home

poolsetup.exe

This is a setup and installation application. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
a491d90baea88be80aab10f8fafd7bda

SHA-1:
db8ba7df3cb1b26ec7506b150b2d3c21ac347afc

SHA-256:
15ce5e6d5c47b70d706cfcfb3e0f733d1378d806775dfd1eae8a2ea2fcb072a7

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/20/2024 3:10:43 AM UTC  (today)

Scan engine
Detection
Engine version

Norman
Suspicious_Gen2.TYNVZ
11.20140522

File size:
2.7 MB (2,868,351 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\spiele\billard\poolsetup.exe

File PE Metadata
Compilation timestamp:
4/23/1998 4:44:26 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.10

CTPH (ssdeep):
49152:yAuLNatFmxBAKfjeyW6ykGNPzkx+ddUk+y6YMSRF50pmLbIuXuJgC+R/C5X:yAuBatvKfyy/vl9YMSRD0IL8wuJsa5X

Entry address:
0x21C5

Entry point:
55, 8B, EC, 81, EC, AC, 03, 00, 00, 53, 56, 57, 6A, 04, FF, 15, 50, 30, 40, 00, FF, 15, 80, 30, 40, 00, 8B, F0, 89, 75, F8, 8A, 06, 3C, 22, 0F, 85, 61, 04, 00, 00, 8A, 46, 01, 46, 89, 75, F8, 33, DB, 3A, C3, 74, 0D, 3C, 22, 74, 09, 8A, 46, 01, 46, 89, 75, F8, EB, EF, 80, 3E, 22, 75, 04, 46, 89, 75, F8, 80, 3E, 20, 75, 09, 46, 80, 3E, 20, 74, FA, 89, 75, F8, 53, FF, 15, 84, 30, 40, 00, 80, 3E, 2F, 89, 45, F4, 75, 15, 8A, 46, 01, 3C, 53, 74, 04, 3C, 73, 75, 0A, C7, 05, D0, 42, 40, 00, 01, 00, 00, 00, 8D, 85...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file poolsetup.exe has been seen being distributed by the following 12 URLs.

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_en&type=PROGRAM&Expires=1474658463&Signature=EZ6JqJwSzReSEdWzrBbxiwYrv~H~W5vBb8yYMhqXJmFK9vf0rRMqnonmtiVy2PX~vKZvwYre6010Rd5pMnvJSsHfrUaCIJZSWWdNcRaLhToiohuRusT6kvMr1rBHSVC47VA3l~2Mz1t26fJ2biLT4pAYe0aBaTDqbRUAhIHDrs8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_en&type=PROGRAM&Expires=1481773591&Signature=AQbtQEvOCdz6Po~QL2BHLch8oNMbi4fbz~K4W115aaekyiiVw0dp84r~g2AkQYnRfpftR93igJGyZj2hHxpoOsn7kjKTY6PHSLCWixJGW6tsAiR5d3987eTD0bLJ0YRpLDCVMCZ~Rm2vvxiDOvaNqPofmOG0e08lDf6yZtqutEU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://www.anarchia.com/link_in_frame.php?link=1170&c=

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_br&type=PROGRAM&Expires=1451986758&Signature=ddq1cCujIO9F5sgB0cyJWtt7Ze0UPXsbkHdQt8o5i8qJUs9onMm4p6M-V7aiFm3j5EZCXCDMZnBLY0BgnJCo48h0lY9qO59UJ-Zb0XZWuwHxcbqtnH3eYpk8EXAQwZtifOu6yuziCKH3bEPrjb-RHu~T5EmZhWA4LtSNr3Peawo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_en&type=PROGRAM&Expires=1480471208&Signature=dj499OwVJn3ZkoUXeWcmrOhpfg3zgUlB7Z-8g0DZitB8qgW9AOQxHgbBgbr7jX-Z9-2WYkDnL-8XwFl487Xv17g8m~xSwtNZl8bwLSZaaWSzhK9S3c1mMnAddtiXPWQ--5skEr5ZsRRIOzZigGUnOm2NhcCxAgPNWSNsPA7UWsk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_br&type=PROGRAM&Expires=1469623121&Signature=Hx4A6jY-hQ6HTZ5HuTh2q1h7bfhmnbIZLKQYsVE0p3DczE~t2XS-umsTIGNyV1U1b5IvagxUfb~YBReGNfIsx61oVg9NUqKopMlsl6BrabKTSQo19nSGV81Lswv5BolQqwnSKGpzjjhwOuWsfarCAVh-AsqK-JzyalYR-TTy-kw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_br&type=PROGRAM&Expires=1454812358&Signature=gJGPVGDCtFdJ7rnX74DECZMx49IzNdeCs7Vg9tApG~EWh4tATIxqyRZNSwky32CXi7M2OGudfWhFD9bBgc2kagEeJQsT43i9MP8GVsd~QfZqIFAeeZ2NQxjhLlglz5UiMgbHX7Cu22YbmPSj~odpEW5mMicKR2zAA1t8cnluBCM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_en&type=PROGRAM&Expires=1464389539&Signature=T9DNAHsjDMbUUs~hVrbbAzePCN0RSG0bJtGJDqkm-iWFmxD5z1HQOg3d~uamjB7UPqKTKCzLpZ-adDIp1lQ67tLBfPDIAl6q6bmdtuOgv8m3Vui7FM5xUhm1~zQiFDVxaHta~s0tN9X2XgQyBdCsJYqPV2VXQ9u60X30D7lkDJs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_en&type=PROGRAM&Expires=1457235373&Signature=NNhX3l8t2eMnodNCS5~j-~USgx~5ElFnP1ZQRxp3~Xh7~mQxYzWEG8WKFEvuvncf86g1VRllmZWTW123P4Ro7v1AlY-0~~88ijFKMHw~eWQdsqvqR-pFFzNHvEycdGtdh580UBoPR4zNJCYT46A17jJjhgR9fTMEQmikzIsb5a8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://gsf-cf.softonic.com/db8/ba7/.../file?SD_used=0&channel=WEB&fdh=no&id_file=27810&instance=softonic_en&type=PROGRAM&Expires=1456516853&Signature=LJdR8rNe7foMZ7~cWZLTlyqx5hYoe~JoYm6RXVqQzE8RJM6Qp1tpSz9xc9-RWGzbMAz-6lIRJ6eVpznogEnexhkcQaRiLbj554b~qJZI6mHrRcTjY2wkeTv2jz3Az2NTBMJbKbISlu1zLxVVv-Sk~oK3Ce6HhGqTeuU0WwWPEAQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=poolsetup.exe

http://dl.cdn.chip.de/downloads/.../poolsetup.exe

http://gratisgames24.de/giggle/spiele/.../poolsetup.exe

Scan poolsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.