home

crack and setup.exe

Stepan Rybin

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application crack and setup.exe by Stepan Rybin has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
Stepan Rybin  (signed and verified)

MD5:
bc11fb36710c7c0453d1818266c4037f

SHA-1:
2adb159128d5a48239fb82c1f8b4c897f0011049

SHA-256:
ca4c98ca3d0066b01d91251a40e70f9fdda9267cd289bb1de9533e45a59f5732

Scanner detections:
22 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
5/23/2024 10:23:07 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.7658
6395973

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.02.13

Avira AntiVirus
Adware/MPlug.tros
7.11.210.6

avast!
Win32:InstalleRex-CH [PUP]
2014.9-150215

AVG
Generic
2016.0.3200

Bitdefender
Gen:Variant.Adware.Mikey.7658
1.0.20.220

Bkav FE
W32.HfsAdware
1.3.0.6379

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.7658
9.0.0.4799

ESET NOD32
Win32/Adware.MultiPlug.ES application
7.0.302.0

F-Prot
W32/S-b1f91337
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Mikey.7658
5.13.68

G Data
Gen:Variant.Adware.Mikey.7658
15.2.25

K7 AntiVirus
Unwanted-Program
13.194.14961

Kaspersky
not-a-virus:AdWare.Win32.MultiPlug
14.0.0.2483

McAfee
Multiplug-FVQ
5600.6856

MicroWorld eScan
Gen:Variant.Adware.Mikey.7658
16.0.0.132

Panda Antivirus
PUP/TSUploader
15.02.15.11

Reason Heuristics
PUP.Installer.WebPick
15.2.13.4

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.15211

Sophos
MultiPlug
4.98

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug
3.12.26.3

VIPRE Antivirus
Threat.4786450
36694

File size:
1.1 MB (1,114,824 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
WebPick InstalleRex

Common path:
C:\ProgramData\{c2e3a553-1935-52d9-c2e3-3a553193954c}\crack and setup.exe

Digital Signature
Signed by:
Stepan Rybin

Authority:
Unizeto Technologies S.A.

Valid from:
6/27/2014 10:37:40 AM

Valid to:
6/27/2015 10:37:40 AM

Subject:
E=rybin.step@yandex.ru, CN=Stepan Rybin, O=Stepan Rybin, C=UA

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
47154C2151E9EB8DFA42C2C9E45BFC6C

File PE Metadata
Compilation timestamp:
4/15/2013 12:56:28 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:4qWP4wJwz9zAWbAB2a8jME4kmUsGEVBM5CrfPmF4ZXe:4qx3a2L7kUsGgMTSZu

Entry address:
0xB51F9

Entry point:
E8, FE, 13, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 90, B3, 4F, 00, E8, 11, 19, 00, 00, E8, CB, 15, 00, 00, 0F, B7, F0, 6A, 02, E8, 91, 13, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 40, 03, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
745 KB (762,880 bytes)

The file crack and setup.exe has been seen being distributed by the following URL.

http://profficer.org/hp/?q=BcfMQLmjeBcdxpnikgevJHPmEGAKdW1 q7Tja4Bq1TntVh7MAKIykmmTpYm80f/ShbrxEH7XH9Bvv59kwvjoY2LMwObbERikkvbfBVVHFH3w3q 3wm62K5RYSaBo7JiaZ526kXvIBtdofqFab ElslzeeamQFQ6O8DfCKQ1lK4u19dAAx1cOI0ktkUz aVBZfyJlYkdz8obHRHBhcyH7eFr3gKrPOo031SwApXpZ7P06w0weJ wCHP0D0PxIdAM Dhfdb9qSBjCYAxa/y/.../gG2nuj77PQpGhPXb7swgu1EeV2G&external_id=1423815785720746837

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

Remove crack and setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.