home

vs_proweb.exe

Microsoft Visual Studio 2010 Professional - ENU

Microsoft Corporation

This is a self-extracting archive and installer. The file has been seen being downloaded from dl-mail.ymail.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft Visual Studio 2010 Professional - ENU

Description:
Microsoft Visual Studio 2010 Professional - ENU Setup

Version:
10.0.30319.01

MD5:
8f994cd46bf9d22e5009fcdd73e3c75f

SHA-1:
9c9472ef8b742195216e094139eea4fe3f90cb45

SHA-256:
a03ef907e301ae9fc81c6b8bbe17112a449f1ab6c79eaa623b6e50a6cec366ba

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/19/2024 2:12:38 AM UTC  (today)

File size:
4.3 MB (4,542,800 bytes)

Product version:
10.0.30319.01

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
vs_proweb.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\vs_proweb.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
12/7/2009 5:40:29 PM

Valid to:
3/7/2011 5:40:29 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
6101CF3E00000000000F

File PE Metadata
Compilation timestamp:
12/21/2007 2:26:24 AM

OS version:
5.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
98304:sHKsQ2b79LoPpXLKKj9FuzrCKj6WD1zq6Y1CTm35Xz2QhZy8EmBMDjtxiyopq:EQ2b79LypeKjk96WD1W7tzpy9jejk

Entry address:
0x63FF

Entry point:
6A, 28, 68, E0, 25, 00, 01, E8, AD, 01, 00, 00, 66, 81, 3D, 00, 00, 00, 01, 4D, 5A, 75, 28, A1, 3C, 00, 00, 01, 81, B8, 00, 00, 00, 01, 50, 45, 00, 00, 75, 17, 0F, B7, 88, 18, 00, 00, 01, 81, F9, 0B, 01, 00, 00, 74, 21, 81, F9, 0B, 02, 00, 00, 74, 06, 83, 65, E4, 00, EB, 2A, 83, B8, 84, 00, 00, 01, 0E, 76, F1, 33, C9, 39, 88, F8, 00, 00, 01, EB, 11, 83, B8, 74, 00, 00, 01, 0E, 76, DE, 33, C9, 39, 88, E8, 00, 00, 01, 0F, 95, C1, 89, 4D, E4, 83, 65, FC, 00, 6A, 01, FF, 15, CC, 21, 00, 01, 59, 83, 0D, EC, D3...
 
[+]

Entropy:
7.9983  (probably packed)

Code size:
33.5 KB (34,304 bytes)

The file vs_proweb.exe has been seen being distributed by the following 18 URLs.

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-FNOicuueiygY8MrCPm6lLm5dkrJo4dEAzA_kuEE9HT05w3YYjU3Z9N0K5m6xdd4GGH4nkLovJSeSm65J69qU1w/messages/@.id==AEe_imIAfNs-WBuWRwu4AFxVx8Y/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBY2_ATNEFVgkK_auKA2daxyb0DdKoIl-ug5id9QyrpVJNg5oa0N94wIIbnOhsqcYGVRaGMi_a4dULZHRa_xD1WB&error=https://mg.mail.yahoo.com/.../iframemsg?id=9e0ef387-e8d8-f6ff-b248-1bb8534bfcef&ymreqid=bfa314a1-1fec-5939-0191-81000d010000

https://docs.google.com/uc?id=0B7cWOYCQtbwmcW1DcnZrT05rSUk&export=download

https://www.dropbox.com/sh/64x5k1nh8771yee/.../vs_proweb.exe

https://docs.google.com/uc?id=0B23lhB8BLox6Mm8ySXhjX3RSWW8&export=download

http://download.msdn.microsoft.com/.../en_visual_studio_2010_professional_web_installer_x86_516532.exe

http://l.facebook.com/l.php?u=http://download.microsoft.com/download/D/B/C/.../vs_proweb.exe&h=XAQEGhnYj

https://docs.google.com/uc?authuser=0&id=0B1Dnd9mJNGhcVm9ZS2Yxa0lvSWs&export=download

http://download.msdn.microsoft.com/.../en_visual_studio_2010_professional_web_installer_x86_516532.exe

&onid=2212&oid=3001-2212_4-10618634&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=developers/ides-coding&topicbrcrm=&pid=11891086&mfgid=50119&merid=50119&ctype=dm&cval=NONE&devicetype=desktop&pguid=b3a4a1706412bcdf80f55b91&viewguid=YyYCkT6Mg9Ydk2CGtGYxCHcoTmrLYYTvTAwy&destUrl=http://files.downloadnow.com/s/software/11/89/10/.../vs_proweb.exe

http://software-files-a.cnet.com/u/.../vs_proweb.exe

http://download.msdn.microsoft.com/.../en_visual_studio_2010_professional_web_installer_x86_516532.exe

http://files.downloadnow.com/s/software/11/89/10/.../vs_proweb.exe

https://fp-pr1.ds.microsoft.com/.../FileTransfer.dll?Cmd=1&MN=1009308547&Dir=1&Mode=0&Off=0&TS=3F7127C0-B0EF-4F11-97C8-772CC41450DE&CVN=5,0,0,32

https://fp-pr1.ds.microsoft.com/.../FileTransfer.dll?Cmd=1&MN=329665729&Dir=1&Mode=0&Off=0&TS=B31C0A86-636C-4FB7-8696-9EF0DDC21572&CVN=5,0,0,32

https://fp-pr1.ds.microsoft.com/.../FileTransfer.dll?Cmd=1&MN=1495935049&Dir=1&Mode=0&Off=0&TS=E99AF538-F86C-4976-92C0-8DDD9F1544E9&CVN=5,0,0,32

https://fp-pr1.ds.microsoft.com/.../FileTransfer.dll?Cmd=1&MN=1470753846&Dir=1&Mode=0&Off=0&TS=BD108871-E3E3-4BC0-8F31-A8F0F5DD1AB6&CVN=5,0,0,32

http://software-files-a.cnet.com/s/software/11/89/10/.../vs_proweb.exe

http://download.microsoft.com/download/D/B/C/.../vs_proweb.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.