home

removefakeantivirus.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from download.softpedia.com and multiple other hosts.
MD5:
cd4ad05b8d35029372278825ab46adf1

SHA-1:
eae12babe443479fb839d9eafd86b52ffb5657b3

SHA-256:
cde14c181b63375636d52aa646ef58361032d6363bdde269242cc54664a4e627

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/26/2024 9:05:31 PM UTC  (today)

Scan engine
Detection
Engine version

VIPRE Antivirus
FraudTool.Win32.SpywareRemover2009.b
30112

File size:
234.7 KB (240,351 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\removefakeantivirus.exe

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:qe34bKyHy9jBWsvLA1j2saS8Ewm4nvKc5vnB2tYNwFa:9xBFLAcsaXRNvKcNBKYew

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file removefakeantivirus.exe has been seen being distributed by the following 25 URLs.

http://download.softpedia.com/dl/9019f8ceadcaaadc4ef4b22fcd07d388/57e896a8/100127588/software/.../Remove Fake Antivirus.exe

https://app.box.com/index.php?rm=box_download_shared_file&shared_name=p33obaovi6&file_id=f_346262687

http://download.softpedia.com/dl/f3073cbab91c27bd30d8bad7fdcad6da/58063524/100127588/software/.../Remove Fake Antivirus.exe

http://download.softpedia.com/dl/701fff2789bf1a393798a01da6ecf80e/580e551c/100127588/software/.../Remove Fake Antivirus.exe

http://download.softpedia.com/dl/bab2c01dd371edc43d6fb6f1d512f369/575521ba/100127588/software/.../Remove Fake Antivirus.exe

https://app.box.com/index.php?rm=box_download_shared_file&shared_name=qzy9ylb7mu&file_id=f_323302562

http://storage.programki.pl/RemoveFakeAntivirus.exe

http://download.softpedia.ro/dl/bf556f81fe8713c21a1358a31501c0b0/5761be4a/100127588/software/.../Remove Fake Antivirus.exe

http://external.comss.ru/url.php?url=http://dl2.comss.ru/.../RemoveFakeAntivirus.exe

http://download.softpedia.com/dl/67d76468cc73e8e03efbcfd8acd36e6e/56c48fba/100127588/software/.../Remove Fake Antivirus.exe

http://download.softpedia.com/dl/1fc6fba302b91a15d4ffafe0d2311f05/568b5285/100127588/software/.../Remove Fake Antivirus.exe

http://download.softpedia.com/dl/b14796a0bc26703d604abf0a161d4f80/553942fe/100127588/software/.../Remove Fake Antivirus.exe

http://ftp-stahuj.centrum.cz/dl/cf7221fc0e450391f147d25e9235976e/55679ff4/stahuj/download/software/secured/r/remove-fake-antivirus/.../RemoveFakeAntivirus.exe

http://ftp-stahuj.centrum.cz/dl/f38541a26d3aa2c475bf3d53fbae2ef1/55316546/stahuj/download/software/secured/r/remove-fake-antivirus/.../RemoveFakeAntivirus.exe

http://download.softpedia.com/dl/3bcc58be06c2cbd28b48136f6d4a2b63/54dd77a1/100127588/software/.../Remove Fake Antivirus.exe

http://filepony.de/.../RemoveFake99Antivirus.exe

http://download.heise.de/software/5d79fc59588749c99cc47ffcce3674b0/54ce44e7/.../removefakeantivirus.exe

http://download.softpedia.ro/dl/c033f782dbe435c4a62a92a6778606a5/5484c584/100127588/software/.../Remove Fake Antivirus.exe

http://ftp-stahuj.centrum.cz/dl/7a336b73abc091a15bae3448ec6c8bd5/547ea03f/stahuj/download/software/secured/r/remove-fake-antivirus/.../RemoveFakeAntivirus.exe

http://download.pcwelt.de/area_release/files/86/72/.../RemoveFakeAntivirus1.99.exe

https://cloclo17.datacloudmail.ru/weblink/get/.../Remove Fake Antivirus v1.99.exe

http://ftp-stahuj.centrum.cz/dl/05a6c2a4508273a3602c0d8f84897d0a/53fa6482/stahuj/download/software/secured/r/remove-fake-antivirus/.../RemoveFakeAntivirus.exe

http://ftp-stahuj.centrum.cz/dl/a8314028e050deb0832642a1be3c9f75/53a3d993/stahuj/download/software/secured/r/remove-fake-antivirus/.../RemoveFakeAntivirus.exe

http://dl.cdn.chip.de/downloads/.../RemoveFake99Antivirus.exe

http://olzen.info/RemoveFakeAntivirus.exe

Scan removefakeantivirus.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.