home

download.exe

system

Alexey Kurilenko

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application download.exe by Alexey Kurilenko has been detected as adware by 30 anti-malware scanners. This is a setup program which is used to install the application. It uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
and most definition DBMS relatively  (signed by Alexey Kurilenko)

Product:
system

Version:
3.9.0.0

MD5:
3f1c864fa2ef23010acc58ff6167b3dc

SHA-1:
547656495e574ba3505a57073708dc51b80f80f6

SHA-256:
abc437babe04f17b78227cd86727bc64c603933e4204ba1f8c32f982d01b1f14

Scanner detections:
30 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
5/7/2024 7:18:39 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Dropper.103
890

Agnitum Outpost
PUA.MultiPlug
7.1.1

AhnLab V3 Security
PUP/Win32.InstallRex
2014.08.29

Avira AntiVirus
Adware/MultiPlug.aob
7.11.169.230

avast!
Win32:InstalleRex-CH [PUP]
140813-1

AVG
Adware Generic5.AYRD
2014.0.4015

Bitdefender
Gen:Variant.Adware.Dropper.103
1.0.20.1205

Clam AntiVirus
Win.Adware.Agent-7655
0.98/19314

Comodo Security
Application.Win32.Multiplug.AB
19348

Dr.Web
BackDoor.Bull.723
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Dropper.103
9.0.0.4324

ESET NOD32
Win32/AdWare.MultiPlug.AP application
7.0.302.0

F-Prot
W32/A-6075dea0
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Dropper.103
11.2014-29-08_6

G Data
Gen:Variant.Adware.Dropper.103
14.8.24

IKARUS anti.virus
AdWare.SaveNet
t3scan.1.7.5.0

K7 AntiVirus
Adware
13.183.13198

Kaspersky
not-a-virus:HEUR:WebToolbar.Win32.Cossder
14.0.0.3334

Malwarebytes
Adware.Agent
v2014.08.29.02

McAfee
PUP-FLT
5600.7024

MicroWorld eScan
Gen:Variant.Adware.Dropper.103
15.0.0.723

NANO AntiVirus
Riskware.Win32.MultiPlug.dbvxax
0.28.2.61861

Panda Antivirus
PUP/TSUploader
14.08.29.02

Qihoo 360 Security
Malware.QVM10.Gen
1.0.0.1015

Reason Heuristics
PUP.AlexeyKurilenko.I
14.8.29.1

Sophos
MultiPlug
4.98

SUPERAntiSpyware
Adware.Dropper/Variant
10393

Vba32 AntiVirus
AdWare.Agent
3.12.26.3

VIPRE Antivirus
Threat.4150696
32210

Zillya! Antivirus
Adware.MultiPlug.Win32.22
2.0.0.1905

File size:
788.2 KB (807,088 bytes)

Product version:
3.9.0.0

Copyright:
Copyright (c) 2014

Original file name:
Obtaining which profiler language were are

File type:
Executable application (Win32 EXE)

Language:
English (United Kingdom)

Common path:
C:\users\{user}\downloads\download.exe

Digital Signature
Signed by:
Alexey Kurilenko

Authority:
Unizeto Technologies S.A.

Valid from:
6/17/2014 7:20:17 AM

Valid to:
6/17/2015 7:20:17 AM

Subject:
E=Alexey.kurilenko@hotmail.com, CN=Alexey Kurilenko, O=Alexey Kurilenko, C=RU

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
15D51642691B3EE20985639A8FE865DD

File PE Metadata
Compilation timestamp:
6/30/2014 9:53:45 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:Rc3sXMFFR0C/16QUXNjvaRCYzvxkuCCRuHCZrYMtXtotyC3tLS20v51S8:RCnL6QU9jvSRtCCR6CdYijCS20R1t

Entry address:
0x1EADB

Entry point:
E8, 87, 7C, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 28, 61, 43, 00, E8, 6F, 0D, 00, 00, E8, A2, 03, 00, 00, 0F, B7, F0, 6A, 02, E8, 1A, 7C, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 53, 45, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.7394  (probably packed)

Code size:
165 KB (168,960 bytes)

The file download.exe has been seen being distributed by the following URL.

http://applicationgrabb.net/149fc5b7d8c31f22dba1b60161261e0d/listen2/dl.php?id=1404621296880265243&r=http://newcreditcardgrab.info/.../?&q=Download&product_name=Download&installer_file_name=Download&__rnd=521dbaa8240ef0cc3fb5189968be21b7

Remove download.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.