» autocad 2015.exe
Overview
Analysis
File Details
Downloads (3)
Network (2)

autocad 2015.exe

Apps Installer S.L.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application autocad 2015.exe by Apps Installer S.L has been detected as adware by 32 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.downloadiechahrixiew.com and multiple other hosts. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.

File name:

autocad 2015.exe

Publisher:

AppsInstall (signed by Apps Installer S.L.)

Description:

setupmanager

Version:

3.1.11.18

MD5:

e46f72aeeeddc3cdaf31e2553ec4c499

SHA-1:

e1c4e1e9d376fe310f2e97372f97ce89322b7723

SHA-256:

195df79d471f46e89d6dc16d7f23472d998eb033d73e1fcec8bc6d65007b6c1d

Scanner detections:

32 / 68

Status:

Adware

Explanation:

This is a wrapped installation of legitimate software (without persmission of the developer) and bundles adware such as toolbars and extensions.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/20/2024 12:19:13 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.Fireseria.1

6217456

Agnitum Outpost

PUA.Firseria

7.1.1

AhnLab V3 Security

PUP/Win32.FirseriaInstaller

2015.04.08

avast!

Win32:Solimba-C [PUP]

2014.9-150407

AVG

Adware BundleApp

2016.0.3146

Bitdefender

Gen:Variant.Application.Bundler.Fireseria.1

1.0.20.485

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Adware.Fiseria

0.98/21511

Comodo Security

Application.Win32.Firseria.CJL

21681

Dr.Web

Trojan.DownLoader11.4341

9.0.1.097

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.Fireseria

9.0.0.4799

ESET NOD32

Win32/FirseriaInstaller.H potentially unwanted application

9.7.0.302.0

Fortinet FortiGate

Riskware/Generic.AC.1794300

4/7/2015

F-Prot

W32/A-96118aad

v6.4.7.1.166

F-Secure

Riskware.Gen:Variant.Application.Bundler

5.13.68

G Data

Win32.Application.Morstar

15.4.24

herdProtect (fuzzy)

variant of directx 90c.exe (Adware)

2015.7.10.22

IKARUS anti.virus

PUA.Morstar

t3scan.1.8.9.0

K7 AntiVirus

Unwanted-Program

13.202.15513

Kaspersky

not-a-virus:AdWare.Win32.Fiseria

15.0.0.543

Malwarebytes

PUP.Optional.Firseria

v2015.04.07.04

MicroWorld eScan

Gen:Variant.Application.Bundler.Fireseria.1

16.0.0.291

NANO AntiVirus

Trojan.Win32.DownLoader11.czvwwp

0.30.10.952

nProtect

Trojan-Clicker/W32.Fiseria.502248

15.04.07.01

Panda Antivirus

Trj/Genetic.gen

15.04.07.04

Quick Heal

PUA.Firseria.DC5

4.15.14.00

Reason Heuristics

PUP.Bundler.Solimba

15.4.7.12

Rising Antivirus

PE:Malware.FirseriaInstaller!6.19E3

23.00.65.15405

Sophos

PUA 'Solimba Installer'

5.12

Vba32 AntiVirus

Downware.Morstar

3.12.26.0

VIPRE Antivirus

Threat.4782980

29732

Zillya! Antivirus

Adware.Fiseria.Win32.9

2.0.0.2129

File size:

490.5 KB (502,248 bytes)

Product version:

3.1.15

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Common path:

C:\users\{user}\downloads\autocad 2015.exe

Digital Signature

Signed by:

Apps Installer S.L.

Authority:

Thawte, Inc.

Valid from:

2/18/2013 7:00:00 PM

Valid to:

2/19/2015 6:59:59 PM

Subject:

CN=Apps Installer S.L., O=Apps Installer S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

323F44D66AEF890F43C32CFD743A4AD0

File PE Metadata

Compilation timestamp:

5/28/2014 5:19:04 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:KHJj3R/vGJl1xLdNb9l+FfeHO9HfxuvCMF:KHx3R/voDpQCc2ZF

Entry address:

0xE7EA

Entry point:

E8, 7C, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 60, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 10, E1, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64... 
[+]

Code size:

115.5 KB (118,272 bytes)

The file autocad 2015.exe has been seen being distributed by the following 3 URLs.

http://dl.downloadiechahrixiew.com/n/3.1.11.18/.../AutoCAD 2015.exe

http://dl.downloadiechahrixiew.com/n/.../AutoCAD 2015.exe

http://www.hispazone.com/lanzador.asp?v=2631

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to cdn.solimba.com (95.211.6.35:80)

TCP (HTTP):

Connects to api.downloadmr.com (95.211.39.161:80)

http://api.downloadmr.com/installer/59895402/launch

Remove autocad 2015.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.