home

ttpod-setup.exe

天天动听

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from 123.briian.com and multiple other hosts.
Publisher:
天天动听

Product:
天天动听

Description:
动听音乐,美妙聆听

Version:
1.0.0

MD5:
27baef4f4333faa7cb1dd7742bb58dcb

SHA-1:
76bd54d73caf2d8d09664d9c75dabfc67d62ab04

SHA-256:
fbb0dd0d75932c6ad0a1c223084fc7c5fd32a040ad9992fee5952c4c07f4561d

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
5/10/2025 8:27:57 PM UTC  (today)

Scan engine
Detection
Engine version

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.0

File size:
19.7 MB (20,607,932 bytes)

Product version:
1.0.0

Copyright:
版权所有 (C) 天天动听

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Chinese (Simplified, China)

File PE Metadata
Compilation timestamp:
6/16/2008 9:49:15 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
393216:KG4kLtTVhz7tUK5zJ7GxFmLZZ9lltVkrspZlfVJiyfaEOT+XIK:34kZTVB7eK5zVQULz9LffzBIK

Entry address:
0x36DF

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 7C, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, B8, 93, 44, 00, E8, AD, 2E, 00, 00, A3, 04, 93, 44, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, A8, B4, 42, 00, FF, 15, 58, 81, 40, 00, 68, 04, A8, 40, 00, 68, 00, 53, 44, 00, E8, 8D, 29, 00, 00, FF, 15, B0, 80, 40, 00, BF, 00, 20, 47, 00, 50, 57, E8, 7B, 29, 00, 00...
 
[+]

Entropy:
7.9941

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file ttpod-setup.exe has been seen being distributed by the following 4 URLs.

http://123.briian.com/forum.php?mod=attachment&aid=MjE4NHw5M2E0ODU1YnwxNDgxNzI0MDI5fDU0MjIxfDcxOA==

http://123.briian.com/forum.php?mod=attachment&aid=MjE4NHw3Yzk5MzgzOXwxNDcyNTM0NzMzfDB8NzE4

http://www.dongting.com/.../ttpod-setup.exe

http://123.briian.com/forum.php?mod=attachment&aid=MjE4NHw1YTM4MjRiM3wxMzkwNDgzMDAyfDB8NzE4

Scan ttpod-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.