home

windowsxp-kb952954-x86-enu.exe

DOBLON

The application windowsxp-kb952954-x86-enu.exe, “Karaoke Sound Tools Setup ” by DOBLON has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer.
Publisher:
Doblon   (signed by DOBLON)

Description:
Karaoke Sound Tools Setup

MD5:
e302b7efb9de1863bf214a5c4528c2af

SHA-1:
b20b512257609beb687936d3d9dbab77e2ac91c3

SHA-256:
9d99b7e29b9f7bfc224db568bb5ef6ff75ecca7e161fd7f4918e78d36d43ae66

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
4/25/2024 7:23:01 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Packed/Themida
7.1.1

Dr.Web
Adware.Conduit.37
9.0.1.0231

ESET NOD32
Win32/Toolbar.Conduit (variant)
9.10696

F-Prot
W32/A-3213ba2d
v6.4.7.1.166

File size:
5.7 MB (5,964,896 bytes)

Copyright:
© 2006 Doblon

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\windowsxp-kb952954-x86-enu.exe

Digital Signature
Signed by:
DOBLON

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
8/4/2006 1:00:00 AM

Valid to:
8/25/2008 12:59:59 AM

Subject:
CN=DOBLON, OU=SECURE APPLICATION DEVELOPMENT, O=DOBLON, L=Gdansk, S=Gdansk, C=PL

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
3E4301C7E724E5B89C38B2A110FFE155

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:It3cozDbPMfrgFMGwmgY3PcleHDguCEEDY2Kmbeoyk7twtoi5riv5G5dW9wjheL:G3dfMfk2GwrY3Eu8xM2Tbjyk7tk765GM

Entry address:
0x998C

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 3A, 97, FF, FF, E8, 41, A9, FF, FF, E8, 6C, CB, FF, FF, E8, B3, CB, FF, FF, E8, 12, F3, FF, FF, E8, 79, F4, FF, FF, 33, C0, 55, 68, 32, A0, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, FB, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 06, FA, FF, FF, 8D, 55, F0, 33, C0, E8, B0, D0, FF, FF, 8B, 55, F0, B8, D8, CD, 40, 00, E8, EB, 97, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, CD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9992

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36.5 KB (37,376 bytes)

Remove windowsxp-kb952954-x86-enu.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.