home

curriculum-vitae-europeo.exe

Sifufi

The application curriculum-vitae-europeo.exe, “Sifufi Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Sifufi

Description:
Sifufi Setup

MD5:
c3e7f67ad79255f0b438e60ad53af84d

SHA-1:
877e75dfda059fb44b07d6319212a1f787ecd15c

SHA-256:
d1ed2179420bddfcd7d68f34ee9ab07454a305b8709d1bd82b0b575d3982d259

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
5/13/2024 9:57:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.4.17.19

File size:
1015 KB (1,039,374 bytes)

Product version:
1.0.3

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\curriculum-vitae-europeo.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:hqd75mBnxbenL3iNNY+wNg1Z/MlJM8eHMt/lR8ybNSoGD3EIGAI7C4Welt:hUIBnxenLyMji1ZUlOzQRmoGQAIBt

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file curriculum-vitae-europeo.exe has been seen being distributed by the following 5 URLs.

http://www.nowapplicationgift.com/c?x=T071f27mE6dO7WqN7HS2QnnDesapqDiSt2YqMzqVXu4=&c=cZjOoUGhH/9DaMgsZPqS8/VYKUIoLIIWdcUBoLCa pCFCizaDxbWXlYBtME4MkDwR5EhXUf4sD5WHuf3qh8hIsUtMNFR8xtJC1Ytxv4Y9 /zjmxo6lLGpC7syKYORQH/o4zCKheyqDVnufvS3wkq6YkdxCeH 0m/ed42 GIdS0VlXQMgoX9ksD5Eib3XFWX6&e=0&fallback_url=https://secure.inndl.com/.../curriculum-vitae-europeo.doc?st=1xbPg81Wv-zrfC18UPOGOg&e=1461074436&downloadAs=curriculum-vitae-europeo.exe

http://www.nowapplicationgift.com/c?x=rWmhtAsUSvFY4zBfVeNShyM45LFknD9yoi9fpgaXPqA=&c= uU52gduDt4FcCWtRYlVRgZLlTL1UnPrXZXwdPH1 O7s3ZFnyDIJMXopgfd7BjS gDH/0Zs SDBgsysDorMQadgp0Y33AXS0bM8xErGehRtA3K5PTC8CRYAycMQUT/HcjxV/rfVfD5agwbK3EuhSmaQhqOSMzsPG/goKLIhoJwPrOGUgScMyp5U 4iCB61fC&e=0&fallback_url=https://secure.inndl.com/.../curriculum-vitae-europeo.doc?st=vucPnJYdlDRPJEu8zEwSyg&e=1460813526&downloadAs=curriculum-vitae-europeo.exe

http://www.nowapplicationgift.com/c?x=5csTT24srZLKuJwDzK98V6cWvWO/AEJdqI6TVSeDsqE=&c=rA9LXR5jxkO7mQ6L24ZVEosh46vf8BuUzYAl5Yj4vAVVLle6Tu2TC42RnjCnOmbsQs3SfjexdSXHOMOih1fuYPBe6/CsFIn5D0UMoBvQwzLr BYSODKfIFUF/v/clN8iUKcljHMynbAVWVqAcp1R2cM90hs8toulXyFA1dR uVVxuknPxDRP854g1KnDuyvj&e=0&fallback_url=https://secure.inndl.com/.../curriculum-vitae-europeo.doc?st=SDfPL3xfFoSTkeQ70Bm8bg&e=1461108034&downloadAs=curriculum-vitae-europeo.exe

http://www.nowapplicationgift.com/c?x=VC Hv/kHzZcM3z5yD/jtFlEPfMKD8LzV2gg/ikUvB2k=&c= QvdQZIwfiezpJl7NaIEV4f9IIOft0IDy700x6tBly PwTA/ IMPYrsSVW3Ca1JwHNWUtNBI7LfeOhLqrLZhnRWdFd81shUZP1lqfoDvXTaSrgTL3QLLprub 56wZziKUX5UI4zJnfJJkHX85AP32tJSjJAZya1/at0mGOt 7/sh3 vQK6RxA9jTNe7D8KVe&e=0&fallback_url=https://secure.inndl.com/.../curriculum-vitae-europeo.doc?st=4KT9HI62BLrVQXrH5CkYng&e=1460918092&downloadAs=curriculum-vitae-europeo.exe

http://www.nowapplicationgift.com/c?x=nKQw3B 00OEVq/6BVg T0RlHluZWFJCBStgi6UD5vBc=&c=lh9FNh9BuDxQ8/UnHYQ7MjgggcDSVtVgFrh3ODoqKBZmuTyiPjqgkPWr1nyKz2v2MwS1vBQ70lFyGYXQLgkwtuIwTFA1XcvRljIFXzwmaE91KSnL/buvPg6FyPg98Iq5UmTKOoqBXMHDVtYf4OqgOw2V4FXQtyWuchXjjgA/fPRtPV/zEzmBx00EhB6ZRxJL&e=0&fallback_url=https://secure.inndl.com/.../curriculum-vitae-europeo.doc?st=oeYLkT4WWLbG089hOlyb8g&e=1460757175&downloadAs=curriculum-vitae-europeo.exe

Remove curriculum-vitae-europeo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.