» 2f8.exe
Overview
Analysis
File Details
Downloads (1)

2f8.exe

Stepan Rybin

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application 2f8.exe by Stepan Rybin has been detected as adware by 27 anti-malware scanners. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. The file has been seen being downloaded from groupsetzipmyjob.org.

File name:

2f8.exe

Publisher:

Stepan Rybin (signed and verified)

MD5:

c840bae15f9a6c4dca38e22bd18697d5

SHA-1:

7e71e991a74dd80b2dcdc117ec3b1eb537540fa1

SHA-256:

414b6eb2d3e0a7d59ae54a74faa0b340e1e3aebf5208c32aca5af0abe64cdc40

Scanner detections:

27 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

4/18/2024 3:33:31 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.MPLug.GO

6397122

Agnitum Outpost

PUA.MultiPlug

7.1.1

AhnLab V3 Security

PUP/Win32.MultiPlug

2015.03.27

avast!

Win32:Dropper-gen [Drp]

150319-1

AVG

Adware Generic6.AACG

2014.0.4311

Bitdefender

Adware.MPLug.GO

1.0.20.425

Bkav FE

W32.HfsAdware

1.3.0.6379

Comodo Security

Application.Win32.MultiPlug.YTRA

21546

Dr.Web

Trojan.Crossrider1.22656

9.0.1.05190

Emsisoft Anti-Malware

Adware.MPLug.GO

9.0.0.4799

ESET NOD32

Win32/Adware.MultiPlug.GC (variant)

9.11381

Fortinet FortiGate

Riskware/MultiPlug

3/26/2015

F-Secure

Adware.MPLug.GO

5.13.68

G Data

Adware.MPLug.GO

15.3.25

herdProtect (fuzzy)

variant of full gl_ theme-vol3.rar(1).exe

2015.7.1.6

IKARUS anti.virus

AdWare.MultiPlug

t3scan.1.8.6.0

K7 AntiVirus

Unwanted-Program

13.202.15392

Kaspersky

not-a-virus:AdWare.Win32.MultiPlug

15.0.0.543

Malwarebytes

PUP.Optional.Bundler

v2015.03.26.11

McAfee

MultiPlug-FWZ

5600.6815

MicroWorld eScan

Adware.MPLug.GO

16.0.0.255

NANO AntiVirus

Riskware.Win32.MultiPlug.dpifir

0.30.8.659

nProtect

Adware.MPLug.GO

15.03.26.01

Reason Heuristics

PUP.WebPick

15.3.26.11

Rising Antivirus

PE:Malware.XPACK-HIE/Heur!1.9C48

23.00.65.15324

Sophos

MultiPlug

4.98

Vba32 AntiVirus

suspected of Heur.Malware-Cryptor.Multiplug

3.12.26.3

File size:

475.2 KB (486,600 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\ProgramData\{aeaf4de0-1546-3bc5-aeaf-f4de01543780}\2f8.exe

Digital Signature

Signed by:

Stepan Rybin

Authority:

Unizeto Technologies S.A.

Valid from:

6/27/2014 3:37:40 AM

Valid to:

6/27/2015 3:37:40 AM

Subject:

E=rybin.step@yandex.ru, CN=Stepan Rybin, O=Stepan Rybin, C=UA

Issuer:

CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:

47154C2151E9EB8DFA42C2C9E45BFC6C

File PE Metadata

Compilation timestamp:

12/25/2012 4:48:40 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

6144:ZLHg5Oc0jEQxjdFQ1oWHPlpJiFlQM8MOFTFwWd/wm+bQ90jNn6suo8mLx6cf7gM3:RHg5Oc0jEWjdioWvlpJijQEOJ64mT3

Entry address:

0x4615B

Entry point:

E8, CF, 1F, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, A0, 11, 45, 00, E8, DF, 24, 00, 00, E8, 9C, 21, 00, 00, 0F, B7, F0, 6A, 02, E8, 62, 1F, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 28, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8... 
[+]

Entropy:

6.4556

Code size:

301 KB (308,224 bytes)

The file 2f8.exe has been seen being distributed by the following URL.

http://groupsetzipmyjob.org/hp/?q=7fOtqohcBetuIKEG xn9CiHPdeXGMBKLE1acmL5p1Hc4pFUz37li1hlduHbHP 0qGlnmZsHPh66X2LVuTEfqtp GxPZllz1M3N3njmEDuzi9Rb7AqvFPGNkEfWn89xave7ln2FN/lpYzDKo8HvBjtZOZjc9UKxGMtUwF6v531IcJyo JPnGWjah21irmDf08Opg/.../nO7jNIY0FypgLFnNXwyLAITnv9lPCnPMgI5pqovmwZ8D&external_id=1426794113646641901

Remove 2f8.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.