What Gridinsoft observed on Softgozar.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903033709-b92654ad
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Distributes Malware or Unwanted File Download
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current Gridinsoft category is retained because the exact reported download chain remains active. The www software pages link to two current RAR archives, and those archives contain the exact reported Windows executables: an AOMEI crack activator and an NTFS Permissions Reporter keymaker. Their included instructions direct users to run the activation-bypass tools, and the AOMEI instructions tell users to whitelist crack files when antivirus software detects them. The files were not executed, so this review does not claim a specific trojan family or payload. The reproducible basis is current distribution of unwanted crack/key-generator executables, not the apex-versus-www spelling difference or external blacklist labels.
Analyst findings
Review 5 documented observations View evidence
The apex redirected to https://www.softgozar.com/. The reviewed AOMEI Backupper and NTFS Permissions Reporter pages returned HTTP 200 and directly linked to the two RAR archives named in the report. The hostname difference does not separate the operator page from the download objects because the www pages actively publish the dl1 and dl2 archive links.
-
HTTP status
301 -
Final URL
https://www.softgozar.com/ - Public artifact URL https://www.softgozar.com/aomei-backupper_/
- Public artifact URL https://www.softgozar.com/ntfs-permissions-reporter_/
- Analyst observation Both reviewed software pages contained live direct links to the reported RAR archives on dl1.softgozar.com and dl2.softgozar.com.
The current 201,969,592-byte RAR archive was downloaded without execution. It contained an executable named Activator_AOMEI_Backupper_v2.exe whose SHA-256 exactly matched the file object supplied in the report. The archive README instructed the user to run the activator, press Activate, and whitelist crack files when antivirus software detects them.
-
HTTP status
200 - MIME type application/x-rar-compressed
- File SHA-256 d0ac6f4a906581f48fb7128cbcb5f1ace497f165957d3853eec43ef702d49bdd
- File SHA-256 2018276745591a2cfa364436a39280a6efb393b879da12db86e302be1bd75d33
- Analyst observation The inner matching file was a Windows GUI PE executable in a Crack directory; no executable was launched during this review.
- Page element The archive README instructed users to run the activator and whitelist crack files if antivirus software detects them.
The current 60,784,277-byte RAR archive was downloaded without execution. It contained Keymaker/Keymaker.exe whose SHA-256 exactly matched the second file object supplied in the report. The README instructed the user to run Setup.exe and then run the keymaker to obtain a serial number for activation.
-
HTTP status
200 - MIME type application/x-rar-compressed
- File SHA-256 b11afd84cf669059d759c4e3510ed81428740398e3ca21509ff3c3af51ce4a0e
- File SHA-256 7365f35b5ce26a9756dd5aa732f942806dc182f2db3c009fc2da3b8b76cf3364
- Analyst observation The inner matching file was a Windows console PE executable in a Keymaker directory; no executable was launched during this review.
- Page element The archive README instructed users to run the keymaker and use the displayed serial number to activate the program.
Static inspection confirmed that both matching file objects are Windows executables and that neither PE image contains an Authenticode security directory. The activator imports Windows allocation and system libraries. This review did not execute the files or claim a specific malware family, persistence action, command chain, or network payload.
- Analyst observation Activator_AOMEI_Backupper_v2.exe is a 32-bit Windows GUI PE; Keymaker.exe is a 64-bit Windows console PE.
- Analyst observation Both executable PE headers had an empty security directory, so no embedded Authenticode signature was present.
- Analyst observation The files were reviewed statically and were not executed; this analysis does not assert a trojan or other specific malware payload.
Public urlscan searches returned 130 records associated with the parent-domain search and 80 for www, including repeated captures of the expected Persian software-download site. The returned result set did not assign a malicious urlscan verdict. OTX reported no pulse for www or dl1 in the available responses, and Wayback preserved extensive www history. These indexes are incomplete and were context only because the live exact downloads already supplied reproducible object-level evidence.
- Public artifact URL https://urlscan.io/domain/softgozar.com
- Public artifact URL https://urlscan.io/domain/www.softgozar.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/softgozar.com
- Public artifact URL https://web.archive.org/web/*/www.softgozar.com/*
- Analyst observation External domain labels and public-index coverage were not substituted for the current exact archive and executable evidence.
Scope and limitations
- The review covered the apex redirect, the two reported www software pages, the two current RAR archives, their file listings and extracted contents, static PE metadata, DNS, current report data, public URL intelligence, and available archive context.
- The executable files were not launched or dynamically sandboxed by Gridinsoft during this review; no specific malware family, persistence behavior, command execution, or network payload is asserted.
- Only the two exact reported download objects were downloaded and inspected in depth. Other files, mirrors, software pages, account areas, and future replacements were not exhaustively reviewed.
- Public urlscan, OTX, archive, sandbox, and threat-intelligence indexes are finite; unavailable or missing results were treated as unknown rather than clean.
- External vendors manage their own current labels. Their results were recorded as context and did not determine this verdict.
Help protect others by sharing this page on social media! The more people who know about softgozar.com, the fewer chances they have to deceive someone else. Help others evaluate softgozar.com by sharing this page on social media!