asus p4p800 user guide provided through pdfretriever.com.exe

Interactive Install

LiveSoftAction

The program utilizes the Appscion Download and Install manager, an adware distribution bundler from SIEN SA. The setup program includes ad-supported toolbars and utilities. The application asus p4p800 user guide provided through pdfretriever.com.exe by LiveSoftAction has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer.
Publisher:
Live Soft Action S.R.L.  (signed by LiveSoftAction)

Product:
Interactive Install

Version:
1.0.11.0

MD5:
e4140d78f4a65b8a56c68e90463aea91

SHA-1:
c2f5fee2f816bfeb4c92c1e5bd12d87f2228a393

SHA-256:
c768059ad4dc2af423c85f11b18b4cba25ee98defaa6b19a543d7faa79824ea1

Scanner detections:
6 / 68

Status:
Adware

Explanation:
This is a modified installer that uses the Appscion to bundle adware.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/4/2016 7:23:21 AM UTC  (today)

Scan engine
Detection
Engine version

Antiy Labs AVL
Trojan/Win32.TSGeneric
1.0.0.1

Dr.Web
Adware.Downware.4421
9.0.1.05190

ESET NOD32
Win32/GetNow.B potentially unwanted application
7.0.302.0

Malwarebytes
PUP.Optional.GetNow
v2014.06.10.10

Reason Heuristics
PUP.Installer.LiveSoftAction.x
14.6.10.10

VIPRE Antivirus
Threat.4794174
30086

File size:
714.2 KB (731,304 bytes)

Product version:
1.0.11.0

Copyright:
(c) Live Soft Action S.R.L. All rights reserved.

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SIEN SuperInstall

Language:
English (United States)

Common path:
C:\users\{user}\downloads\asus p4p800 user guide provided through pdfretriever.com.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
6/5/2012 2:00:00 AM

Valid to:
6/6/2014 1:59:59 AM

Subject:
CN=LiveSoftAction, OU=SienAppNetwork, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=LiveSoftAction, L=Bucharest, S=functiune, C=RO

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
17E4CA22DB0D2CFD73BAACB9BD605BF7

File PE Metadata
Compilation timestamp:
5/27/2014 1:47:52 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:PIuh1l2rO0wmbjnBi/WWkU60W2f/Krdd8jZ+zHGUIyBuwH6B1aAgMy90Z+:QuJ21jnA/8UdCrv8jZ+LSwH6B1JryS+

Entry address:
0x1A7E00

Entry point:
60, BE, 00, E0, 50, 00, 8D, BE, 00, 30, EF, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.9009

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
620 KB (634,880 bytes)