» cccam soft.txt.exe
Overview
Analysis
File Details
Downloads (1)
Network (1)

cccam soft.txt.exe

Stas Kosmov

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application cccam soft.txt.exe, “Installer for Application fields Software” by Stas Kosmov has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

cccam soft.txt.exe

Publisher:

Application fields Software (signed by Stas Kosmov)

Product:

Application fields Software

Description:

Installer for Application fields Software

Version:

2014.6.2.1205

MD5:

ab53be16b13268eb37f7a151b37722a8

SHA-1:

48bd4968c4c18ee9d1f1a7d993b163d35c7cce8f

SHA-256:

163e52f722a990e8f0884c9bf26d3e147e625584c04ba3f5defc55a068781f90

Scanner detections:

33 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/24/2024 9:14:53 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.11464298

6435848

Agnitum Outpost

Trojan.AntiFW

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2015.02.09

Avira AntiVirus

TR/Visucius.20

7.11.208.184

avast!

Win32:InstalleRex-DT [PUP]

150203-1

AVG

Generic

2016.0.3205

Bitdefender

Trojan.Generic.11464298

1.0.20.195

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.6379

Clam AntiVirus

Win.Trojan.Installerex-2

0.98/20045

Comodo Security

Application.Win32.InstalleRex.KG

21008

Dr.Web

Trojan.WebPick.2627

9.0.1.05190

Emsisoft Anti-Malware

Trojan.Generic.11464298

9.0.0.4799

ESET NOD32

Win32/InstalleRex.M potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/Generic.AC.4161048

2/8/2015

F-Prot

W32/InstallRex.B

4.6.5.141

F-Secure

Trojan.Generic.11464298

5.13.68

G Data

Trojan.Generic.11464298

15.2.25

K7 AntiVirus

Unwanted-Program

13.193.14899

Kaspersky

Trojan.Win32.AntiFW

15.0.0.543

Malwarebytes

PUP.Optional.InstalleRex

v2015.02.08.11

McAfee

Program.PUP-FHQ

16.8.708.2

MicroWorld eScan

Trojan.Generic.11464298

16.0.0.117

NANO AntiVirus

Riskware.Win32.InfoLeak.cvgqot

0.30.0.65070

Norman

Trojan.Generic.11464298

02.01.2015 13:58:24

nProtect

Trojan/W32.AntiFW.322600

15.02.06.01

Panda Antivirus

PUP/TSUploader

15.02.08.11

Quick Heal

Trojan.AntiFW.A5

2.15.14.00

Reason Heuristics

Adware.WebPick.Installer

15.2.8.11

Rising Antivirus

PE:Trojan.DL.Win32.AntiFW.a!1075355932

23.00.65.15206

Sophos

PUA 'InstallRex'

5.09

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4150696

37240

Zillya! Antivirus

Trojan.AntiFW.Win32.250

2.0.0.2057

File size:

315 KB (322,600 bytes)

Product version:

1.0.0.3

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\cccam soft.txt.exe

Digital Signature

Signed by:

Stas Kosmov

Authority:

COMODO CA Limited

Valid from:

9/24/2013 1:00:00 AM

Valid to:

9/25/2014 12:59:59 AM

Subject:

CN=Stas Kosmov, O=Stas Kosmov, STREET=Levitana 21, L=Kiev, S=Kiev, PostalCode=03083, C=UA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

7A2834207C5588F506D3CF09661E12F2

File PE Metadata

Compilation timestamp:

3/12/2013 8:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:ZrYbUzkuvcBYC47l2xSHyxdphxUIdRyZBBMX9v9y8DBM3i:ZrdkuveY354dH3diBMX9v9N9

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file cccam soft.txt.exe has been seen being distributed by the following URL.

http://applicationgrabb.net/.../cccam soft.txt.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove cccam soft.txt.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.