downloads.exe
IronInstall
The application downloads.exe by IronInstall has been detected as adware by 7 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from 50ftwares.com.
MD5:
298f2e7d015b441e828c7c31ac4e479b
SHA-1:
4373a36e3690507d7794af22b5de3145e68c08cf
SHA-256:
7274d2558af3d7f632bb48d8153aa786819a3da3a33bb35be62d7cf6ff550913
Scanner detections:
7 / 68
Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.
Analysis date:
4/26/2024 11:59:27 AM UTC (today)
Scan engine
Detection
Engine version
avast!
Win32:Installer-I [PUP]
2014.9-130726
Dr.Web
Adware.InstallCore.101
9.0.1.0207
ESET NOD32
Win32/InstallCore.BY (variant)
7.8545
McAfee
Artemis!298F2E7D015B
5600.7148
Reason Heuristics
PUP.IronInstall.J
14.8.7.18
Trend Micro House Call
TROJ_GEN.F47V0708
7.2.207
VIPRE Antivirus
InstallCore
19426
File size:
610.6 KB (625,208 bytes)
File type:
Executable application (Win32 EXE)
Common path:
C:\users\{user}\downloads\downloads.exe
Authority:
COMODO CA Limited
Valid from:
11/19/2012 4:00:00 PM
Valid to:
11/20/2015 3:59:59 PM
Subject:
CN=IronInstall, O=IronInstall, STREET=63 Rothschild Blvd., L=Tel-Aviv, S=NA, PostalCode=65785, C=IL
Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Serial number:
2DC5BB8E9D823CD0C4F09AE859BBBEAC
Compilation timestamp:
6/19/1992 3:22:17 PM
Code size:
36 KB (36,864 bytes)
The file downloads.exe has been seen being distributed by the following URL.