home

qtraxsetup.exe

Qtrax

Qtrax Inc

The application qtraxsetup.exe, “Qtrax Description Text” by Qtrax Inc has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Qtrax Inc  (signed and verified)

Product:
Qtrax

Description:
Qtrax Description Text

Version:
20.13.06.24

MD5:
849568afddc9aab10b54086f7d4fe9d9

SHA-1:
16fd30119de3a9978a14a6a86a9c709f3ae2e403

SHA-256:
52571882b967af9b4011f8351ca301a22a4923d46b048e028a2a24654b090048

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 4:21:02 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
DLOADER.Trojan
9.0.1.0354

McAfee
Artemis!849568AFDDC9
5600.7261

Reason Heuristics
PUP.Optional.Installer.Qtrax.K
14.3.2.15

Trend Micro House Call
TROJ_GE.4CA041CE
7.2.354

File size:
10.3 MB (10,810,136 bytes)

Copyright:
Author © 2013

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\qtraxsetup.exe

Digital Signature
Signed by:
Qtrax Inc

Authority:
GoDaddy.com, Inc.

Valid from:
7/31/2012 4:51:42 PM

Valid to:
5/14/2014 7:39:01 PM

Subject:
CN=Qtrax Inc, O=Qtrax Inc, L=New York, S=NY, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2B85B70415878A

File PE Metadata
Compilation timestamp:
5/20/2013 12:52:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:JmUdKAdggb5AhtngeJBRNwuAd/1+cyfoZFJLEfUs4ksUTRqHTusM:HdKADa8e3TAVx/AfUs4x7

Entry address:
0x3250

Entry point:
81, EC, 84, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 1C, C7, 44, 24, 10, 30, 91, 40, 00, 89, 5C, 24, 18, C6, 44, 24, 14, 20, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 8C, 72, 40, 00, 6A, 08, A3, D8, 27, 7A, 00, E8, 86, 2D, 00, 00, A3, 24, 27, 7A, 00, 53, 8D, 44, 24, 38, 68, 60, 01, 00, 00, 50, 53, 68, E0, DC, 79, 00, FF, 15, 64, 71, 40, 00, 68, E4, 91, 40, 00, 68, 20, 1F, 7A, 00, E8, 30, 2A, 00, 00, FF, 15, B0, 70, 40, 00, BD, 00, 80, 7A, 00, 50, 55, E8, 1E, 2A...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file qtraxsetup.exe has been seen being distributed by the following 9 URLs.

http://gsf-cf.softonic.com/16f/d30/.../file?SD_used=0&channel=WEB&fdh=no&id_file=72008&instance=softonic_en&type=PROGRAM&Expires=1483602876&Signature=Jw6B5WxQ-36cNtmxAxJosQBP9yqJwOLBZl4YywFhgF6TMbdlMemP5UN6g2iMKh-Eu67GoMpN3TtcAf-q08HbDfcSPvSvXBwxoYPm5ynmq~lwFQhSvRKnZKaGUR8VZTM-M7DfzAaJb7DOzpeQCetExMgyZPP1KZ4vL7E~WKarYBE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=QtraxSetup.exe

http://gsf-cf.softonic.com/16f/d30/.../file?SD_used=0&channel=WEB&fdh=no&id_file=72008&instance=softonic_en&type=PROGRAM&Expires=1476180061&Signature=e0er~vb9ukpUhMozEhB~v9I9AOhh5F0TdXCMFGpEnEnzCzZcsgcvExFsRDRPN9d6v3tXKRFqm-rN3CCtogNQWx~XcI0ct4OI4NVueFszv6yxVwe7hFBLJeIWZer47I2hfjg7eAXNIrJWUWhNkVhln3V1EUtlxp0m1JgYuRcL97g_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=QtraxSetup.exe

http://gsf-cf.softonic.com/16f/d30/.../file?SD_used=0&channel=WEB&fdh=no&id_file=72008&instance=softonic_en&type=PROGRAM&Expires=1478344512&Signature=hpD-mHSFybUNt~8EIZ-J2bIQwsUS3w6K8J9XiRZ9mZYGa2PeFV65FjAWqgbifh6GDXR3-cX68edgN~FKtIH2PCyJCH6UOvpUMjzNvxJK58TivLluSlxknWBqgj9aBFJEsxuW91VqRFnNYcVcRRlUDstp~LW9hwmMTkGhnHbg4Xk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=QtraxSetup.exe

temp:QtraxSetup.exe

http://gsf-cf.softonic.com/16f/d30/.../file?SD_used=0&channel=WEB&fdh=no&id_file=72008&instance=softonic_en&type=PROGRAM&Expires=1472955733&Signature=SYYNELJrTWsFcKJUR9S3PJlANn4vaLgeGW5oE547NJNff2T4P6JLlxV4piMeK2D9JnELgNlea~As~q5ciYFnyusbTt7aT1Te9k7m7JLm0c5ljecMDs9~QHJfMCj~wdkdfEcm9iUE~XHivryC5fkU31p8CKr3vluT43GqJmPj1EQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=QtraxSetup.exe

http://gsf-cf.softonic.com/16f/d30/.../file?SD_used=0&channel=WEB&fdh=no&id_file=72008&instance=softonic_en&type=PROGRAM&Expires=1462454409&Signature=czc7DqkbN3YV3EmNM~qJJ3YPnNbWhzuleuuXjT56XIvSPavF34~oOcpJJzovXWHKnpxvps5fSTP7wdWTagFkxF8EOpMIuOMJoPMze~267tR9jTzJtcpJ7oSuOJcLKWsWI2yldgqS4H9lAM3BSUEAK3CrtMRENlQBqosCP1rvDjg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=QtraxSetup.exe

http://gsf-cf.softonic.com/16f/d30/.../file?SD_used=0&channel=WEB&fdh=no&id_file=72008&instance=softonic_en&type=PROGRAM&Expires=1440695784&Signature=EnxDdrwLW22DFjY0gQ~zU9gNumh8isdJztBqKBSMqNTnaSvG9PDSrVExXh~2cbeFYPEUq8XzTwJN8m~JPA5SN86jaGZq33uL244qNfz2CrFc~N3Dk8qzogBS1mbBDIqJ85vbSfFJhIdx3S3fDnbI9p-E603pUWN9cFl~RuPJxHM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=QtraxSetup.exe

http://gsf-cf.softonic.com/16f/d30/.../file?SD_used=0&channel=WEB&fdh=no&id_file=72008&instance=softonic_en&type=PROGRAM&Expires=1448458759&Signature=Xhqf~TI~HBin1XP75sHsqpLkCdSW9LJ8hwemVr3EZ9p9bQsZpUnq2F3rk4n5uHxsxCc5rBhYjOJiiPcOdbmMl-MVkeVknjc8pE~eyhIjFaEWcPA7yzldQA69Y66hs1w~YF01YIUTldFheaIgiApAyQ1G8jtydGimSHdr~-ppwz0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=QtraxSetup.exe

http://content.qtrax.com/.../QtraxSetup.exe

Remove qtraxsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.