home

setup.exe

Internet Cyclone

Jordysoft

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Jordysoft

Product:
Internet Cyclone

Description:
Internet Cyclone Setup

Version:
2.2.0.0

MD5:
7cae7072b1c19d8c9846068658fa7742

SHA-1:
977adfb435ae0885a7d87c8e8d3a02156c1816db

SHA-256:
eaf9f4c8195f1666ebc1d02a578b905798bc3cf79a4b26729b1cda9845ed1657

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/19/2024 6:23:17 PM UTC  (today)

File size:
961.5 KB (984,567 bytes)

Product version:
2.2.0.0

Copyright:
Copyright © 2014 Jordysoft.

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 2:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:CQiGdegAV+IpdBszRhd3wr+9fOmRUPg3KUElWorbcaQfm8i0Rl7q3C8pJth:CQisFI3Oz3dA6RP3KUyxoaB+l7uh

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9798

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 5 URLs.

http://gsf-cf.softonic.com/977/adf/.../file?SD_used=0&channel=WEB&fdh=no&id_file=51558&instance=softonic_br&type=PROGRAM&Expires=1441389070&Signature=DxKUR~gunPwhZOgyC6Fvhl2VJEoqDU-1W~pkSxz-9tQ15srCbrD7W9Sn521qyistsVGE6jiUAdnaKGVseqiVvpcfYs3TVaBt87MMn~EcuRyXZvp6btxbCWs-Z1n91SG2knPGDxCHMQKJlLiO5nePUpxwNh6WKRpG~ZlP0TpqU4w_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icyclone.exe

http://gsf-cf.softonic.com/977/adf/.../file?SD_used=0&channel=WEB&fdh=no&id_file=51558&instance=softonic_en&type=PROGRAM&Expires=1449366421&Signature=STKRBRUZEWLGq6ujiUyPBWmK~uS0mEw351L-nLlB7ODVavdt8DoJxHj1Xp4Vdx7s1Jj7eWDOayAZWbZGxuk2n0EunHpDltjz2bYW8625EyMdP5bBTKifxJKMWKHtGmgOBip2Ju7iZ1f1Tdg5cCd~lB2ckB84LZLGkYlB5Mx8o1E_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icyclone.exe

http://gsf-cf.softonic.com/977/adf/.../file?SD_used=0&channel=WEB&fdh=no&id_file=51558&instance=softonic_br&type=PROGRAM&Expires=1447896315&Signature=eBM8GvluSTaquKeuw1HZOjerhSfdoie2izsLpAfOdKVQC1Q7IV4ghizy8KTrs0qtXBbD2M2REAZSDYVPjoXu41GqGniuw-ITJ7KtH46hvXt64Mo0vqwa7xX1bMiw1JJH0Jb68ZIKfDNFSoR9dvhCnGzPSMdPwovsU6g6BgzjwtU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icyclone.exe

http://downloads.jordysoft.net/.../icyclone.exe

http://www.jordysoft.net/DownSoft.aspx?Id=1&L=2

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.