» diseno-cocinas-3d.exe
Overview
Analysis
File Details
Downloads (1)
Network (1)

diseno-cocinas-3d.exe

Stanislav Kabin

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application diseno-cocinas-3d.exe, “Installer for FreshApp installer” by Stanislav Kabin has been detected as adware by 37 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

FreshApp installer (signed by Stanislav Kabin)

Product:

FreshApp installer

Description:

Installer for FreshApp installer

Version:

2014.7.31.1602

MD5:

9c85353b7cd9b868d239624cef354e49

SHA-1:

d983995570ff2a1c7648b870ae8a288e9974d2fc

SHA-256:

8eee498ff5004693ce6bbe46647c2824b8151010ae22642bce2a691d4d944583

Scanner detections:

37 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/20/2024 5:14:29 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Kazy.324119

787

Agnitum Outpost

PUA.Downloader

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

14.09.28

Avira AntiVirus

Adware/MultiPlug.aoa

7.11.164.242

avast!

Win32:InstalleRex-CK [PUP]

2014.9-140928

AVG

Generic

2015.0.3337

Bitdefender

Gen:Variant.Kazy.324119

1.0.20.1720

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.4959

Clam AntiVirus

Win.Trojan.Installerex-1

0.98/19086

Comodo Security

Application.Win32.InstalleRex.KG

19049

Dr.Web

Trojan.WebPick.2759

9.0.1.0271

Emsisoft Anti-Malware

Gen:Variant.Kazy.324119

8.14.12.10.01

ESET NOD32

Win32/InstalleRex.M potentially unwanted application

8.7.0.302.0

Fortinet FortiGate

Riskware/InstalleRex

12/10/2014

F-Prot

W32/InstallRex.B.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Kazy.324119

11.2014-10-12_4

G Data

Win32.Application.InstalleRex

14.9.24

herdProtect (fuzzy)

variant of spyhunter 4.17.6.4336 full version with patch.exe (Adware)

2014.12.10.6

IKARUS anti.virus

PUA.InstallRex

t3scan.1.6.1.0

K7 AntiVirus

Trojan

13.176.11684

Kaspersky

Trojan.Win32.AntiFW

14.0.0.3180

Malwarebytes

PUP.Optional.InstalleRex

v2014.09.28.10

McAfee

PUP-FHQ!D6BB6F2CE8EA

5600.6993

MicroWorld eScan

Gen:Variant.Kazy.324119

15.0.0.1032

NANO AntiVirus

Riskware.Win32.InfoLeak.cvgqot

0.28.2.61148

nProtect

Adware/W32.Agent.311488

14.04.07.01

Panda Antivirus

PUP/TSUploader

14.09.28.10

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

9.14.14.00

Reason Heuristics

Adware.WebPick.Installer.R

14.9.28.22

Rising Antivirus

PE:PUF.InstallRex!1.9E4C

23.00.65.141208

Sophos

InstallRex

4.98

SUPERAntiSpyware

Adware.InstalleRex/Variant

10187

Total Defense

Win32/Tnega.RefOZd

37.0.11203

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4753027

31208

Zillya! Antivirus

Downloader.Adload.Win32.16843

2.0.0.1774

File size:

314.4 KB (321,904 bytes)

Product version:

1.0.0.3

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\diseno-cocinas-3d.exe

Digital Signature

Signed by:

Stanislav Kabin

Authority:

Unizeto Technologies S.A.

Valid from:

6/23/2014 8:28:15 AM

Valid to:

6/23/2015 8:28:15 AM

Subject:

E=Stanislav.Kabin@hotmail.com, CN=Stanislav Kabin, O=Stanislav Kabin, C=RU

Issuer:

CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:

3469022839E88D596EA6FE14C990AF76

File PE Metadata

Compilation timestamp:

3/12/2013 5:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:MrvbUzkuvcBYC47l2x0vOppHKip3Hrcgrz/xHWS1JH:MrkkuveY3oXpHggf4S1Z

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file diseno-cocinas-3d.exe has been seen being distributed by the following URL.

http://www.programas-gratis.net/.../diseno-cocinas-3d

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove diseno-cocinas-3d.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.