home

PDFCreator-1_4_0_setup.exe

PDFCreator

Chinery & Heindoerfer GbR

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from sd-cf.softonic.com and multiple other hosts.
Publisher:
pdfforge GbR  (signed by Chinery & Heindoerfer GbR)

Product:
PDFCreator

Description:
PDFCreator is the easy way of creating PDFs.

Version:
1.4.0

MD5:
6b3fbdca0bb1461ae908bda2b78133b5

SHA-1:
0719a92d1474fe02518badd58af02fc0078e1d7f

SHA-256:
2227c87a3d85df060b11bbb0b25ca827001613ff474cedba05d8e52456785eff

Scanner detections:
4 / 68

Status:
Inconclusive  (probably just false positive detections)

Analysis date:
4/26/2024 3:15:27 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/OpenCandy
8.9310

Reason Heuristics
PUP.OpenCandy.Installer (L)
16.11.29.7

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.14130

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.24.3

File size:
17.8 MB (18,675,024 bytes)

Product version:
1.4.0

Copyright:
© pdfforge.org

Original file name:
PDFCreator-1_4_0_setup.exe

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\pdfcreator-1_4_0_setup.exe

Digital Signature
Signed by:
Chinery & Heindoerfer GbR

Authority:
Thawte, Inc.

Valid from:
5/30/2012 8:00:00 AM

Valid to:
5/31/2013 7:59:59 AM

Subject:
CN=Chinery & Heindoerfer GbR, O=Chinery & Heindoerfer GbR, L=Hamburg, S=Hamburg, C=DE

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
65596CEC842F63B39F082AFBD5D9EAE1

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:EiKVuVuudCf4J3JaXowLAouCEj1q9fQHdMl:EgBdHJaXUN1Kl

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Entropy:
7.9807

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file PDFCreator-1_4_0_setup.exe has been seen being distributed by the following 10 URLs.

http://sd-cf.softonic.com/31000/31176/.../PDFCreator-1_4_0_setup.exe

http://filehippo.com/es/download/file/.../

http://green.download.pdfforge.org/pdfcreator/.../PDFCreator-1_4_0_setup.exe

http://softandpc.com/.../pdfcreator.exe

https://docviewer.yandex.ru/source?id=anyaq-6ot00e61oq47xjp4at00inbzxuz28r3ktctgmpccdrz6rtlqhx5m73shz5a06v6va7xjmzq3kkvcnbmsv7bsyiodp1qcocndfb&archive-path=//PDFCreator-1_4.exe&ts=150f5bcbe84&token=CKQNeYIvHVKJiIooCboX0w==&name=PDFCreator_Rus.zip

https://www.comeralia.com/.../PDFCreator.exe

http://www.oldapps.com/pdfcreator.php?app=6B3FBDCA0BB1461AE908BDA2B78133B5

http://garr.dl.sourceforge.net/project/pdfcreator/PDFCreator/.../PDFCreator-1_4_0_setup.exe

http://yellow.download.pdfforge.org/pdfcreator/.../PDFCreator-1_4_0_setup.exe

http://blue.download.pdfforge.org/pdfcreator/.../PDFCreator-1_4_0_setup.exe

Scan PDFCreator-1_4_0_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.