home

setup-sopcast-3.9.2-2014-7-10.exe

The application setup-sopcast-3.9.2-2014-7-10.exe has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. This version of the installer will bundle the Ask.com Toolbar, a potentially unwanted web browser extension. The file has been seen being downloaded from api2.tenlua.vn and multiple other hosts.
MD5:
e63daa1bb9890c20d312de4f2f47b0de

SHA-1:
3770bd7ead9f4012dd2440bf48700f609a39baae

SHA-256:
265207f8b7444881ba93f1c11b8c74e9da356f274ac2c7a3c2c8aaf488b2baf3

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Bundles that Ask.com toolbar as a third-party offer, a web browser extension that may modify a user's search and home pages.

Analysis date:
4/30/2024 4:28:59 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Toolbar.282
9.0.1.068

ESET NOD32
Win32/Bundled.Toolbar.Ask.G potentially unsafe (variant)
9.11259

File size:
6.4 MB (6,660,694 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup-sopcast-3.9.2-2014-7-10.exe

File PE Metadata
Compilation timestamp:
7/6/2011 6:31:19 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:GLshAxlPK5FC2zJXi9tMV4TTkoEm9hWLxQgA36VN6Ov4f2h5d/zUWYgf1v5P213P:GIv5FZFX62VFcMy6P6WhhfdBP2h+PMJ

Entry address:
0x33E9

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 70, 85, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, 78, 06, 47, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, 90, 05, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 6C, 85, 40, 00, FF, 15, 80, 81, 40, 00, 68, 54, 85, 40, 00, 68, 80, 85, 46, 00, E8, 35, 26, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, 10, 4C, 00, 57, E8, 23, 26, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

The file setup-sopcast-3.9.2-2014-7-10.exe has been seen being distributed by the following 6 URLs.

http://api2.tenlua.vn/filemanager/builddownload/.../?hash=0c39ee71bc5f2c581567733d6ba17e822127fe92a219fc5dfa3b8d3c98414f1c622079f8e76d2fb11522fef117731b514a2815ceade24f2e6b5ec24bef9fd889da9af99f8e5eddfaf6263607e3128665c4128525ab511960821a30ca1f7f3cffff30bc211f085c9f90ffed795a2cc1769961ae06454a1360534c7483ddece83cf9d55e623b60f2d2366fc12880c729e7ab551284a4&url=0b3da36fa30172185e33336174fd75853636b390ad53eb4dee2a8862c5410f&down=0b3da36fa30172185e33336174fd75853636b390ad53fc56f8369064ca4249102d25&jump_type=download

http://download002.fshare.vn/dl/.../SinhvienIT.Net-Setup-SopCast-3.9.2.exe

http://file.sinhvien.it/download/ad690db7/ab9b6abee1ea58be523876d6336336c2/2014/.../SinhVienIT.Net--Setup-SopCast-3.9.2.exe

http://www.ex.ua/.../115281508

http://www.vivatv.ro/SopCast.exe

http://files.getpedia.net/Data/2014/08/.../Setup-SopCast-3.9.2-2014-7-10.exe

Remove setup-sopcast-3.9.2-2014-7-10.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.