home

born to die.exe

Anton Melnikov

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application born to die.exe, “Installer for TopApp software” by Anton Melnikov has been detected as adware by 32 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
TopApp software  (signed by Anton Melnikov)

Product:
TopApp software

Description:
Installer for TopApp software

Version:
2014.5.23.1127

MD5:
13e6bcd6bdc9ee9162dea4ae08ec21b7

SHA-1:
7c3a58e4e7a3898b23e6f22f969a47340c29281a

SHA-256:
8d3e2dba5eefd8008c7367411ffa1a519d54f0afae55e8e5937a31b2f3b22061

Scanner detections:
32 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
4/24/2024 7:24:05 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.11475800
6383201

Agnitum Outpost
Trojan.AntiFW
7.1.1

AhnLab V3 Security
PUP/Win32.TSULoader
2015.02.16

Avira AntiVirus
TR/AntiFW.b.109
7.11.210.104

avast!
Win32:InstalleRex-DT [PUP]
150101-1

AVG
Generic
2016.0.3197

Bitdefender
Trojan.Generic.11475800
1.0.20.235

Bkav FE
W32.FamVT.AntiFWK.Trojan
1.3.0.6379

Comodo Security
Application.Win32.InstalleRex.KG
21095

Dr.Web
Threat.Undefined
9.0.1.05190

Emsisoft Anti-Malware
Trojan.Generic.11475800
9.0.0.4799

ESET NOD32
Win32/InstalleRex.M potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Generic.AC.4161048
2/16/2015

F-Prot
W32/InstallRex.B
4.6.5.141

F-Secure
Trojan.Generic.11475800
5.13.68

G Data
Trojan.Generic.11475800
15.2.25

K7 AntiVirus
Unwanted-Program
13.194.14970

Kaspersky
Trojan.Win32.AntiFW
14.0.0.2480

Malwarebytes
PUP.Optional.InstalleRex
v2015.02.16.01

McAfee
Program.PUP-FHQ
16.8.708.2

MicroWorld eScan
Trojan.Generic.11475800
16.0.0.141

NANO AntiVirus
Riskware.Win32.InfoLeak.cvgqot
0.30.0.65070

Norman
Trojan.Generic.11475800
03.12.2014 13:20:04

nProtect
Trojan/W32.AntiFW.323760
15.02.13.01

Panda Antivirus
PUP/TSUploader
15.02.16.01

Quick Heal
Trojan.AntiFW.A5
2.15.14.00

Reason Heuristics
Adware.WebPick.Installer
15.2.16.1

Rising Antivirus
PE:Trojan.DL.Win32.AntiFW.a!1075355932
23.00.65.15214

Sophos
PUA 'InstallRex'
5.10

Vba32 AntiVirus
Downware.TSU
3.12.26.3

VIPRE Antivirus
Threat.4150696
36694

Zillya! Antivirus
Trojan.AntiFW.Win32.215
2.0.0.2068

File size:
316.2 KB (323,760 bytes)

Product version:
1.0.0.3

Copyright:
Copyright © 2014 TopApp software

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\born to die.exe

Digital Signature
Signed by:
Anton Melnikov

Authority:
COMODO CA Limited

Valid from:
8/27/2013 10:00:00 AM

Valid to:
8/28/2014 9:59:59 AM

Subject:
CN=Anton Melnikov, O=Anton Melnikov, STREET=Borshagovskaya 117, L=Kiev, S=Kiev, PostalCode=03058, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
008EFE75FFE332B06C663189A317121232

File PE Metadata
Compilation timestamp:
3/12/2013 6:51:45 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:urYbUzkuvcBYC47l2xLnvhueEZdkKQ3+7Oj7hTOVA1HWZP:urdkuveY3CvI5Zdkj6OEu1HSP

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9537

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

Remove born to die.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.