» angry birds provided through ads med network cpa.exe
Overview
Analysis
File Details

angry birds provided through ads med network cpa.exe

SuperInstall

LiveSoftAction

The program utilizes the Appscion Download and Install manager, an adware distribution bundler from SIEN SA. The setup program includes ad-supported toolbars and utilities. The application angry birds provided through ads med network cpa.exe by LiveSoftAction has been detected as adware by 29 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent.

File name:

Publisher:

Live Soft Action S.R.L. (signed by LiveSoftAction)

Product:

SuperInstall

Version:

8.48.2.2

MD5:

b72d0a5266015acf99384096255ac382

SHA-1:

d1ff6500b0f9a0208fe4137f091fe72aeb8ceca8

SHA-256:

3c2923ec73decd4ad22dde38ae74771afd1639eadc20e0646ff5874f42527c91

Scanner detections:

29 / 68

Status:

Adware

Explanation:

This is a modified installer that uses the Appscion to bundle adware.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/25/2024 9:11:22 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.KS

356

Agnitum Outpost

PUA.Downloader

7.1.1

Avira AntiVirus

APPL/Downloader.Gen4

7.11.189.36

AVG

Generic

2017.0.2834

Baidu Antivirus

PUA.Win32.GetNow

4.0.3.16214

Bitdefender

Application.Bundler.KS

1.0.20.225

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Trojan.Getnow-2

0.98/20259

Comodo Security

Application.Win32.SuperInstall.AR

20663

Dr.Web

Adware.Iminent.3

9.0.1.045

Emsisoft Anti-Malware

Application.Bundler.KS

8.16.02.14.04

ESET NOD32

Win32/GetNow.E potentially unwanted application

10.7.0.302.0

F-Prot

W32/S-c6da7cb1

v6.4.7.1.166

F-Secure

Riskware.Application.Bundler.KJ

11.2016-14-02_1

G Data

Win32.Adware.LiveSoft

16.2.25

IKARUS anti.virus

PUA.Getnow

t3scan.1.8.3.0

K7 AntiVirus

Unwanted-Program

13.186.14150

Kaspersky

not-a-virus:Downloader.Win32.Agent

14.0.0.664

Malwarebytes

PUP.Optional.LiveSoftAction

v2016.02.14.04

McAfee

Artemis!ADFD15CD1B1C

5600.6490

MicroWorld eScan

Application.Bundler.KS

17.0.0.135

NANO AntiVirus

Trojan.Win32.Symmi.djigay

0.28.6.63726

Panda Antivirus

Trj/Genetic.gen

16.02.14.04

Quick Heal

PUA.Livesoftac.Gen

2.16.14.00

Reason Heuristics

PUP.Sien.LiveSoftAction.Bundler (M)

16.2.14.4

Trend Micro House Call

Suspicious_GEN.F47V1123

7.2.45

Vba32 AntiVirus

Downloader.Agent

3.12.26.3

VIPRE Antivirus

Trojan.Win32.Generic

35170

Zillya! Antivirus

Downloader.Agent.Win32.230151

2.0.0.2017

File size:

693.9 KB (710,504 bytes)

Product version:

8.48.2.2

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

SIEN SuperInstall

Language:

English (United States)

Common path:

C:\users\{user}\downloads\angry birds provided through ads med network cpa.exe

Digital Signature

Signed by:

LiveSoftAction

Authority:

COMODO CA Limited

Valid from:

12/13/2013 5:30:00 AM

Valid to:

12/14/2014 5:29:59 AM

Subject:

CN=LiveSoftAction, O=LiveSoftAction, STREET="Str. Dionisie Lupu, Nr. 64-66, Et.", L=Bucharest, S=Bucharest, PostalCode=010458, C=RO

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

2CAFD284C3B4147AD3E7601989FCCF42

File PE Metadata

Compilation timestamp:

11/25/2014 6:51:58 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:lTA566p+ZqQBHTm19agprQoJHXlvUgPCCUqOXvIHGgKLyvuyy90NL:lTA56JqQBzm19auZ0gKTImx0y2L

Entry address:

0x1A4C30

Entry point:

60, BE, 00, 00, 51, 00, 8D, BE, 00, 10, EF, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Entropy:

7.8969

Packer / compiler:

UPX 2.90LZMA

Code size:

596 KB (610,304 bytes)

Remove angry birds provided through ads med network cpa.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.