 80, 3E, 20, 7F, F6, 8A, 06, 84, C0, 74, 04, 3C, 20, 7E, E1, 83, 65, E8, 00, 8D, 45, BC, 50, FF, 15, 3C, 01, 41, 00, F6, 45, E8, 01, 5F, 74, 06, 0F, B7, 45, EC, EB, 03, 6A, 0A, 58, 50, 56, 6A, 00, 6A, 00, FF... 
[+]

Packer / compiler:

InstallShield Custom

Code size:

57.5 KB (58,880 bytes)

The file pci_de_smartrecovery.exe has been discovered within the following program.

PC Inspector smart recovery by Convar

Publisher's description - “PC Inspector Smart Recovery is a data-recovery program for Flash Card, Smart Media, Sony Memory Stick, IBM Micro Drive, Multimedia Card, and Secure Digital Card. The software will bring back deleted pictures from any digital camera media.”

8% remove it

The file pci_de_smartrecovery.exe has been seen being distributed by the following 9 URLs.

http://gsf-cf.softonic.com/c48/d38/.../file?SD_used=0&channel=WEB&fdh=no&id_file=28974&instance=softonic_de&type=PROGRAM&Expires=1477378906&Signature=AcBqYmXXWy7-sSh98O~rD9WvRwUrzOas7UFeWyIUjB0b1y0KVSyWSiseJiwi4NzxN-2A8XEOKNGtWGyorxJtkxJw0DObOf1C7RdTM4CMk7H4iwL7LhZ~J6WZVgQVYGabGiJS-xxA~g8FOP8EbdHDmbmxEtVazhJEBXICaLmpe6U_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pci_de_smartrecovery.exe

http://global-shared-files-l3.softonic.com/c48/d38/.../file?nvb=20150107115951&nva=20150108000051&token=0deadea21f9fa727f6b85&SD_used=0&channel=WEB&fdh=no&id_file=28974&instance=softonic_de&type=PROGRAM&filename=pci_de_smartrecovery.exe

http://r2.computerbild.de/exec/r2r.pl?m=w-cobi;u=http://d.computerbild.de/downloads/.../smartrecovery.exe

http://www.libe.net/.../pci_de_smartrecovery.exe

http://gsf-cf.softonic.com/c48/d38/.../file?SD_used=0&channel=WEB&fdh=no&id_file=28974&instance=softonic_de&type=PROGRAM&Expires=1450124959&Signature=XibzCxWyyMy2OaeSGJeSxRzKrYv7rrTLtaK22R5gELBomWF5WQWrcf5heIvaRD9XG9TZQhGL5P~4jidQOHa59LPXWg~GlE-sjCgJTQ3wlXjQI~OW5urJi7j2xmqmp6gK4XubmgxjJX7pq4ykmy2CdnGEsBDMlMqgJQvrdEcw-gU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=pci_de_smartrecovery.exe

http://dl.cdn.chip.de/downloads/.../pci_de_smartrecovery45.exe

http://download.pcinspector.de/pci_filerecovery.exe

http://download.pcinspector.de/pci_de_smartrecovery.exe

http://download.pcwelt.de/area_release/files/0A/76/.../pci_de_smartrecovery.exe

Scan pci_de_smartrecovery.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.