home

download dan de bon.exe

Alexey Kurilenko

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application download dan de bon.exe, “Installer for TopApp soft” by Alexey Kurilenko has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
TopApp soft  (signed by Alexey Kurilenko)

Product:
TopApp soft

Description:
Installer for TopApp soft

Version:
2014.5.26.2303

MD5:
46ee16beeb09375a61b2278e551de979

SHA-1:
72ef88d8cc18a57d47ee3f74e06122b1867a7a15

SHA-256:
fc11facc8c9ecdee2cb69e85e16c18ad91cc0e9be3b4d1527523d9c9aff6f05d

Scanner detections:
26 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
4/26/2024 1:44:16 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.AntiFW
7.1.1

AhnLab V3 Security
PUP/Win32.TSULoader
2015.02.24

Avira AntiVirus
Adware/InstallRex.G
7.11.212.36

avast!
Win32:InstalleRex-DT [PUP]
150101-1

Bkav FE
W32.FamVT.AntiFWK.Trojan
1.3.0.6379

Clam AntiVirus
Win.Trojan.Antifw-7
0.98/20096

Comodo Security
Application.Win32.InstalleRex.KG
21184

Dr.Web
Trojan.WebPick.2533
9.0.1.05190

ESET NOD32
Win32/InstalleRex.M potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Generic.AC.4161048
2/23/2015

F-Prot
W32/InstallRex.B
4.6.5.141

G Data
Win32.Application.InstalleRex
15.2.25

K7 AntiVirus
Unwanted-Program
13.198.15051

Kaspersky
Trojan.Win32.AntiFW
14.0.0.2443

Malwarebytes
PUP.Optional.InstalleRex
v2015.02.23.10

McAfee
Program.PUP-FHQ
16.8.708.2

NANO AntiVirus
Riskware.Win32.InfoLeak.cvgqot
0.30.0.296

nProtect
Trojan/W32.AntiFW.323712
15.02.23.01

Panda Antivirus
PUP/TSUploader
15.02.23.10

Quick Heal
Trojan.AntiFW.A5
2.15.14.00

Reason Heuristics
Adware.WebPick.Installer
15.2.23.10

Rising Antivirus
PE:Trojan.DL.Win32.AntiFW.a!1075355932
23.00.65.15221

Sophos
PUA 'InstallRex'
5.10

Vba32 AntiVirus
AdWare.Agent
3.12.26.3

VIPRE Antivirus
Threat.4150696
37788

Zillya! Antivirus
Trojan.AntiFW.Win32.221
2.0.0.2079

File size:
316.1 KB (323,712 bytes)

Product version:
1.0.0.3

Copyright:
Copyright © 2014 TopApp soft

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Common path:
C:\users\{user}\downloads\download dan de bon.exe

Digital Signature
Signed by:
Alexey Kurilenko

Authority:
COMODO CA Limited

Valid from:
7/19/2013 2:00:00 AM

Valid to:
7/20/2014 1:59:59 AM

Subject:
CN=Alexey Kurilenko, O=Alexey Kurilenko, STREET="Str. Sums'ka, 28", L=Kharkiv, S=Kharkivska, PostalCode=61057, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EC26735E2AD490D07645FA7A606FA1EE

File PE Metadata
Compilation timestamp:
3/12/2013 9:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:PrYbUzkuvcBYC47l2xa6g4FhwjZd/9d1XKxlo/ecwrHs5r:PrdkuveY36kjZP/XKxlSZAHK

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file download dan de bon.exe has been seen being distributed by the following URL.

http://welovecoupon.eu/v2109?installer_file_name=Download dan de bon

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

Remove download dan de bon.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.