home

ccproxy.exe

installation process

SETUPPROCESS

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application ccproxy.exe, “Installer Manager” by SETUPPROCESS has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.
Publisher:
SetupProcess SL  (signed by SETUPPROCESS)

Product:
installation process

Description:
Installer Manager

Version:
1.0.1.40

MD5:
b51180a9354e4d5be649020c78f367bf

SHA-1:
289ba1ed876c93e0553a91cfbed87834d8f8522a

SHA-256:
3cfab55461a40d1101f8876de0f7385745200b2e5675089566f31f201188d02c

Scanner detections:
20 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/19/2024 9:12:24 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Downloader
7.1.1

Avira AntiVirus
APPL/Firseria.C
7.11.145.18

avast!
Win32:PUP-gen [PUP]
2014.9-140424

AVG
Luhe.Fiha
2015.0.3495

Comodo Security
Application.Win32.FirseriaInstaller.BCB
18158

Dr.Web
Trojan.DownLoader11.3675
9.0.1.0114

ESET NOD32
Win32/FirseriaInstaller (variant)
8.9715

Fortinet FortiGate
Adware/Firseria
4/24/2014

G Data
Win32.Application.Morstar
14.4.24

IKARUS anti.virus
not-a-virus:Downloader.Win32.Morstar
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.176.11861

Kaspersky
not-a-virus:Downloader.Win32.Morstar
14.0.0.3969

Malwarebytes
PUP.Optional.BundleInstaller.A
v2014.04.24.05

NANO AntiVirus
Trojan.Win32.Morstar.cthxhs
0.28.0.59492

Panda Antivirus
Trj/Genetic.gen
14.04.24.05

Qihoo 360 Security
Malware.QVM11.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.SETUPPROCESS.H
14.4.24.5

Sophos
Solimba Installer
4.98

Vba32 AntiVirus
Downloader.Morstar
3.12.26.0

VIPRE Antivirus
Trojan.Win32.Generic
28562

File size:
248.9 KB (254,832 bytes)

Product version:
3.0.28

Copyright:
copyright © 2014

Original file name:
installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Digital Signature
Signed by:
SETUPPROCESS

Authority:
DigiCert Inc

Valid from:
11/27/2013 1:00:00 AM

Valid to:
12/1/2014 1:00:00 PM

Subject:
CN=SETUPPROCESS, O=SETUPPROCESS, L=Badalona, S=Barcelona, C=ES

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0A8ABFC7C80D0C2F0A3A89CF6139A91D

File PE Metadata
Compilation timestamp:
1/27/2014 5:02:51 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:kM+rYpivc/oKDnY+ySrs9obojzhom2f/1zNa+MrTklQcTy7pIIg:Urw8oNZyVhV2H1Za+6TkLTy7pIIg

Entry address:
0x6F3B0

Entry point:
60, BE, 00, C0, 43, 00, 8D, BE, 00, 50, FC, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
208 KB (212,992 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to cdn.solimba.com  (95.211.6.35:80)

TCP (HTTP):
Connects to api.downloadmr.com  (95.211.39.161:80)

 
http://api.downloadmr.com/installer/12884232/launch

Remove ccproxy.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.