home

burn4free_setup.exe

Sakysoft s.r.l.

The application burn4free_setup.exe by Sakysoft s.r.l has been detected as a potentially unwanted program by 11 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs. The file has been seen being downloaded from directdownload2.burn4free.com and multiple other hosts.
Publisher:
Sakysoft s.r.l.  (signed and verified)

MD5:
5b405af773e638dc422ea8a724b295d0

SHA-1:
0ba345b8fb1f10561658fd23fac08610fa957c57

SHA-256:
aed9ac86c93e5c07c57ee6813d10925ffbb273185ca90d8ce88fdbd5c26f459a

Scanner detections:
11 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
4/26/2024 8:15:49 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.OutBrowse
7.1.1

Avira AntiVirus
APPL/Downloader.Gen
7.11.165.58

AVG
Generic
2015.0.3279

Dr.Web
Trojan.Packed.28387
9.0.1.0330

ESET NOD32
Win32/OutBrowse.AB
8.10204

McAfee
Artemis!5B405AF773E6
5600.6935

Reason Heuristics
PUP.Optional.Installer.P
14.11.26.10

Sophos
Generic PUA AL
4.98

Trend Micro House Call
Suspicious_GEN.F47V0718
7.2.330

Vba32 AntiVirus
Hoax.PornoAsset
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
31932

File size:
555.7 KB (569,072 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\burn4free_setup.exe

Digital Signature
Signed by:
Sakysoft s.r.l.

Authority:
COMODO CA Limited

Valid from:
6/29/2014 8:00:00 PM

Valid to:
6/30/2015 7:59:59 PM

Subject:
CN=Sakysoft s.r.l., O=Sakysoft s.r.l., STREET=Via Gorghi 6, L=Udine, S=Udine, PostalCode=33100, C=IT

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AC0378721652B1C1535A0BF60A34B3EE

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:VaEKNXVfL26Ox4bFBTlLioNdyz0Q+ciXq7E5Q9eSt3lbco9OoG:Vanx92wbB7/RXFQcSt3lbcow

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9759

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file burn4free_setup.exe has been seen being distributed by the following 2 URLs.

http://directdownload2.burn4free.com/burn4free_setup.exe

http://r.burn4free.com/burn4free-download.php

Remove burn4free_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.