duplicatephotofinder_setup.exe

Rspark LLC

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application duplicatephotofinder_setup.exe by Rspark has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. It is also typically executed from the user's temporary directory.
Remove duplicatephotofinder_setup.exe - Powered by Reason Core Security
Publisher:
Rspark LLC  (signed and verified)

MD5:
aac21f898329c4ade4b4ba26d2d81231

SHA-1:
e1f09eaa28133bd21a74129dd287384cf2920018

SHA-256:
a8a1e4c24e082658512edcdfaecc535533f54923de286f3aaeb28e2d136f0b82

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/4/2016 11:13:55 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
MemScan:Application.Bundler.Outbrowse.E
969

Bitdefender
MemScan:Application.Bundler.Outbrowse.E
1.0.20.805

ESET NOD32
Win32/OutBrowse
8.9921

F-Secure
MemScan:Application.Bundler.Outbrowse
11.2014-10-06_3

G Data
MemScan:Application.Bundler.Outbrowse
14.6.24

Malwarebytes
PUP.Optional.OutBrowse
v2014.06.10.07

MicroWorld eScan
MemScan:Application.Bundler.Outbrowse.E
15.0.0.483

Qihoo 360 Security
Win32/Application.af9
1.0.0.1015

Reason Heuristics
PUP.Installer.Rspark.AA
14.6.10.19

Trend Micro House Call
TROJ_GEN.F47V0603
7.2.161

VIPRE Antivirus
Trojan.Win32.Generic
30148

Remove duplicatephotofinder_setup.exe - Powered by Reason Core Security
File size:
921.2 KB (943,344 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou (using Nullsoft Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\duplicatephotofinder_setup.exe

Digital Signature
Signed by:

Authority:
DigiCert Inc

Valid from:
11/24/2013 6:00:00 PM

Valid to:
1/26/2015 6:00:00 AM

Subject:
CN=Rspark LLC, O=Rspark LLC, L=Seattle, S=Washington, C=US

Issuer:
CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0ADE80060D1D9FFF62ADB2CF331C657C

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:WyHXdyZNrNF/4lgGhpwJxmntY1VKc9IsTELQX:5HXc3BqXp6fScKsILG

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9173

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

Remove duplicatephotofinder_setup.exe - Powered by Reason Core Security