sketchupprowen.exe

SketchUp Pro Installer

Trimble Navigation

This is a setup and installation application. The file has been seen being downloaded from download1805.mediafire.com and multiple other hosts.
Publisher:
Trimble Navigation Limited  (signed by Trimble Navigation)

Product:
SketchUp Pro Installer

Description:
SketchUp Pro Installer, Version 8.0

Version:
8.0.0

MD5:
80bd18020afaaa40ba0aee984baa4b5f

SHA-1:
6d1f98fd97275879522cea8dc364d3ab9591a087

SHA-256:
daac1a7068fd153b411fc7acc3e130474708c423d84af2da0aedc31265e3c715

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
6/23/2018 7:24:40 AM UTC  (today)

Scan engine
Detection
Engine version

Antiy Labs AVL
Trojan[:HEUR]/Win32.AGeneric
0.1.0.1

File size:
49.5 MB (51,902,136 bytes)

Product version:
8.0.0

Copyright:
Copyright © 2012 Trimble Navigation Limited

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\sketchupprowen.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
1/5/2010 1:00:00 AM

Valid to:
1/9/2013 12:59:59 AM

Subject:
CN=Trimble Navigation, OU=E&C, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Trimble Navigation, L=Westminster, S=Colorado, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
714102801606BD29072FBE39414739E1

File PE Metadata
Compilation timestamp:
5/13/2010 1:38:41 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
786432:1y9/2T238Sy5hw2wbIi4wwOHBjzX+vl7pPO0BK8BDuYA7m/ivLkR9nT1eU3+8Dpk:1yITaynkIz6BjzXkPO0fiwxTfrDTyKY

Entry address:
0x14A9B

Entry point:
E8, 71, 39, 00, 00, E9, 16, FE, FF, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 58, 42, 42, 00, 89, 0D, 54, 42, 42, 00, 89, 15, 50, 42, 42, 00, 89, 1D, 4C, 42, 42, 00, 89, 35, 48, 42, 42, 00, 89, 3D, 44, 42, 42, 00, 66, 8C, 15, 70, 42, 42, 00, 66, 8C, 0D, 64, 42, 42, 00, 66, 8C, 1D, 40, 42, 42, 00, 66, 8C, 05, 3C, 42, 42, 00, 66, 8C, 25, 38, 42, 42, 00, 66, 8C, 2D, 34, 42, 42, 00, 9C, 8F, 05, 68, 42, 42, 00, 8B, 45, 00, A3, 5C, 42, 42, 00, 8B, 45, 04, A3, 60, 42, 42, 00, 8D, 45, 08, A3, 6C, 42, 42, 00, 8B...
 
[+]

Code size:
110 KB (112,640 bytes)

The file sketchupprowen.exe has been seen being distributed by the following 37 URLs.

http://download1805.mediafire.com/6kpm5ghy9bag/.../sketchup 8 pro.exe

http://download703.mediafire.com/tygyuw3hl81g/.../sketchup 8 pro.exe

http://download1616.mediafire.com/ski1r9w72sng/.../sketchup 8 pro.exe

http://download2213.mediafire.com/v99b95ttqtag/.../sketchup 8 pro.exe

https://docs.google.com/uc?export=download&confirm=r7OF&id=0B5AXHcdxLXdTdzBUNEVOXzJkaFE

http://download1409.mediafire.com/lhom55p9ocdg/.../sketchup 8 pro.exe

http://download2213.mediafire.com/imo5k134zehg/.../sketchup 8 pro.exe

http://download2030.mediafire.com/4945v1gaicog/.../sketchup 8 pro.exe

temp:sketchupprowen.exe

http://download1699.mediafire.com/r5ggd6hlcsmg/.../sketchup 8 pro.exe

http://download890.mediafire.com/71igp786hvjg/.../sketchup 8 pro.exe

http://download2102.mediafire.com/qjv52e5defyg/.../sketchup 8 pro.exe

http://download18.mediafire.com/mepzq445s18g/.../sketchup 8 pro.exe

http://download2030.mediafire.com/0k2aesfp4b6g/.../sketchup 8 pro.exe

http://download880.mediafire.com/vuy0lowxn0qg/.../sketchup 8 pro.exe

http://download2101.mediafire.com/d787u02b9o6g/.../sketchup 8 pro.exe

http://download2030.mediafire.com/3fa3xbmcd6mg/.../sketchup 8 pro.exe

http://download775.mediafire.com/lukhtd37b5qg/.../sketchup 8 pro.exe

http://download2102.mediafire.com/8i6a322uz1ag/.../sketchup 8 pro.exe

http://download1705.mediafire.com/xslvai2528qg/.../sketchup 8 pro.exe

http://download1214.mediafire.com/78ghujynxwcg/.../sketchup 8 pro.exe

ftp://10.61.201.222/Software/.../sketchup 8 pro.exe

Latest 30 of 37 download URLs

Scan sketchupprowen.exe - Powered by Reason Core Security