» angry birds provided through ads med network cpa.exe
Overview
Analysis
File Details

angry birds provided through ads med network cpa.exe

SuperInstall

LiveSoftAction

The program utilizes the Appscion Download and Install manager, an adware distribution bundler from SIEN SA. The setup program includes ad-supported toolbars and utilities. The application angry birds provided through ads med network cpa.exe by LiveSoftAction has been detected as adware by 29 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent.

File name:

Publisher:

Live Soft Action S.R.L. (signed by LiveSoftAction)

Product:

SuperInstall

Version:

8.50.4.1

MD5:

f4bce55aad8cf2f61d626ab9adbe05ba

SHA-1:

d76f84729a73b09f78c02e4fe18f80db69967c0d

SHA-256:

05a93019fd989f90e949c76095d49556c688f380493ab35f7d0c338b0c674f93

Scanner detections:

29 / 68

Status:

Adware

Explanation:

This is a modified installer that uses the Appscion to bundle adware.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/20/2024 2:04:24 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.KS

354

Agnitum Outpost

PUA.Downloader

7.1.1

Avira AntiVirus

APPL/Downloader.Gen4

7.11.189.36

AVG

Generic

2017.0.2832

Baidu Antivirus

PUA.Win32.GetNow

4.0.3.16215

Bitdefender

Application.Bundler.KS

1.0.20.230

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Trojan.Getnow-2

0.98/20259

Comodo Security

Application.Win32.SuperInstall.AR

20663

Dr.Web

Adware.Iminent.3

9.0.1.046

Emsisoft Anti-Malware

Application.Bundler.KS

8.16.02.15.05

ESET NOD32

Win32/GetNow.E potentially unwanted application

10.7.0.302.0

F-Prot

W32/S-c6da7cb1

v6.4.7.1.166

F-Secure

Riskware.Application.Bundler.KJ

11.2016-15-02_2

G Data

Win32.Adware.LiveSoft

16.2.25

IKARUS anti.virus

PUA.Getnow

t3scan.1.8.3.0

K7 AntiVirus

Unwanted-Program

13.186.14150

Kaspersky

not-a-virus:Downloader.Win32.Agent

14.0.0.656

Malwarebytes

PUP.Optional.LiveSoftAction

v2016.02.15.05

McAfee

Artemis!ADFD15CD1B1C

5600.6488

MicroWorld eScan

Application.Bundler.KS

17.0.0.138

NANO AntiVirus

Trojan.Win32.Symmi.djigay

0.28.6.63726

Panda Antivirus

Trj/Genetic.gen

16.02.15.05

Quick Heal

PUA.Livesoftac.Gen

2.16.14.00

Reason Heuristics

PUP.Sien.LiveSoftAction.Bundler (M)

16.2.15.17

Trend Micro House Call

Suspicious_GEN.F47V1123

7.2.46

Vba32 AntiVirus

Downloader.Agent

3.12.26.3

VIPRE Antivirus

Trojan.Win32.Generic

35170

Zillya! Antivirus

Downloader.Agent.Win32.230151

2.0.0.2017

File size:

682.4 KB (698,728 bytes)

Product version:

8.50.4.1

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

SIEN SuperInstall

Language:

English (United States)

Common path:

C:\users\{user}\downloads\angry birds provided through ads med network cpa.exe

Digital Signature

Signed by:

LiveSoftAction

Authority:

COMODO CA Limited

Valid from:

12/12/2013 7:00:00 PM

Valid to:

12/13/2014 6:59:59 PM

Subject:

CN=LiveSoftAction, O=LiveSoftAction, STREET="Str. Dionisie Lupu, Nr. 64-66, Et.", L=Bucharest, S=Bucharest, PostalCode=010458, C=RO

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

2CAFD284C3B4147AD3E7601989FCCF42

File PE Metadata

Compilation timestamp:

12/11/2014 10:27:40 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:AU1dmX5cl/FUpFCa276JPwVe+T9n0EnwXwAON40bYGvV34asMBUoFEprKsgCmsb4:AU1cGza27vVecznw7YVvV34asMB9WrK7

Entry address:

0x197E70

Entry point:

60, BE, 00, 60, 50, 00, 8D, BE, 00, B0, EF, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Entropy:

7.8947

Packer / compiler:

UPX 2.90LZMA

Code size:

588 KB (602,112 bytes)

Remove angry birds provided through ads med network cpa.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.