down.2988.ext_setup.exe

Pavel KRASNOV

This installer (utilizes the InstalleRex from WebPick) is designed to bundle additional software offerings such as adware and malware, mostly web browser extensions in the download manager, with minimal user consent. In most cases the setup process will install a browser extension for IE, Chrome and Firefox by default. The application down.2988.ext_setup.exe by Pavel KRASNOV has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address dl.softservers.net on port 80 using the HTTP protocol.
Publisher:
Pavel KRASNOV  (signed and verified)

MD5:
e577d63f483e939fdcb45ab1ae776250

SHA-1:
b94223155c8aa4cf6706161110dc8b12ed2891f4

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Bundles additional adware offers in the installer/setup process.

Analysis date:
4/23/2024 9:53:49 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick.PavelKRASNOV.Installer (M)
16.2.13.10

File size:
800 KB (819,200 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\Local settings\temp\down.2988.ext_setup.exe

Digital Signature
Signed by:

Authority:
Unizeto Technologies S.A.

Valid from:
1/17/2014 12:46:29 PM

Valid to:
1/17/2015 12:46:29 PM

Subject:
E=pavel0125@hotmail.com, CN="Open Source Developer, Pavel KRASNOV", O=Pavel KRASNOV, C=RU

Issuer:
CN=Certum Level III CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
145B82E22CCF1D1A2268198D76B51075

File PE Metadata
Compilation timestamp:
1/22/2014 2:38:14 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:UTf4va3K7iZKjVNutFlV+E1PkuiQ6ZnfKwBnc:UTgAaiZKPzFQ6JC+c

Entry address:
0xDC0B

Entry point:
E8, 7E, 44, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, B8, DC, 41, 00, E8, DF, 12, 00, 00, E8, CB, 0F, 00, 00, 0F, B7, F0, 6A, 02, E8, 11, 44, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 96, 01, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.2327

Code size:
87 KB (89,088 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to i1.stylefun.info  (198.7.61.118:80)

TCP (HTTP):
Connects to dl.softservers.net  (184.154.145.171:80)

TCP (HTTP):
Connects to c1.getapplicationmy.info  (54.201.215.30:80)

Remove down.2988.ext_setup.exe - Powered by Reason Core Security