home

zbar-0.10-setup.exe

The executable zbar-0.10-setup.exe has been detected as malware by 2 anti-virus scanners. The program is a setup application that uses the Nullsoft Install System installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from tcpdiag.dl.sourceforge.net and multiple other hosts.
MD5:
52277ae1b3132e44b2cb317f1a125ae6

SHA-1:
13e66ac88461e4925ba178ff372d4c4f6d330061

SHA-256:
3404793b7ebeb59f2f44db131fa9e31ab736ca38816d6b449664ff43e23d8aea

Scanner detections:
2 / 68

Status:
Malware

Explanation:
This is part of the Crossrider Internet browser extension framework which may modify the user's web browser settings including changing the home and search pages.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application.

Analysis date:
4/19/2024 5:55:18 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
HW32.CDB
1.3.0.4959

Reason Heuristics
Threat.Win.Reputation.IMP
16.11.29.15

File size:
3.1 MB (3,257,279 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\downloads\zbar-0.10-setup.exe

File PE Metadata
Compilation timestamp:
10/11/2009 8:32:37 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
98304:UBtJU/g0lfHuRBhN0vePNayHdG6USMjVv2ow8:UC/ABhCaAUdfUSMjp88

Entry address:
0x39BC

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, 7C, 01, 00, 00, E8, A3, 47, 00, 00, 83, EC, 0C, 68, 01, 80, 00, 00, E8, 4E, 44, 00, 00, 6A, 00, E8, B7, 47, 00, 00, A3, C8, 34, 7A, 00, 6A, 08, E8, 6A, 28, 00, 00, A3, 78, 35, 7A, 00, 6A, 00, 68, 60, 01, 00, 00, 8D, 85, 90, FE, FF, FF, 50, 6A, 00, 68, A4, A2, 40, 00, E8, FC, 46, 00, 00, 83, EC, 0C, 68, A5, A2, 40, 00, 68, A8, 35, 7A, 00, E8, 8A, 2A, 00, 00, 83, C4, 18, E8, 0A, 44, 00, 00, 52, 52, 50, 68, 00, C0, 7A, 00, E8, 75, 2A, 00, 00, 57, 6A, 00, E8, 5D, 43, 00, 00, A3...
 
[+]

Code size:
28.5 KB (29,184 bytes)

The file zbar-0.10-setup.exe has been seen being distributed by the following 7 URLs.

http://tcpdiag.dl.sourceforge.net/project/zbar/zbar/.../zbar-0.10-setup.exe

http://ufpr.dl.sourceforge.net/project/zbar/zbar/.../zbar-0.10-setup.exe

http://voxel.dl.sourceforge.net/project/zbar/zbar/.../zbar-0.10-setup.exe

http://optimate.dl.sourceforge.net/project/zbar/zbar/.../zbar-0.10-setup.exe

http://kaz.dl.sourceforge.net/project/zbar/zbar/.../zbar-0.10-setup.exe

http://colocrossing.dl.sourceforge.net/project/zbar/zbar/.../zbar-0.10-setup.exe

http://downloads.sourceforge.net/project/zbar/zbar/.../zbar-0.10-setup.exe

Remove zbar-0.10-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.