» appinstaller.exe
Overview
Analysis
File Details
Downloads (1)

appinstaller.exe

PortalProgramas

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application appinstaller.exe by PortalProgramas has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.downloadohdooshieyei.com.

File name:

appinstaller.exe

Publisher:

appinstaller (signed by PortalProgramas)

Description:

appinstaller

Version:

3.1.10.28

MD5:

518c8010ec0b53cbdf1fe50bf7972e49

SHA-1:

fe76886a55edddd80638be67b251b9f09470e8b3

SHA-256:

a8bd685cd4f7485453db51d0ffb9f2523496db8265553b05802ac3cb151d90e3

Scanner detections:

11 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/25/2024 4:45:28 AM UTC (today)

Scan engine

Detection

Engine version

AVG

BundleApp

2015.0.3494

ESET NOD32

Win32/FirseriaInstaller (variant)

8.9720

G Data

Win32.Application.Morstar

14.4.24

IKARUS anti.virus

not-a-virus:Downloader.Win32.Morstar

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.176.11873

Malwarebytes

PUP.Optional.Firseria

v2014.04.25.12

Panda Antivirus

PUP/MultiToolbar.A

14.04.25.12

Reason Heuristics

PUP.Installer.PortalProgramas.M

14.8.8.0

Sophos

Solimba Installer

4.98

Vba32 AntiVirus

Downware.Morstar

3.12.26.0

VIPRE Antivirus

DownloadMR

28590

File size:

503.6 KB (515,672 bytes)

Product version:

3.1.9

Original file name:

appinstaller.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\appinstaller.exe

Digital Signature

Signed by:

PortalProgramas

Authority:

COMODO CA Limited

Valid from:

1/2/2014 7:00:00 PM

Valid to:

1/3/2015 6:59:59 PM

Subject:

CN=PortalProgramas, OU=Tech, O=PortalProgramas, STREET="Balmes 1, primera planta", L=Terrassa, S=Barcelona, PostalCode=08225, C=ES

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00FD1E07CCAABD98839CDBE058C9F8B3E9

File PE Metadata

Compilation timestamp:

4/22/2014 11:36:09 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:guWnIFlU4rOaBlVRRt80zmltDHMctOq9PoFjdz5FkH7n3jvA20mf/aQ0NuR7CQwR:guU6OaOilVRvjOPzzDJa1NuJCQIoO5

Entry address:

0xEF74

Entry point:

E8, B2, 78, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 98, F4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 38, F1, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 74, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64... 
[+]

Entropy:

7.6446

Code size:

117 KB (119,808 bytes)

The file appinstaller.exe has been seen being distributed by the following URL.

http://dl.downloadohdooshieyei.com/n/3.0.30.9/.../Windows 7 SP1.exe

Remove appinstaller.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.