home

visualboyadvance_setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.signtodayclean.com and multiple other hosts.
MD5:
17c7482ae44efe51af421502d4461e30

SHA-1:
b00312ef8e96f9542dffa88e4273011088381099

SHA-256:
1af24f5c4d879954b6e36c836f121186074c571402e18e3e154db77f15459907

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 1:23:43 AM UTC  (today)

File size:
603.6 KB (618,052 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\visualboyadvance_setup.exe

File PE Metadata
Compilation timestamp:
12/6/2009 9:50:41 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:mwx/plnURRp5EuCGJsFDz8O571IU9IZqd440lK4kNH7jDVTa/j84aXj/y:mwVnUPpmuCskDZvSUd2lNk57k/otXG

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9647

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file visualboyadvance_setup.exe has been seen being distributed by the following 24 URLs.

http://www.signtodayclean.com/JvCAm0tCJ6pr7UGBbw_snBdi_CEDnARIHB_YTSK_Xc_Ufo91E5sl5VojSw3 Vwb9yAt2UEzdaPdbxCVcAkCD7NiAa Kw7gb4PqrvK2E7ZlTWwY1_X3mpEPukpRYQMCW00yRZthjdaB0mBE5igu1qKkr02IB3nUC1LX487AE7XCh ZYYoqhocxACixMc6XKgPnBgf8j29-Ow==

http://www.townmetaupdate.com/GYhsy1k5cjFqOi6siIcpS1l8ZSYnKfd3BwpFxBqOxLnogMlZNY6Dxl50GxBrJnOlCwL_LxKkQ5QXXmQWBEVN7Sg9XUeHag4G9G9vQQa8dbw4Bh4x7KQJhM5MOPgKHsFGZZhhVBy791gu8TaIxXkdFNH8FqI243_u5FyMR5oGB0aGgWCJE9mgbKIz0mWc7VdUkjGG08CFPZJVhQm3gjeFG8eFBmv1KA==-Ow==

http://www.signtodayclean.com/v 4pfhcK7M2pxNnjDXB ubBg_ugspk2SvkEUzNzFUgmExIQVa9563N_CAYqE0c0y5n7HJX7CL1TdMD7d5snzbSA7Qy8FPiiQAnXWEx4vTUPQ95y7HOLEFuqK7WSzWACj7or skk5ZwKlj_xrENm7bdVg7b_hhtoMUbTVTlcwG9WVb ly1MYZuOocnrc jIbRhkD3V6DD-Ow==

http://www.signtodayclean.com/59rGA3CH 1EWYfQzhaCX_bl OCO9zC_W_cp7Sje8GGabcqtfEFl6BJaoxWI4fv1y38YmLRZvw5J P4B2aPknRFRLOsgpX1xWKe TaXPeM9RlsInYE2XI2e316d_el53zDULnVvs9oBBq26Z6Rz oNfLL_QG3B58zJYBNv5qBNAsqFUnY2yVGGsD43LBhoAC69EiSmi5yp8dShOEM3jOrVDPNlXjWg==-Ow==

http://www.signtodayclean.com/qW32DR3vOQ214aABX8Np0B_efjIAbP99qcan8OhES4_whuPUxFWCNrwanT0SjOn5HynD7AWzXWt5IKJXsAQqYANO7u82dM5EGF_uoxlFLgEUQSP48LR4Ac1t8Nr4MHkQyzVoN7_6lzyM2WB85bhr3 5Ga77Rse1CPX_KbLXxHmiRnibUFz_PK9S8SR7xedor91hfwXRdjXYIpsLUk0IBDNaUSuTNAg==-Ow==

http://www.signtodayclean.com/5kkvIdBP82znSRyQTcMeLNutHARvsP77 r_aPzQ9tv06ujhl9aPX1nMEz__But429lYzkf__hp1zLsqfsbGDPHEkT 6lYc2cXzV_8sd2ikS159mT3IWN3_LEXVslNXLqUJZ3JS_1cPdmNHDigwz0_GyaazTLG7VzpO75m635MNUTIFEkWSo6gy7LPVyRDp9pDJ6FwiUT-Ow==

