download.exe

Lior Sela

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application download.exe, “Installer for SoftSafe” by Lior Sela has been detected as adware by 36 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
SoftSafe  (signed by Lior Sela)

Product:
SoftSafe

Description:
Installer for SoftSafe

Version:
2013.4.10.1655

MD5:
563139c2e47eb9c07aaa7bdaefcabcc5

SHA-1:
86f9d096a6bd5542bb60068a3f40ef963f1de70f

SHA-256:
3548b03d44ca755a5039257d000961017d12bf873db0dddce9146f9e20f10fd8

Scanner detections:
36 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
10/20/2018 8:48:25 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.InstallRex.2
424

Agnitum Outpost
Trojan.XPACK
7.1.1

AhnLab V3 Security
Adware/Win32.StartPage
15.12.08

Avira AntiVirus
ADWARE/InstallRex.Gen
7.11.140.20

avast!
Win32:Downloader-UZF [PUP]
2014.9-151208

AVG
Adware AdInstaller.P
2016.0.2902

Bitdefender
Adware.Generic.424488
1.0.20.1710

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Agent-6667
0.98/20522

Comodo Security
Application.Win32.InstalleRex.KG
18014

Dr.Web
Adware.Downware.1166
9.0.1.0342

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.InstallRex
8.15.12.08.11

ESET NOD32
Win32/InstalleRex.E potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/InstalleRex
12/8/2015

F-Prot
W32/InstallRex.B
v6.4.6.5.141

F-Secure
Riskware.Gen:Variant.Application.Bundler
11.2015-08-12_3

G Data
Adware.Generic.424488
15.12.24

IKARUS anti.virus
PUP.InstallRex
t3scan.1.6.1.0

K7 AntiVirus
Adware
13.176.11595

Kaspersky
not-a-virus:HEUR:Downloader.Win32.AdLoad
14.0.0.1003

Malwarebytes
PUP.Optional.InstalleRex
v2015.12.08.11

McAfee
Artemis!DBC3E6441304
5600.6558

MicroWorld eScan
Adware.Generic.424488
16.0.0.1026

NANO AntiVirus
Riskware.Win32.Agent.crfiku
0.28.0.58720

Norman
Gen:Variant.Application.Bundler.InstallRex.2
11.20151208

nProtect
Trojan-Clicker/W32.Agent.291624
14.03.19.01

Panda Antivirus
PUP/TSUploader
15.12.08.11

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Quick Heal
Trojan.AntiFW.B5
12.15.14.00

Reason Heuristics
Adware.WebPick.Installer (M)
15.12.8.11

Rising Antivirus
PE:PUF.InstallRex!1.9E4C
23.00.65.151206

Sophos
PUA 'InstallRex'
5.15

SUPERAntiSpyware
Adware.InstalleRex/Variant
9460

Vba32 AntiVirus
Downloader.AdLoad
3.12.24.3

VIPRE Antivirus
Threat.14871
40552

Zillya! Antivirus
Dropper.Agent.Win32.132170
2.0.0.1779

File size:
283.3 KB (290,080 bytes)

Product version:
1.0.0.1

Copyright:
Copyright © 2012 SoftSafe

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\download.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
1/21/2013 4:00:00 PM

Valid to:
1/22/2014 3:59:59 PM

Subject:
CN=Lior Sela, O=Lior Sela, STREET=Moshe Sharet 46, L=Beer Sheva, S=Beer Sheva, PostalCode=84786, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00D39C56B89258E40E737B2AEDA8D3D3E5

File PE Metadata
Compilation timestamp:
3/12/2013 1:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:YrkY6Y0JQBkQRl7174NpNUM+UHs+CRndGvHpIUV1uwi0fa3TXY2q3:YrkY63yRl1uqM+gs+K8HpIUPpi0f2Rq3

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9553

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file download.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

TCP (HTTP):
Connects to c1.stylezip.info  (54.186.255.26:80)

 
http://c1.stylezip.info/?step_id=1&installer_id=37135194&publisher_id=713&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=111405582&external_id=0&session_id=222811164&hardware_id=259946358&installer_file_name=download

Remove download.exe - Powered by Reason Core Security