home

sp57721.exe

SP57721

Hewlett-Packard Development Company, L.P.

The executable sp57721.exe, “Original Intel Chipset Driver ” has been detected as malware by 10 anti-virus scanners. This is a setup program which is used to install the application. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from ftp.hp.com.
Publisher:
Hewlett-Packard Development Company, L.P.

Product:
SP57721

Description:
Original Intel Chipset Driver

Version:
9.2.0.1011 - Rev A

MD5:
afdd67c739ea6ced3da0537416b7243f

SHA-1:
e392556c58385f9be9f1a91af50046ae7fce3d43

SHA-256:
782c8d0149eef18f6d143508f32f3d27837ba693d380da8481ad94cbdaef5aae

Scanner detections:
10 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
4/18/2024 10:42:53 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160118-1

AVG
Win32/Sality
2015.0.4522

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5366

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.4543.0

Norman
Win32.Sality.3
11.01.2016 17:30:26

VIPRE Antivirus
Threat.4721115
46794

File size:
3.5 MB (3,712,672 bytes)

Product version:
9.2.0.1011 - Rev A

Copyright:
Copyright © 2012 Hewlett-Packard Development Company, L.P.

Original file name:
stub32i.exe

File type:
Executable application (Win32 EXE)

Language:
Engleski (Sjedinjene Države)

Common path:
C:\users\{user}\downloads\sp57721.exe

File PE Metadata
Compilation timestamp:
8/2/2002 9:01:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:Rd+mQakC/rMTJJajytG0JzJmUOAumRDIthzQtdDsL5SFFPzzv7LvgZoxl9ffzhC:RbEdwOLa93mDozQtdQMXPzzTa6fb4

Entry address:
0x8AF7

Entry point:
0F, AF, D0, FE, C9, 03, FF, 48, 81, F9, 92, 0C, 00, 00, 74, 01, F2, 88, C6, BD, 7B, FA, C0, 45, 8D, 15, DE, D2, AD, 4F, 21, DF, 47, 8D, 15, 43, EC, D8, 91, 88, CB, 6B, C9, 00, 77, 07, 3D, 77, 6B, 46, FD, 8A, D7, 81, E9, 2C, C0, FF, FF, 69, D0, 60, 53, 80, 1C, 69, C5, 34, 17, 90, 39, 81, E9, 5B, 07, 00, 00, 85, D2, 34, 76, 8D, 29, FE, C7, C7, C7, 21, 1B, 9B, 77, 80, C7, 6E, 81, F5, 3A, 09, 00, 00, B9, 85, 02, E3, 3F, 03, F5, 33, C0, 1C, DC, 81, C6, 65, 09, 00, 00, 85, DB, 75, 02, 2B, D5, 0F, B7, EB, 69, DE...
 
[+]

Entropy:
7.9811  (probably packed)

Code size:
76 KB (77,824 bytes)

The file sp57721.exe has been seen being distributed by the following URL.

http://ftp.hp.com/pub/softpaq/.../sp57721.exe

Remove sp57721.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.