http://www.townmetaupdate.com/Vfb05cB_ArecKrHTxx jcXmOYAF2YwXB3BIOlKLg3ICP3QEoVdS7wQAbUrAvykDImIwOq1tTqzWANwxgWhXz85 tulaW9ZvkCYPvfpX0WFDIE6xNEPbOJvDguyaqhsMAz6pVjxuBXDWsrZ xhuFFOafYItaqe6CgPvqJVSMZ0zHs16j7HN EQkc6V1pwUbho9gxc7xuyQLU1G7ypscbPJrXOuWjVXQ==-Ow==

http://www.townmetaupdate.com/1qmbPss7ThNz6A9dlnU1F4ZZUe2mO2v1 FFTDY0CgjGJN1A7WMKcMVbZohu0cBOoLzcwkTrTmtopAfDmNVf_A9usU6UP4xVrlkXaae3dgMo_SxHgL1ALpnv2ux_Qz wr_pm6WLgEKMYUHQAB gOjEfQkYDc7XZHHel7B1NyXlsFkHoT1vaWNyWWQ9CidGuKbvUKkRHT_jlLvxySxitqHNgax9NIwTA==-Ow==

http://www.townmetaupdate.com/hzSGa53U36sEXXyJ8I wyhtwGn2mT5jq8FJP9r5XYIpTlnHwVQleZcpU2wh9EPhRCY71nft6HOpSB3eBIOv3s6AtL6cj1CCnabtuWZQVV7mPB0XSdhWwGa2DSIe54JWgVZKZfBiuu2NLAhHchXS3yKuWnVrrHTixOY1uv9upT VYT8TdxSEVKodVvFaVfk6inZiCiyLX6zG5bvqu4LECGSQTHUPhZQ==-Ow==

http://www.townmetaupdate.com/eZ5qY_PVH cnzWOrRLNri zFidNCDHly6in5YUWpaJx1tn9078uwG8ZKAO5DswDwq2h1Ar8h0xNBSJ1oexrXqS6n5fpysGJ8s1kb56d7l 5SMRNE22OIHZEoWvbxT7YjX89AkR0HrvbLKFqHvHWV4qDyyujRKfZV_hyyR3ezeJhSW1WydDZOJjrqcrSh6c0nEkHNcvL5QJDELIECky_EkZo1nASRig==-Ow==

http://www.townmetaupdate.com/GDEgbKTEhiwvDN29jQgjglXGviC42hMA07qLTIlQC8b q2POb1mdCou39ICXDtILMzicoL8eKY1D6CUTPvTyaV90 lTXF_zqJjwYlWO5KQ2WtFrSRL2bHuvtn7n7OiJzDRPaGt9ln9VPTLmb1G8mXnpBFcZjCgwa5btfjS4sdNApmvbpidDGluhO sHq3ZIJxpj29WfWl05cIy0MZxTZz2R6o4DMUA==-Ow==

http://download2184.mediafire.com/15g3b89pw6gg/.../VisualBoyAdvance_Setup [1].exe

http://www.filesfunpresent.com/c?x=Ls7lvbK0hgYd/gUK4WHHpF8/Sqr0efRKToL8Uanu8WI=&e=0&c=asllw/hPtwrFVX5r EAjFEwBNoN6snA2G10IAOa27tS91TUJsZkzKOTgnqAI4zXewbOpyPN18WIScqPz9MSZa367EKB5/41bWzwK TFCzn9nnpLUw3 hmo d8/.../XtLII3xS7JRxm5EouDcIDoATfQNvZNZjMhShYLzv9AwVJBaK9KJN4LkcD0m5SN1FF&downloadAs=VisualBoyAdvance_Setup.exe

http://www.filesfunpresent.com/c?x=aq9FSWux7qQtPyCwGbB wIQqt/MdytPqqjrKOHFQZt0=&e=0&c=OO896Ytd 0X4u9 fMMBz1LfuKLNY7SGD2TqONY5Pb8tpnv5a87kW1vrtk AaJeqKg0riyO6zGhit6BN 3Zay8Rz0KGO6POkshaCyuUtXjvqZq37Jb5KkoE8L0 HBvRfK75NhUrquuarAJI/.../iB004rw=&downloadAs=VisualBoyAdvance_Setup.exe

