» codec-v.exe
Overview
Analysis
File Details
Downloads (1)
Network (2)

codec-v.exe

Setup

Artua Vladislav

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application codec-v.exe by Artua Vladislav has been detected as adware by 30 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The file has been seen being downloaded from www.storagenl.info. While running, it connects to the Internet address r1.stylezip.info on port 80 using the HTTP protocol.

File name:

codec-v.exe

Publisher:

Premium (signed by Artua Vladislav)

Product:

Setup

Description:

Installer

Version:

2012.6.10.1911

MD5:

a17465f1f03f876bf589d5f7352b4893

SHA-1:

0ea5cdbf93b23c5e9b1f2ecb6d1b36dc1cbc9d4b

SHA-256:

0a4c4c617563296a9f2d962f55e6cf9bd852f6b8220888c8a7b8bd8b6edb0331

Scanner detections:

30 / 68

Status:

Adware

Explanation:

Uses Web-Pick's 'File Product', an Installer which wraps various products and downloads and installs it silently through the process, hosted on TusFiles.

Analysis date:

4/27/2024 3:39:30 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Generic.376680

852

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

14.10.06

Avira AntiVirus

TR/Rogue.10238907

7.11.141.68

avast!

Win32:InstallMate-CJ [PUP]

141003-0

AVG

Adware AdInstaller.PremiumInstaller

2015.0.3330

Bitdefender

Adware.Generic.376680

1.0.20.1395

Bkav FE

HW32.CDB

1.3.0.4959

Clam AntiVirus

Win.Adware.Downware-591

0.98/19360

Comodo Security

Application.Win32.Bundledz.C

18047

Dr.Web

hacktool program Tool.InstallToolbar.87

9.0.1.05190

Emsisoft Anti-Malware

Adware.Generic.376680

8.14.10.06.09

ESET NOD32

Win32/InstallMate.A potentially unwanted application

7.0.302.0

F-Secure

Adware.Generic.376680

11.2014-06-10_2

G Data

Adware.Generic.376680

14.10.24

IKARUS anti.virus

AdWare.Allpremiumsoft

t3scan.1.6.1.0

K7 AntiVirus

Adware

13.183.13358

Malwarebytes

PUP.Optional.InstallRex

v2014.10.06.09

MicroWorld eScan

Adware.Generic.376680

15.0.0.837

NANO AntiVirus

Riskware.Win32.Downware.cvbqqp

0.28.0.58873

nProtect

Trojan.Generic.8750467

14.05.16.01

Panda Antivirus

PUP/TSUploader

14.10.06.09

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.ArtuaVladislav.H

14.10.6.8

Rising Antivirus

PE:PUF.InstallRex!1.9E4C

23.00.65.141004

Sophos

InstallRex

4.98

SUPERAntiSpyware

Adware.InstallMate

10316

Trend Micro House Call

HV_INSTALLEREX_CI0534C4.RDXN

7.2.279

Vba32 AntiVirus

Downloader.AdLoad

3.12.26.0

VIPRE Antivirus

Installerex/WebPick

28026

File size:

270.8 KB (277,304 bytes)

Product version:

1.0

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\codec-v.exe

Digital Signature

Signed by:

Artua Vladislav

Authority:

COMODO CA Limited

Valid from:

2/21/2012 7:00:00 PM

Valid to:

2/21/2013 6:59:59 PM

Subject:

CN=Artua Vladislav, O=Artua Vladislav, STREET=HaRav Dangur 22, L=Bnei Braq, S=Israel, PostalCode=51282, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

2E891F383001DD159332A0D089F55CE3

File PE Metadata

Compilation timestamp:

5/31/2012 5:22:02 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:nBPq2ppX2eV8UsM3yrdz4hdNJZPh04mjMTrTb3r8X5Tpm:nBi2PX2UaZyZZSj+wX5Tpm

Entry address:

0x14A3

Entry point:

55, 8B, EC, 81, EC, 24, 06, 00, 00, 53, 56, 33, F6, 57, 66, 89, B5, E4, FB, FF, FF, 89, 75, F4, 89, 75, FC, FF, 15, 68, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 64, 30, 40, 00, 89, 45, F8, 68, 04, 01, 00, 00, 8D, 85, DC, F9, FF, FF, 50, 56, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, BC, 32, 40, 00, E8, 82, FB, FF, FF, 59, C7, 05, 0C, 44, 40, 00, FD, 00, 00, 00, E9, 13, 02, 00, 00, 50, 68, 98, 32, 40, 00, E8, 67, FB, FF, FF, 59, 59, C7, 05, 0C, 44, 40, 00, FF, 00... 
[+]

Entropy:

7.9536

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file codec-v.exe has been seen being distributed by the following URL.

http://www.storagenl.info/v58/?reffer=http://.../wu5p7bjtgmou

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

TCP (HTTP):

Connects to c1.stylezip.info (54.186.255.26:80)

http://c1.stylezip.info/?step_id=1&installer_id=11490770&publisher_id=149&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=34472310&external_id=0&session_id=68944620&hardware_id=80435390&installer_file_name=codec-v

Remove codec-v.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.