home

torbrowser-install-5.0.4_en-us.exe

The Tor Project, Inc.

The executable torbrowser-install-5.0.4_en-us.exe has been detected as malware by 1 anti-virus scanner. The program is a setup application that uses the Nullsoft Install System installer. The file has been seen being downloaded from www.techspot.com and multiple other hosts.
Publisher:
The Tor Project, Inc.  (signed and verified)

MD5:
3121f1481b258b04ea771407b3034422

SHA-1:
8bf9beb85fdf7793eac212f8096b8d83855ccaff

SHA-256:
6ff07c0ef1f382b65cf1d0d5217644cac124484a6e5f6084c61768d2aa5bb449

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
5/14/2024 7:58:40 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.12.7.17

File size:
41.8 MB (43,801,888 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\downloads\torbrowser-install-5.0.4_en-us.exe

Digital Signature
Signed by:
The Tor Project, Inc.

Authority:
DigiCert Inc

Valid from:
5/22/2014 5:00:00 PM

Valid to:
5/25/2017 5:00:00 AM

Subject:
CN="The Tor Project, Inc.", O="The Tor Project, Inc.", L=Cambridge, S=Massachusetts, C=US, PostalCode=02081, STREET=7 Temple Street, STREET=Suite A, SERIALNUMBER=208096820, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization

Issuer:
CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0C310A0C32CEA7FE5D6E112D52E6B6EE

File PE Metadata
Compilation timestamp:
2/19/2012 7:01:49 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
786432:zRIR4QG4V/IClgwHpOSq2fsIEgB5pMJNKb8zXGEYyMpoUvPNdQbyxa939HN:lIR4QG4VQcO8fZEiEYyE1I9NHN

Entry address:
0x4327

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, 93, 42, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, 94, 42, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, 94, 42, 00, 56, A3, 40, 7B, 42, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, 9C, 7B, 42, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, 94, 42, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Entropy:
7.9999  (probably packed)

Code size:
34.5 KB (35,328 bytes)

The file torbrowser-install-5.0.4_en-us.exe has been seen being distributed by the following 24 URLs.

http://www.techspot.com/downloads/downloadnow/.../?evp=91e732b318425e6b223e571227a97a6c&file=1

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.ranchmetabits.com/um8_wYGCLp9S0DMk2XF8 fTonV77OxvjxH90xC7qwtJgeVZnXb8AVcLw Gyouem499NHRItnyE7sc3WK0XXfLooGhqGQm1gEDaNqYgyIKRI6mMRTDpcf hTj24HIpt2nypQcrod9N6QG840i4hSoCoK6yKiIPzjJC97N_UJPr10lnwXoyqM=-GxkDAGTQTWocOEEs94prgEVq4G0Rg4kcsLfFEPNJ7L1x4MkaIz LwJxv6_jon1u59gveY7XtOrnfh0O2DUmiOzarMu0_zIhmZ7eZ0Hx kNDhQ80Z A ydXkoZgwJYGjPdGLOm0RSRhowqAJH1EuIZ4k2 oR_VfcexylKDPLivR4aAtjY63fqYM7LqS70iVTj96xI8QZvWVcK4WlHDk1PyOPwPG74VKX6uB_uywAs6oBOGDDn8MbQZCst6Vh_V7Z9Shxn1tKJS4C4XSxxOwBIqXknoWyq1Fspb1D8iHnriAiTQkzGjpEh2hx3LNcxPkuuyZxABEx48HdLPoI9fYOpa60Y5LGxVra_j2FlsBBe8sGI5RYneq8 sffn7AOJ5LH3aYquvJbC5n2tcepF4QICXVa8X6YVYAmpRRFicruUnikRJucNbFB6uq895gAzoS2teBIadHMC0tuIxKpEh49A4u pbz0Gr1L86xa_EVfgh0bAKbRCsmhNEU7FkcQ6jT171xm7Kn51XQ3XDyKRkeGq K6ZjlQEpsQ0xBv DMWDwW85BGPrCZcuDzZfT_k4r_36um3RFKG20jutiHT luBa8sj3FzFcyRRmbKtTeQAaQB7ZrW 7 PsUBwODEmYn3urJHiFYmq4g01ddypmLYVJu3Mg9 igIDMVz1dATXH6UovhpOK3iRcsQ1HaWi2ufPTsHHTf81iqxURtYE0tSN_5UUJLjpPABzOMrx_Ntw5xam837IM6KQohVL3N4I C4yDuULy ni2_3sVZoBsAV7gr LA

http://www.download.fi/.../download.cfm?version_id=105486&software_id=4065&mirror_id=0&installer=0&perion=0&air_installer=0

http://tor-browser.tr.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKeQn6Gjmpc=

http://filehippo.com/download/file/.../

http://tor-browser.da.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmZ-Jnp6nlps=

http://tor-browser.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKiIoKKkmpg=

http://filehippo.com/download/file/.../

http://filehippo.com/es/download/file/.../

http://dl3.vessoft.com/files2/t/torbrowser_windows/5.0.4/.../torbrowser-install-5.0.4_en-US.exe

https://www.torproject.org//dist/torbrowser/.../torbrowser-install-5.0.4_en-US.exe

&onid=2356&oid=3001-2356_4-75660251&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=browsers/web&topicbrcrm=&pid=14486008&mfgid=10192562&merid=10192562&ctype=dm&cval=SPIGOTWIN&devicetype=desktop&pguid=0dfaaf4c329201edb8f57b24&viewguid=ZoZiI3FIgAd6Fhhzfu0ijWwKUqt2fFjJAA-M&destUrl=http://files.downloadnow.com/s/software/14/48/60/.../torbrowser-install-5.0.4_en-US.exe

http://tor-browser.da.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKaQpZyjlZk=

http://www.afterdawn.com/software/.../download.cfm?version_id=105486&software_id=4065&mirror_id=0&installer=0&perion=0&air_installer=0

https://doc-0g-c0-docs.googleusercontent.com/docs/securesc/omer6g2daqbkpd8963l08p1pj23nu3da/nif9ch5fv3nofhf8smktbi9260so8i31/1456416000000/01873178837252765688/.../0B8xq-m8u3pJqcjNBZU5LWDZVU00?e=download

http://tor-browser.th.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKaPop-nl5Y=

http://tor-browser.fi.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmZ-JnqGhl5w=

http://files.downloadnow.com/s/software/14/48/60/.../torbrowser-install-5.0.4_en-US.exe

&onid=2356&oid=3001-2356_4-75660251&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=browsers/web&topicbrcrm=&pid=14486008&mfgid=10192562&merid=10192562&ctype=dm&cval=SPIGOTWIN&devicetype=desktop&pguid=2c6a5a19a22b4c8bacb640d3&viewguid=ZIuy@amGXVxPROByvw3cXAL3fLQ@P9BPGyPb&destUrl=http://files.downloadnow.com/s/software/14/48/60/.../torbrowser-install-5.0.4_en-US.exe

https://dist.torproject.org/torbrowser/.../torbrowser-install-5.0.4_en-US.exe

https://www.torproject.org/dist/torbrowser/.../torbrowser-install-5.0.4_en-US.exe

Remove torbrowser-install-5.0.4_en-us.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.