home

wpxp101.exe

Windowpaper XP

SodaBush Development

This is a setup program which is used to install the application. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
SodaBush Development

Product:
Windowpaper XP

Description:
It makes a better door than your window.

Version:
1.01.0048

MD5:
2858f7f4d0d508ad99cf8de1925000be

SHA-1:
b8d809f7847d9b3497e48da5bb4e7c50bbbbd4f5

SHA-256:
8c9b6309d2621bda7d2e3e910776c5539ab7e5acf890f5325c962f1617e48ee4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/16/2024 2:29:49 PM UTC  (today)

File size:
2.1 MB (2,201,781 bytes)

Product version:
1.01.0048

Copyright:
(C) Copyright 2003-2004, Bryan Callahan

Original file name:
stub32i.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\wpxp101.exe

File PE Metadata
Compilation timestamp:
8/2/2002 10:01:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:0d/Ij3l0VPM10Y5ogakUC1B+uofMWcsO261mqNWJdrMGTYujc:06egrU4mfncsO261FIFMH

Entry address:
0x8AF7

Entry point:
55, 8B, EC, 6A, FF, 68, 20, 43, 41, 00, 68, F0, C3, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, F0, 41, 41, 00, 33, D2, 8A, D4, 89, 15, 7C, 93, 41, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 78, 93, 41, 00, C1, E1, 08, 03, CA, 89, 0D, 74, 93, 41, 00, C1, E8, 10, A3, 70, 93, 41, 00, 33, F6, 56, E8, 70, 02, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, B0, 00, 00, 00, 59, 89, 75, FC, E8, D1, 36, 00, 00, FF, 15, F4, 41, 41, 00, A3, 4C, BA, 41, 00, E8...
 
[+]

Entropy:
7.9619

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
76 KB (77,824 bytes)

The file wpxp101.exe has been seen being distributed by the following 8 URLs.

http://gsf-cf.softonic.com/b8d/809/.../file?SD_used=0&channel=WEB&fdh=no&id_file=30920&instance=softonic_es&type=PROGRAM&Expires=1461908376&Signature=LVNbxDaCLxBw5yHcI-Ls8-PYCDcWsoZVYDLjS~709sHBRtQe~RSHK4UfquKIb0DS85hXkpfwzD5smk9SFV~oQiN5inoiCux8TLub0oNWHmJ68Uy--n1ZzS6qSrMmBelblXReO-aXQpb5V31GM-LyjQ6QwV9KFWty96SsmT3pqw4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wpxp101.exe

http://gsf-cf.softonic.com/b8d/809/.../file?SD_used=0&channel=WEB&fdh=no&id_file=30920&instance=softonic_en&type=PROGRAM&Expires=1458759555&Signature=PwUK~7dFP3FWgfmH3X9kiOjA6iUEPQNDFwmNlvUEqM1miJvbAZsqEDBnU9dSrr77E22DgDOkWc8X47i0fj4VgqbaaxnGBEhAX9bVpIEkfnzFyiLKfVACfxYvnM05qGWdRqBmKjUaaVng1hA~Jjp7nJ2lyGdndT3O3bnOBkl4nUU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wpxp101.exe

http://gsf-cf.softonic.com/b8d/809/.../file?SD_used=0&channel=WEB&fdh=no&id_file=30920&instance=softonic_en&type=PROGRAM&Expires=1447393123&Signature=H~3p-eS1iWcA8zpawa7UJ7PhJJqPHvRLWj~Tmpa0f0cNIgtX-OH-gA-b8nacGICaJWhtlllMaIBSNQCChojX8Nhe15lvnf~q6HIQk8X~LbyJrJf79Oos3s7Sjr9PcPvB9W3Aq3JKUZooLIeYTefg2~seoT-r0LyvA43oRiNkZHo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wpxp101.exe

http://gsf-cf.softonic.com/b8d/809/.../file?SD_used=0&channel=WEB&fdh=no&id_file=30920&instance=softonic_es&type=PROGRAM&Expires=1443320153&Signature=U-8wQ6RgnCk3v11wh3-Ub~K5fi3ZgsUXkIyEDkTEF5aVCGQD-ZxUMTAyTrv8ta15SWEXfQXf0WJ2N-~YY2NEa2wV4z1vsBl4Akj9pd1cYGyiWNKsXiD3JJGrNyCI7gWS8eUwKg4mPf0dyrp2obMSWXJglWpt1zjFYb6lAaz6ylM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wpxp101.exe

http://windowpaper-xp.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWss OhUTy6dg0oQkSTT3eVBRJz7Ig6b3PAPAzS/J5i5/jzgEmigwpeC8ypg MAx5XbymakNF/.../EPOLWOviZMo1wOwp0Rm iqHnsXl3qVCpC0tAjU7FMrdUiWr2U1EY=

http://windowpaper-xp.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAOGMtfd GVMLvQsHqQHA2XCZXoJmcm4DvJOIFcT5yn6SZI/.../B5lgBANAlWZhLoVMd oPWFH2EOpVAEBVHfVKPpBx5sL92dvR4zDO6 l5sCsiLgr0jsQvMHeYvwqsXJo=

http://www.sodabush.com/jump.php?id=150

http://www.sodabush.com/windowpaper/.../wpxp101.php

Scan wpxp101.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.