» converted file.exe
Overview
Analysis
File Details
Network (1)

converted file.exe

Itzhak Shternberg

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application converted file.exe, “Installer for Wideblue installer” by Itzhak Shternberg has been detected as adware by 25 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

converted file.exe

Publisher:

Wideblue installer (signed by Itzhak Shternberg)

Product:

Wideblue installer

Description:

Installer for Wideblue installer

Version:

2014.6.29.1256

MD5:

13991e2ec8f65d9540e3f83b49269671

SHA-1:

25553fb83c485e3f0dc41ccf60ac12d8222c9709

SHA-256:

838e5a85fe197c0035d65530cf6079c79b7ed1247e12e7d86d37a28309e0ee5f

Scanner detections:

25 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/24/2024 7:43:13 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Trojan.AntiFW

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2014.07.23

Avira AntiVirus

TR/Kazy.359236.22

7.11.158.174

avast!

Win32:InstalleRex-CG [PUP]

140617-1

AVG

Generic

2015.0.3405

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.4959

Clam AntiVirus

Win.Trojan.Installerex-96

0.98/19185

Comodo Security

Application.Win32.InstalleRex.KG

18788

Dr.Web

Trojan.WebPick.2735

9.0.1.05190

ESET NOD32

Win32/InstalleRex.M potentially unwanted application

7.0.302.0

G Data

Win32.Application.InstalleRex

14.7.24

IKARUS anti.virus

PUA.BInstaller

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.181.12806

Kaspersky

Trojan.Win32.AntiFW

15.0.0.494

Malwarebytes

PUP.Optional.InstalleRex

v2014.07.22.01

McAfee

PUP-FHQ

5600.7061

NANO AntiVirus

Riskware.Win32.InfoLeak.cvgqot

0.28.0.60577

Panda Antivirus

PUP/TSUploader

14.07.22.01

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

7.14.14.00

Reason Heuristics

Adware.WebPick.Installer.O

14.7.22.13

Sophos

InstallRex

4.98

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4150696

29708

Zillya! Antivirus

Trojan.AntiFW.Win32.388

2.0.0.1846

File size:

326.7 KB (334,560 bytes)

Product version:

1.0.0.3

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\converted file.exe

Digital Signature

Signed by:

Itzhak Shternberg

Authority:

COMODO CA Limited

Valid from:

7/17/2013 2:00:00 PM

Valid to:

7/18/2014 1:59:59 PM

Subject:

CN=Itzhak Shternberg, O=Itzhak Shternberg, STREET=Belkind 2, L=Tel Aviv, S=Tel Aviv, PostalCode=62154, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

54990006BE4A0F29ECCD7EE2F93DC0FC

File PE Metadata

Compilation timestamp:

3/11/2013 10:51:45 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:brabUzkuvcBYC47l2xbTL0VugX71xDiD+dS3A0LysdI258R:brDkuveY3e0trLuDRwge25C

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9283

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove converted file.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.