home

solarwindstftpserver.exe

SolarWinds.Net

The program is a setup application that uses the Wise Installer installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
SolarWinds.Net  (signed and verified)

Description:
SolarWinds TFTP Server

Version:
November 2004

MD5:
f94f07030263e6adf303c0a625a142f1

SHA-1:
95d7b31baa12b67bd16fa6c968fadf88373dc2bb

SHA-256:
feac43e7df20d19d9bcb959705ebf77ba20ddbe5040d5aedd3c45127b3fa57ef

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/21/2024 12:43:56 AM UTC  (today)

File size:
6.1 MB (6,402,808 bytes)

Copyright:
Copyright © 1995-2004 SolarWinds.Net

File type:
Executable application (Win32 EXE)

Installer:
Wise Installer

Language:
English (United States)

Digital Signature
Signed by:
SolarWinds.Net

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
10/20/2004 9:24:24 AM

Valid to:
10/20/2006 9:24:24 AM

Subject:
L=Tulsa, S=Oklahoma, C=US, OU=Development, O=SolarWinds.Net, CN=SolarWinds.Net

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
208A7E

File PE Metadata
Compilation timestamp:
4/8/1999 4:24:47 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:x3xU7qyy0sXFvdirfbcKu7GGwVQ/stCwjxm4fXEf9hH5IXFvdiFIe6GjC:2qyJyubcFGGwpxjgwE8cIej2

Entry address:
0x1000

Entry point:
55, 8B, EC, 81, EC, 78, 05, 00, 00, 53, 56, BE, 04, 01, 00, 00, 57, 8D, 85, 94, FD, FF, FF, 56, 33, DB, 50, 53, FF, 15, 34, 20, 40, 00, 8D, 85, 94, FD, FF, FF, 56, 50, 8D, 85, 94, FD, FF, FF, 50, FF, 15, 30, 20, 40, 00, 8B, 3D, 2C, 20, 40, 00, 53, 53, 6A, 03, 53, 6A, 01, 8D, 85, 94, FD, FF, FF, 68, 00, 00, 00, 80, 50, FF, D7, 83, F8, FF, 89, 45, FC, 0F, 84, 7B, 01, 00, 00, 8D, 85, 90, FC, FF, FF, 50, 56, FF, 15, 28, 20, 40, 00, 8D, 85, 98, FE, FF, FF, 50, 53, 8D, 85, 90, FC, FF, FF, 68, 10, 30, 40, 00, 50...
 
[+]

Entropy:
7.9989

Packer / compiler:
Wise Installer Stub

Code size:
512 Bytes (512 bytes)

The file solarwindstftpserver.exe has been seen being distributed by the following 8 URLs.

http://gsf-cf.softonic.com/95d/7b3/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64624&instance=softonic_en&type=PROGRAM&Expires=1469764780&Signature=NrX6QexZdjYuRuUWEQQGZHzVRBKFArgt0AQ5ayaRCKFnb3ST2TrhK61rf0SC936JYoQjkHOTffDKwurIraeLaPvQPfVq-MNfUh-5P5alXEQgaEI57Qt4nxD4IRcz0gOPJPxVdN-ZsUMVhiZe43ZgW4NlghJXcDmKmvmVSfdJ4vY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=SolarWindsTFTPServer.exe

http://gsf-cf.softonic.com/95d/7b3/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64624&instance=softonic_en&type=PROGRAM&Expires=1475907352&Signature=QrA36VfSeAZODCMx3WaG89f130L0mLYkPysqGqROJHEcgF2~WgGRZnvaOcEjTYiL3y4hd949tpG~vcmoWM1iw3odgyzgwG9r57VnUG6aQ9ePE2u3bXu~mbL5HJQknsFoTjxT8du2sJLYewaluZuFAaBsDtZjvtt7a0rn5h~ag0U_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=SolarWindsTFTPServer.exe

http://gsf-cf.softonic.com/95d/7b3/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64624&instance=softonic_br&type=PROGRAM&Expires=1474249641&Signature=RaXmbru-7OKsC5-oUSFVQCCIhLbr7Q72EB9Esi5D5AOuaEpn8~GU5YE0b~V9oqaE1S~tdKzhHhKiRTwMuHAWzW5ygqVSy7uT6Faa5hfe6FiD3K6HOskRiJpWFh20knIGkZeGfckAyYTO7mXLYs28LPAeB49UKqyIlt2B48DmZl4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=SolarWindsTFTPServer.exe

http://gsf-cf.softonic.com/95d/7b3/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64624&instance=softonic_en&type=PROGRAM&Expires=1441649217&Signature=KHcBBGi80JSkUg7gnpl6TiFe5Ahi8haTnLnYqL-utIO5lbNqMGcDf-qAKREBlnBbZsi~GETuXmc5ZtOnKBFxFfAwMPdOEa39hkynAFtHy6L-8U23mDps64G8rXMpJNtYBpydCM4xlR-Nw0CbeKd2Kyr-3r7M6cJZl-CPe8DvsaY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=SolarWindsTFTPServer.exe

http://gsf-cf.softonic.com/95d/7b3/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64624&instance=softonic_en&type=PROGRAM&Expires=1439602409&Signature=H18sKYgR-fBLmwOL88zgfkLlonUcxDhZxXmJBlYIFSjBsr4uqZxlqGTxTE-zeWv5aTFdyLfw3pxdxta-MUL2OrHxXViMJ~H7JkagEhEl1QghHopS8xd0B3y8rby8ULLsspn7rX-0SDr4QrnYyKHvEqs-O5nOcve2wYchEveHWFo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=SolarWindsTFTPServer.exe

http://gsf-cf.softonic.com/95d/7b3/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64624&instance=softonic_en&type=PROGRAM&Expires=1456420194&Signature=hbNLFil4cl1jtusstLNoLZgQ~cGvMkzNoFo5zVTSoxxMRVFwGDl6ztY0eZa2eDIAgki-Je3MJXg4dG1Ujfi8ZT3MiG4fDOS4FvtEa5L7EDjFOFWzobkrQQdOzKJ3yfXyiFbvtb6UlFdgZ9AgSc-oUydKohB-mLNk92f2GvnPYjo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=SolarWindsTFTPServer.exe

http://gsf-cf.softonic.com/95d/7b3/.../file?SD_used=0&channel=WEB&fdh=no&id_file=64624&instance=softonic_en&type=PROGRAM&Expires=1430366372&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=Czss0JZ1o3UCizl5pcBKs8915ibPL3cNNM2v~qgIef-XALBx7Z4mheVHVk9NNHExJBdKN8emTNhFdiwDjGudmSE2rQIdBi6JOYczUHxFFwWIXIv4dDRDaeSwxvn3lLrL4xd2Ny2~aeisC-ZLSU-y7lCW6kDwUQAPaNsbniw3DtQ_&filename=SolarWindsTFTPServer.exe

http://victek.is-a-geek.com/Repositorios/.../SolarWinds-TFTP-Server.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.