0198295634.pdf.exe

Nadav Kashtan

This program bundles adware during the download and install process using the InstaleRex pay-per-install app monetizer. The application 0198295634.pdf.exe, “Installer for StarApp” by Nadav Kashtan has been detected as adware by 27 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
StarApp  (signed by Nadav Kashtan)

Product:
StarApp

Description:
Installer for StarApp

Version:
2013.8.6.1937

MD5:
e6526d54266b2501cb1fe19762b3dfcf

SHA-1:
1c10256ca8177ee4a5adad5e46a1dcab1cf2c8b9

SHA-256:
5d45c45b4071a1a512a96ab0f13ca00d81eab0c94c12763aad48fd8333e5892f

Scanner detections:
27 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
11/20/2018 3:10:48 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Generic.614201
1030

Agnitum Outpost
Adware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.TSULoader
14.04.10

Avira AntiVirus
Adware/Agent.aeph.1
7.11.142.138

avast!
Win32:InstalleRex-AB [PUP]
2014.9-140410

AVG
MalSign.Skodna.Bundle
2015.0.3508

Bitdefender
Adware.Generic.614201
1.0.20.500

Comodo Security
Application.Win32.InstalleRex.KG
18082

Dr.Web
Adware.Downware.1252
9.0.1.0100

Emsisoft Anti-Malware
Adware.Generic.614201
8.14.04.10.04

ESET NOD32
Win32/InstalleRex
8.9662

Fortinet FortiGate
Riskware/InstalleRex
4/10/2014

F-Secure
Adware.Generic.614201
11.2014-10-04_5

G Data
Adware.Generic.614201
14.4.24

K7 AntiVirus
Trojan
13.176.11721

Kaspersky
not-a-virus:AdWare.Win32.Agent
14.0.0.4037

Malwarebytes
PUP.Optional.Installex
v2014.04.10.04

McAfee
PUP-FHQ!E6526D54266B
5600.7164

MicroWorld eScan
Adware.Generic.614201
15.0.0.300

NANO AntiVirus
Riskware.Win32.Agent.crfilu
0.28.0.59048

Panda Antivirus
PUP/TSUploader
14.04.10.04

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Reason Heuristics
Adware.WebPick.Installer.N
14.8.8.0

Rising Antivirus
PE:PUF.InstallRex!1.9E4C
23.00.65.14408

Sophos
InstallRex
4.98

Vba32 AntiVirus
Downloader.AdLoad
3.12.26.0

VIPRE Antivirus
Installerex/WebPick
28194

File size:
303.5 KB (310,752 bytes)

Product version:
1.0.0.1

Copyright:
Copyright © 2012 StarApp

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Common path:
C:\users\{user}\downloads\0198295634.pdf.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
11/5/2012 2:00:00 AM

Valid to:
11/6/2013 1:59:59 AM

Subject:
CN=Nadav Kashtan, O=Nadav Kashtan, STREET=Bizron 38, L=Tel Aviv, S=center, PostalCode=67894, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00F861471B38887DE98076AFF491B1B1B3

File PE Metadata
Compilation timestamp:
3/12/2013 10:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:ZrVv6Y0JQBkQRl7174NpNUM+UHs+c5tGHIuJFL+7QfX7zBoVDCC/S7OSbdGD6qbp:ZrVv63yRl1uqM+gs+czGouJpfX6VDCCr

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9344

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file 0198295634.pdf.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

Remove 0198295634.pdf.exe - Powered by Reason Core Security