home

photofiltre installer.exe

OCSClient

www.download-sponsor.de

The application photofiltre installer.exe has been detected as a potentially unwanted program by 4 anti-malware scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.foto-freeware.de.downloads.c404.eu.
Publisher:
www.download-sponsor.de

Product:
OCSClient

Version:
1.00

MD5:
630505e7e91ef7a487f3859c188aae7e

SHA-1:
7c3185ed102868666c60847f20114c5ccb36b708

SHA-256:
f5c0032a0bf6a601dd3515693a4228a0275985dfbed57640ca44848f4c22e891

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 6:05:19 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.2424
9.0.1.0122

SUPERAntiSpyware
Adware.DownloadSponsor/Variant
10630

Vba32 AntiVirus
Downware.VB.AndreClient
3.12.26.0

VIPRE Antivirus
DownloadSponsor
28778

File size:
496 KB (507,904 bytes)

Product version:
1.00

Copyright:
Copyright @ www.download-sponsor.de

Original file name:
ocsclient.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\photofiltre installer.exe

File PE Metadata
Compilation timestamp:
5/13/2011 1:50:48 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:cKQGtCYcMIfX5DOD4K16rf0PL56cSyf4/rdD2PDl88888888bYR3Nwf9ysVufBnc:cbUSBO9P96cStQdOOysgfBnnl2

Entry address:
0x1434

Entry point:
68, 40, 48, 40, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, C8, E9, F3, 47, 47, 84, E0, 46, 89, EC, 14, BF, 51, 45, D5, 96, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 4F, 43, 53, 43, 6C, 69, 65, 6E, 74, 00, 6E, 64, 72, 65, 5C, 44, 00, 00, 00, 00, FF, CC, 31, 00, 01, 17, 82, D3, 21, 79, BF, 8C, 4B, BF, BE, 97, 9A, 36, C0, 46, 9B, 68, F6, 1D, A1, E7, E0, 4C, 41, AC, 76, 95, F2, E5, 55, B4, 36, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
32 KB (32,768 bytes)

The file photofiltre installer.exe has been seen being distributed by the following URL.

http://www.foto-freeware.de.downloads.c404.eu:14089/?pid=fotofreeware&cid=116

Remove photofiltre installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.