» appbed0.exe
Overview
Analysis
File Details

appbed0.exe

Howard Software Ltd

The application appbed0.exe by Howard Software has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup.

File name:

appbed0.exe

Publisher:

iFreeTV (signed by Howard Software Ltd)

Product:

iFreeTV

Version:

1, 0, 0, 0

MD5:

a58387e82241cc6bcdda4b9e8fd4e75c

SHA-1:

c79b79d4492f6a076246b2d8f887b1eff6a7baed

SHA-256:

95526ff7318693dd88505f1a8cd354f6ea2cd528b540022bcdbbb2535c59b839

Scanner detections:

2 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallMonetizer distribution platform to bundle adware.

Analysis date:

4/25/2024 10:46:56 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/InstallMonetizer.AF

9.8201

Reason Heuristics

PUP.InstallMonetizer.Bundle (M)

16.3.10.15

File size:

1.9 MB (1,988,352 bytes)

Product version:

1.0.0.0

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\appbed0.exe

Digital Signature

Signed by:

Howard Software Ltd

Authority:

COMODO CA Limited

Valid from:

12/17/2012 8:00:00 AM

Valid to:

12/18/2014 7:59:59 AM

Subject:

CN=Howard Software Ltd, O=Howard Software Ltd, STREET=37 Fulwell road, STREET=fulwell, L=Sunderlanad, S=Tyne and Wear, PostalCode=SR60JE, C=GB

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00D026D6511554C7C2AE6DCDC88EA9B79C

File PE Metadata

Compilation timestamp:

6/20/1992 6:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:talY98fT3xbOXwf4arEYFlgkPeUDJ18IinXBgr:clY9oTrE4qkPeUfQRgr

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD... 
[+]

Entropy:

7.9941

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

Remove appbed0.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.