http://www.filesfunpresent.com/c?x=CP/ZPo2ix8S D5AqWgj97cDqtBuAnddwSy VzjHr8hg=&c=SIiIEqpcVcQKgLNtrPrTo3TtHnbl9eKj9J7MkR9XF1yfGxFOQ4lZTNoYPgjGFVyt1RdUk76VTlqdOAIEs66RaMfdRKLjLh094gQoXMtKb5kupNgLcqaB/.../Be8VlbOecv75e1eKRFLl2ySdztmdN9lWxnb Qnrsr&e=0&downloadAs=VisualBoyAdvance_Setup.exe

http://www.filesfunpresent.com/c?x=3MAisRD4rxkpRuzavWrDoxPfqyXm9Kk5M V058cwt8w=&c=SCjQf3YXTM5t2wG15DXRR6aT1QKUPHhkOC3e7RxSo7iTM8tsKebiMUqAc58ZWUEK1V8FaBgazvJ3tXrxLEA4LI24QGzY5xLAca5 zbNAfXsiq2/2Nh0Clmn9PDT/Dwo q00Gq5JU1fMa1TzGkgiozPPdD6H5R4Tkkp /.../H3rg7&e=0&downloadAs=VisualBoyAdvance_Setup.exe

http://www.filesfunpresent.com/c?x=b5b 7D UpVDivZmVS5BrE/.../xu37sVMxuWW1egrOmDvlEr3G K&e=0&downloadAs=VisualBoyAdvance_Setup.exe

http://www.filesfunpresent.com/c?x=gs74lRjj2EjNRFuVQXM0vjeqDFXONSyNaMGSdhxPQRA=&c=INneHj/.../0qhJH1JZKT0FuK0Mhj7H0uzWU1TptJ5zezNALdAlkxpWigScr7TYV4PRboPwp493x9CXcHh4N3LqX0JAzKIQZx mtd6MFOmqATaN0kKGdmVGSn8gpEbS2yanJB6zboO4zzDjblpm2L0lpllHKVCq2fGuMnvX9cGvA=&e=0&downloadAs=VisualBoyAdvance_Setup.exe

http://www.filesfunpresent.com/.../ZxIM2BXamwcOBiWKjE9G1&e=0&downloadAs=VisualBoyAdvance_Setup.exe

http://www.bundlessafetag.com/c?x=5QZS/tVWkeKPvbeOHdq53GDBvs4N2hMPLj 38Trwb7M=&c=7JxjVO byQf yPQQkuH/hd8j7NgOEvf6447RyLYDeaRHsTXLEO3v6Oh16925vVj3I2rnRF9/sfsIt/3qLYDVaKuHqJ /GMvrKw7Mxue1nl0DYXz5zmCqP3d1wINvjcXMxi6aCEhY3/HZzJ/.../QvMM0lxduMfc5bs4RSzWQM7u&e=0&downloadAs=VisualBoyAdvance_Setup.exe

http://www.bundlessafetag.com/c?x=i7UTQD2ZOx/2QgX62TvL2a uRuxICWH4R0hjnEF5QGg=&c=QUNorPc6WNJzjQFrAtGTy8CmMirez6qXgcwgVtH4hZ4HPCQSTy7/MMjJyUatHisHRFuXz/Pq3IhWa1Xvlr9BkIi6YgaJqjDMuH/.../HtzQfG9zEHdSoFBHRRugrEpiCY1AM6cOr1YbGoaVrJ9FEgTU979v9vCq8pAx8pvTbZc3B4lClhx36x8vIJ4q&e=0&downloadAs=VisualBoyAdvance_Setup.exe

http://cdn.quicksetupstar.com/c?x=SPhmZs/OT4Hb0bQUVgft9ihgFq403s ubMjb4GLjb 4=&c=8RZp4O/.../eNmDNsXBld7JA7cBmz8k3jlJDWg3Q7iNITXz3ZhMIloHLqhboQEOhGA==&downloadAs=VisualBoyAdvance_Setup.exe

http://cdn.quicksetupstar.com/c?x=tMLB0yE6Z5Ohx8ddjYmO7VRLaiNEmAAbZMrrZzbkCik=&c=mEVHd21CyP61w67IJI9tRbJzPl2oDGnZ2FHLYnQN34V7zYFCjuiCZ3y9F8eFalqqtVdoae3hOWPM5mtwdBKN1N4IR2lR28t1SaSXlcDMcEGZhrGgDhQiTDOJzTFxiXKP&downloadAs=VisualBoyAdvance_Setup.exe

http://cdn.softsumacontent.com/?ic_user_id=397

Scan visualboyadvance_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.