home

852b34e04281f5c29130a8e8430bc1735d201951e5211bc9a4f90c5605270484

Musiclab, LLC

The file 852b34e04281f5c29130a8e8430bc1735d201951e5211bc9a4f90c5605270484, “BearShare Installer” by Musiclab has been detected as a potentially unwanted program by 21 anti-malware scanners. The program is a setup application that uses the Wise Installer installer.
Publisher:
Free Peers, Inc.  (signed by Musiclab, LLC)

Description:
BearShare Installer

Version:
5.2.5.6PL

MD5:
56b94ddb36a7e33c19fc0bece31e5ff8

SHA-1:
a932b0afd5a8544d75368626a95eb3dbd2b2e7f2

SHA-256:
852b34e04281f5c29130a8e8430bc1735d201951e5211bc9a4f90c5605270484

Scanner detections:
21 / 68

Status:
Potentially unwanted

Explanation:
Bundles the Mindspark (MyWebSearch/Ask) toolbar, a web browser extension that will modify a user's search and home pages.

Analysis date:
5/9/2024 2:09:14 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.AdInstaller
7.1.1

AhnLab V3 Security
Win-Trojan/Agent2.M.3663208
2015.05.19

Avira AntiVirus
TR/Horse.HJO
8.3.1.6

Baidu Antivirus
Adware.Win32.Agent
4.0.3.1564

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.Funweb.102
9.0.1.0155

ESET NOD32
Win32/AdInstaller potentially unwanted (variant)
9.11648

Fortinet FortiGate
Riskware/MyWebSearch
6/4/2015

F-Prot
W32/Trojan4.GFO
v6.4.7.1.166

K7 AntiVirus
Trojan
13.204.15951

Kaspersky
not-a-virus:WebToolbar.Win32.MyWebSearch
14.0.0.1936

McAfee
Artemis!56B94DDB36A7
5600.6744

NANO AntiVirus
Riskware.Win32.MyWebSearch.dxcdi
0.30.24.1357

Norman
Suspicious_Gen2.PCSWI
11.20150604

nProtect
Trojan/W32.Agent.3663208
15.05.18.01

Panda Antivirus
Trj/CI.A
15.06.04.07

Reason Heuristics
PUP.Optional.Installer
15.6.4.19

Rising Antivirus
PE:Trojan.Win32.Generic.11EEBD87!300858759
23.00.65.15602

Trend Micro House Call
TROJ_GEN.R02SC0EC615
7.2.155

Trend Micro
TROJ_GEN.R02SC0EC615
10.465.04

ViRobot
Adware.AdMedia.3663208[h]
2014.3.20.0

File size:
3.5 MB (3,663,208 bytes)

Copyright:
Copyright (C) 2001 Free Peers, Inc.

Installer:
Wise Installer

Language:
English (United States)

Digital Signature
Signed by:
Musiclab, LLC

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
5/4/2006 2:00:00 AM

Valid to:
5/5/2007 1:59:59 AM

Subject:
CN="Musiclab, LLC", OU=Secure Application Development, O="Musiclab, LLC", L=New York, S=New York, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
0F1C545C6576957E6812260D1416A979

File PE Metadata
Compilation timestamp:
4/8/1999 10:24:47 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:gki7HJowHZeZj9PafgCNBg5ooKAqKW+4Gx9aAmE8+qXyImxZs9UjonH:bAHmwv1NBgqf8x9a0XnZs9UjoH

Entry address:
0x1000

Entry point:
55, 8B, EC, 81, EC, 78, 05, 00, 00, 53, 56, BE, 04, 01, 00, 00, 57, 8D, 85, 94, FD, FF, FF, 56, 33, DB, 50, 53, FF, 15, 34, 20, 40, 00, 8D, 85, 94, FD, FF, FF, 56, 50, 8D, 85, 94, FD, FF, FF, 50, FF, 15, 30, 20, 40, 00, 8B, 3D, 2C, 20, 40, 00, 53, 53, 6A, 03, 53, 6A, 01, 8D, 85, 94, FD, FF, FF, 68, 00, 00, 00, 80, 50, FF, D7, 83, F8, FF, 89, 45, FC, 0F, 84, 7B, 01, 00, 00, 8D, 85, 90, FC, FF, FF, 50, 56, FF, 15, 28, 20, 40, 00, 8D, 85, 98, FE, FF, FF, 50, 53, 8D, 85, 90, FC, FF, FF, 68, 10, 30, 40, 00, 50...
 
[+]

Entropy:
7.9988

Packer / compiler:
Wise Installer Stub

Code size:
512 Bytes (512 bytes)

The file 852b34e04281f5c29130a8e8430bc1735d201951e5211bc9a4f90c5605270484 has been seen being distributed by the following 2 URLs.

C:\Users\OEM\Downloads\BSINSTALLPL.exe

http://s10013.chomikuj.pl/File.aspx?e=TKdvs6CAmGYnp6IDHOM7mJuxpDkU5IG9IOZSVsr6srKC8MwsTTo3y4grs5zqM7r8OvlFB2MDGZBULDklAtteObsgoaxzWhgw7QO4myt6FymGZcoTH2IrcaaluVx-8iQK86c3AtiMxCHEuZ4LjPaVJthahPRBsGsp_sFs7u67agU&pv=2

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.