home

popsetup.exe

Harzing's Publish or Perish

Tarma Software Research Pty Ltd

This is a self-extracting archive and installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Tarma Software Research Pty Ltd  (signed and verified)

Product:
Harzing's Publish or Perish

Description:
Installer

Version:
2009.2.20.936

MD5:
439b5f2917816f3cf56b06d51ee7b353

SHA-1:
519684f4a606cc14a5f30764c8a57b93d663b858

SHA-256:
573ccaf2a6afc20d3c773fa9b5fb1a4aa49438abf9e23ff168df402e02d67666

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/19/2024 6:00:40 AM UTC  (today)

Scan engine
Detection
Engine version

Zillya! Antivirus
Worm.VBNA.Win32.257139
2.0.0.2565

File size:
397.7 KB (407,200 bytes)

Product version:
2.6.3339

Copyright:
© 1990-2009 Tarma Software Research Pty Ltd

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\popsetup.exe

Digital Signature
Signed by:
Tarma Software Research Pty Ltd

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
8/5/2008 7:00:00 PM

Valid to:
8/6/2009 6:59:59 PM

Subject:
CN=Tarma Software Research Pty Ltd, OU=Development, O=Tarma Software Research Pty Ltd, L=Melbourne, S=Victoria, C=AU

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
394D20C776280ED6D4499D9284827E60

File PE Metadata
Compilation timestamp:
1/25/2009 9:11:27 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:8L0suE0cwsr5ODnAylGrgZUdfVE9ONIQQCgkQx:bc9ryAyA2Uhhz76

Entry address:
0x15D0

Entry point:
55, 8B, EC, 81, EC, C8, 03, 00, 00, 53, 56, 57, FF, 15, 78, 30, 40, 00, 89, 45, FC, C6, 85, CC, FC, FF, FF, 00, FF, 15, 74, 30, 40, 00, A3, 00, 40, 40, 00, 8D, 85, 38, FC, FF, FF, 50, C7, 85, 38, FC, FF, FF, 94, 00, 00, 00, FF, 15, 70, 30, 40, 00, 85, C0, 75, 21, FF, 15, 3C, 30, 40, 00, 50, 68, 6C, 32, 40, 00, E8, 1F, FA, FF, FF, 59, C7, 05, 04, 40, 40, 00, FF, 00, 00, 00, E9, 0E, 02, 00, 00, 8B, 35, 6C, 30, 40, 00, 68, 58, 32, 40, 00, 68, 48, 32, 40, 00, FF, D6, 50, FF, 15, 68, 30, 40, 00, 85, C0, 74, 08...
 
[+]

Entropy:
7.9785

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file popsetup.exe has been seen being distributed by the following 13 URLs.

