pdfwriter_setup.exe

PDF Writer for Windows 8

Wondersoft

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Wondersoft

Product:
PDF Writer for Windows 8

Version:
1.0.1.2200

MD5:
5bbb4b88d765a6dca056fd35d2119bfe

SHA-1:
8cd3644ad93fa153a149925d509e8c19b6ba6b3e

SHA-256:
9b64897df2f71d7b3ac60da676cb2ea25edcd6d7360bb2fe3967ffa3c43bf8da

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/25/2024 7:30:32 PM UTC  (today)

Scan engine
Detection
Engine version

Rising Antivirus
PE:Trojan.Win32.Generic.12F91309!318313225
23.00.65.14821

File size:
1.3 MB (1,356,599 bytes)

Product version:
1.0.1.2200

Copyright:
Copyright © 2008-2012 Wondersoft

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:5na/dsIj7tdNgnJmKe3rUqy+ZewiMV7mD3VRREza+IZYaZQCyFAaGQJxkTC:5aFHzuyUq4flVrGa6XRAy

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file pdfwriter_setup.exe has been seen being distributed by the following 37 URLs.

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1479043787&Signature=EpNO7uqmK79lZ63sPY6CPn89r9YYRRk0LXMg0AELx1I9~6NuniQUEVn4w0mg5skaa1M-2y4vTelm8Chc2mucZG-AvPaFOKhBI1iXzxfLCLI2bl9CL2gUW1LCVsm91-i1toPBb1VBo0rirfnYmXaRlWsl2mbWksdrYmrmL6ADEug_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1423559919&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Z8WXJx2O~djMZFZDKdDZNIBLaZnXKYeKHPLz6qtZOVS6fKzyujqwxHZ~pw2dNjquxvCR19GY0uNli63pLp2IAR6aZzWPHJnTg5yaFDQLhyjnoH9QBEF9RPrYXUlR3PRxfdtqodLuLc4Auxevd7ci4kJntMcC3FmJ~v4~~1JtG8Q_&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1434338794&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Hjx1ZkeOklNfaelOe7dLsazpwz0Muiv4GmX-7QKP~prAZwC2syucUlCC53RI7qOyB2WAAAACfWYr4Pgd68qKZocUm-tmcyuOEkJNpYdtPtPhzSdps-q96vuDFUb08HmTc~0Ltucc7SzfB5rUVbeDNhPifIC4pUozmE16LnDBUnk_&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1477593473&Signature=MvzsCWV1U-xeSzVe4XpAfZb~6OyWHC83lAyus3q-yiA1wJus3OUQMZ7kC4zeaNShxA2qAr2UwzWWpR8XItIKgSk-ujgUIFmoW~lh3uWWqYbLYryAssVqtfra1D65lfOwNteYxw8K~2DCjnutUHk9l2Xxj8quaezFnMs3Y1YIIAI_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1439143900&Signature=YUwC~3~oFESIcQ2FL19qTc8pc9Kw6UAzygmfOTjQHB6cBJfp0vv0j8spNd8JmSgqVhhnJKqOwWbWqAgzCfmwG5BFlpcLZQ6uxj-SJvH7C-DfCL9gNSEHFfvN0nBcc6ZaOTlek25Cs7ZBJUoPtedjuznFY8L9W4cx96EOtoeMQR8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1480446038&Signature=hNtaKHQUk5X1w0akV29BmbmokBMeCKKbBuBdf8lq1WpNs7t7O2CnzhwB5e0S0F7nFHAb-c4gzSClFCDbT6ljEXh7bkfE-HLdoByKxY1-j4j5ypTZqNkJRY1p-HgkMYnJB5Sb2EfD7XjcSzMOyL8i7qknC8WthmfKR-c-Io~aaw0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1476909728&Signature=N21FFZ5lOKW7lSSM8o4ef39gt0i3zcZIKRkOXGG7u-vnep1WVFPgkyLYiWB-xYeMAiIfrmpuE0Vk-6pOE3JoFKlQlJTdvHFyRfnUu0ixUKIghyq46L6Js58kxLB4e~hpWgIIQaj9b2HKQnWmeFYrGV~Y1FIYmVD51LquzzCb6Fk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1464201328&Signature=Op9XlO3xaeFcxKKxFCI7lehZkCtepOw9x3VYznpmBnA5UulDv-CjncPSjqTmBvAEC4MiiP2KevgT6P0mXlwdeTuvl-6tAHPjiq5a9upWyDJyY9EccdMhcVSRWtNUvMxMDgf6-yCQHIPbhdr-01U9fRbF4EBp6VQx5wV603ZG04Y_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1465535169&Signature=K0pG5dRA3BQSz6TEns8l6HdKDnqucVn6xxRAessFAKD4LlgvF~i9etbP1Tf~0H-l55hspTXpcLBO~tNVr328uaHzjS3X~s4VF5jyPmlgvMknaujl6VK-tHDEL72hNxgJWGy4m~a6azAO6xV4hELpqS5UMiaSIh2a4Nu38lhOLbo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1475294319&Signature=fWC4oxn4rJf-cimA8Ms82VEbZ5wfS53NnmBGrjPhLTKCFffv6qzGoWQHk3CivIoFCpx~InRCBBemYNuO7QZ2r-zKLdjE-k-7CFJ6tnGCjGUVPw-qQIg40r2Toi9fDKGskOyfRKdt1L5erMDKt-Bc55YOYowZp2o7k6mFSNpqRsU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

http://gsf-cf.softonic.com/8cd/364/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3350284&instance=softonic_en&type=PROGRAM&Expires=1478103508&Signature=TLHfbCeFzWfLJYQ4x0g8mlAFKjWE3xtX7SJWOKo~pc7425sDAk99COGHL7jefgcEfaCfOmXJoPW1cFI7V4qCUDkOAqVEppI4LmjTCYX8My5gengTVjjf9QFJtgLQXOKK8SZi1QvU6vzoof-X76THl27Hxio5uiuy5-9fj4BSOKs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PDFWriter_Setup.exe

Latest 30 of 37 download URLs

Scan pdfwriter_setup.exe - Powered by Reason Core Security