home

scanto01tb_softonic.exe

This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
48f0b38a22ca7bb11a2e2e05555dad33

SHA-1:
d386c526fc86091eca01d32875313365aeff273b

SHA-256:
56e7af504a529bf15f24e224cb44bee6da9810a5c44f8f91d48e303f298a7538

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 8:12:45 AM UTC  (today)

File size:
37.3 MB (39,100,347 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
1/22/2004 2:36:06 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
786432:Uf93K6JPJrQWNWuOVr3fj+B/KqDCWx0+p20WLcxQPBbh6cIFLduI:Uf9pJGWNWuOxb+B/DeWa++cWPBPIFv

Entry address:
0x20A70

Entry point:
60, BE, 00, 60, 41, 00, 8D, BE, 00, B0, FE, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75...
 
[+]

Packer / compiler:
UPX 2.90LZMA]

Code size:
44 KB (45,056 bytes)

Scheduled Task
Task name:
{8B32F7B9-42E7-44CD-8771-8B829D862BA9}

Trigger:
Registration (Runs on registration)


The file scanto01tb_softonic.exe has been seen being distributed by the following 6 URLs.

http://gsf-cf.softonic.com/d38/6c5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=46162&instance=softonic_en&type=PROGRAM&Expires=1477788769&Signature=YXUBzIvKggGJRI-~PjVbQUB180TymbJ4VZfvs7uupYR0VBtJcamc4B--34cy-gy0Q9vX4qb5u~EwIC-79aYsSLnCOn3h~y2vOn9GrK0XEbTONJSHB~uIRx923XvrlbuqD46Zr0uFHJxv9-g0AVqD2i4vMOb5WMePPwUXh9uu9Wk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Scanto01TB_Softonic.exe

https://abbyy-scanto-office.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAOGMtfd GVMLvQsHqQHA2XCZXoJmcm4DvJOIFcT5yn6SQOefcf/.../7XbplOTH9M=

http://gsf-cf.softonic.com/d38/6c5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=46162&instance=softonic_en&type=PROGRAM&Expires=1474070758&Signature=f1sZVyq-HzVmsziFOOBOOw6gnjeoUXJTGajpwsXH5mYD1QLnH1ta0UWNP-qGBW3nbNCRGM1iQzzLjOlf211iuYY1ynD~742416XBPVPZSIU7KUr0ZdppzXrbgvEXR8g5Rc4Ha75kwgSMaLj2nhYnXJQj41L4fhnAmkGwG8Y~u~Q_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Scanto01TB_Softonic.exe

http://gsf-cf.softonic.com/d38/6c5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=46162&instance=softonic_en&type=PROGRAM&Expires=1437446189&Signature=dah3JbBKiVKoA-Di~VIwbM0jexXyqPFOJ7WHreywnzv7-E1fvg8xSwAR0eV57mS3DrQVfbkceJv~iv~40RGvXSmJqMJjq4WMV9IMviee9XWUcq6yYqaw872wHoqyg-ebevDy29FxOasj1lcbDXhOzzPsw8vp6bMDDqYljLV3ly8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Scanto01TB_Softonic.exe

http://gsf-cf.softonic.com/d38/6c5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=46162&instance=softonic_en&type=PROGRAM&Expires=1452313054&Signature=ha3rKIXvD2cg4gU5n1JgJe6S39-RcGzKqXM7FkJNTgZ23i9abZlThsMsj~OwoBraCjvP48q570KP--SdfdZEop~9rE1nTvQPaJhTcwQurfAekcBn2X3Sc5QvW0zWu6A1XO1GiJSm~3ldtEs9s4Wep9J9WZMXVR4W2yeTkkdH-w0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Scanto01TB_Softonic.exe

http://abbyy-scanto-office.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAOGMtfd GVMLvQsHqQHA2XCZXoJmcm4DvJOIFcT5yn6SQOefcf/.../7XbplOTH9M=

Scan scanto01tb_softonic.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.