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1477585479&Signature=fnZG5GKd51w2ClTKWffA41BfJkkQbZFg0TuoBW9qF7nRWpQo3LELmu2VbhQGrhGm4qBDx2uu4GI2AIBiARAtSnaPoPmBVAi1B~kZStdYuW21zXKwah~4TQDM3I7-MAdjrHPQTGkM~8ZzHLgb6ALKzNpJujXe5pL61rcpWbHBtmc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1477906411&Signature=SmF9KiBHmULV7kOn2GEf~sbjSS1grfMWsRqlQ5U6Epucte0JW5c91N2-CQT2gaTbqgK5OeQ9yMjX0l45x1JsVYVw-0t~5Rvqbwd6APNBEvW-1t6KSFpM2~W-4c7Xi8-PpZIjpDfFNx6m5qhSRSoU7PPBS7uvSLAuw2xg7xuXC~o_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_es&type=PROGRAM&Expires=1468658590&Signature=flNX0i-sAYlSQfNEuUKUvh-0-tXiAn-tBZAatHL~RGwfyCE9vtc61j~B~akG5DOp2L4SjJhabwTSRhI20j4SH71fui5ybyCLUeIAEHKWmeWnV~3TRBRHUSQX4KabgTnL2Ywg~78GV9ahftUoYxP2pvwhHfwAS-W4esdXtLdD3TE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1476920073&Signature=HwPBWaNOr3stvvH70xOfl08OG8U2OnfS7MauV6ZJpPbC8Kc6fGJnLspvVEjOv~09~NsUkYWEOaO16DOiN27OeJZPMRbZBhR~f1g9r~tmqf33cqSNfUfP6CQeLCNbg--huPcsyaIkMqKTxJ3FWocw03YNgxkANnbiq7tUescrx94_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_es&type=PROGRAM&Expires=1476874368&Signature=CBAXBreLH-3DGq~4NhNxKEuLf643M0X5LqIw~hZQyfvMhuISnsryYmC6~48qCXQLz8qnM8UUKFvCmEyYOmuweAU3-FkvgJGE8oXSdW2dvVkmZk4L-J3WD1RhGojHzOvRXTQOGbXcl9f-0b89rcBjCrjWrz92TGKYfmgx~R88G8g_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1464238983&Signature=Tl6iCqphYizr1ZX5DOMlFRrEETMv9nCWajuRm9aXQiH7wWJwOMLaMS9Kee7aMAIp9JeZqRlbCk8VoBWMc9K-4tqIZrbkTrMPVk03LDd5Mv7C7pN4gUgznCN~HXYnHxUzPLbHhQ5~B3QAuh4mPWfhsLPF881TasuGVrDK96qxfgY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_es&type=PROGRAM&Expires=1471753388&Signature=GZvb1ek9IPElmlXeWybCvJNYt5Dbq4YtsjXmLyE30CPSfUcHniGktupBV7cJG2hKHjRbUmsNnaWccaEpj0BO~QjAnkdEQ-m1C0OiTVb9vkj4DCYtFxKyK2CC2h2h4ZnkRJS8bfH3BQAC1FbxMsLeb7IyvVCC5YpsoasqZ3v7ZPE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_es&type=PROGRAM&Expires=1463583257&Signature=QYDxZ3CAkem-b62dsjFICNfgPRENC-PuA-uPrhAh-D0n~qRamvLAXxRzTyf5n6J~71Lc0Vm77i2q4aofuFnoPrhL~PAmXbVdvXtVVQInR0bN-IZTt9Rt1bYgn4~5mV020HWa56Oy-dFh-3lzYLVn0bGVgB5StFBLfEPftBvlRog_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1454968967&Signature=hDlIZdPkpvDhtOI66H-Y~jdEXHapEN27xPDeEztiJZQKl-p6dJC42THuUY0-vLbd2R~stzgg6QGiWwNTiYvRVpJyL7jxOtT6bLLCBBkH27ldafFqDHGo3DcfVzvDTa7KcAcejjd1zyMifKC8Qx~UpzDGPgWGNiI-z6188nqeI~w_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1449260789&Signature=WWdRutInba78cSrMJCB8k7U36GPG-fCTfS9lOdyL29zk-~rhvhjkf2~6V7dNP3nlcJmg3OGrL~~45~0rzA0kR~5VcDXIdMSrcKHm8dvHDJzcmXrmcr~TygT6TJWT7HR3GGjHmJJWT68x8z3cam3jRHvB-Q-sNe1nlk-eF4~UiL0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1445018340&Signature=UJlLyPnr8438YEa7zZJ-ZhuS2hmKJVrwYThHQAPW7JwCYDm47Bh4wwnad6s8BSPUh1Y~UsSazFgHAgLvaKh2EzRUq5JaOQ9--QJJc0q-Fb1Lf~6TR7QzOI2GS1Kgr6OrMDqvAnDu~OZuVNNSKHwpfaK8bDT9I6v6Wl78bYt3f40_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_en&type=PROGRAM&Expires=1449466651&Signature=gZDxQtLahCD8e3VVQc5nIMaDHlss-QAwqaQ66iB3djYHNDwPXS8MsiOyOumjBVKGqppXV9W-~f2UXQwSh1q1yI6cn~upFLC8JYqz4zBFuaVxDsJac0TZY8Y-yXMQ557mwgpV9EGAg1a7HIvCyBPBo-snv9Z2vECHx-M6-vHf~io_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

http://gsf-cf.softonic.com/519/684/.../file?SD_used=0&channel=WEB&fdh=no&id_file=79313&instance=softonic_es&type=PROGRAM&Expires=1449767847&Signature=QQ2zefvGTyhH8ke2uR5mKRIJbtkw8OKiegpcXiNgfq75INfIJz~Ol8Avs~PXnHeZnB6ZemdH6GTJt-uCMRMPoD8Ll1odHs9xH6NBAPIfDiFmM1qgow~vQEziITfWOBMM8qLESa0tgHAVckJoYiBA1NNywIK75t~GDGotIvvxn9c_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=PoPSetup.exe

Scan popsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.